2

I'm running Ubuntu 12.04 as a webserver with multiple websites. I want to grant users FTPS access to certain directories in order to administer the website. I have the directories for multiple sites set up as normal -

/var/www/htdocs/website1
/var/www/htdocs/website2

I've installed vsftpd using this guide :

https://www.digitalocean.com/community/tutorials/how-to-configure-vsftpd-to-use-ssl-tls-on-an-ubuntu-vps

but instead of setting up the user as specified in the guide I added user1 to the www-data group. I've chroot'ed that users home directory to the individual sites directory.

So here's my question, I know the next step would be to chmod the directory and it's contents to allow rwx for the www-data group but I'm not sure if that is the proper way of doing it from a security point of view. What are the implications of setting things that way and is there a better way of doing it?

  • chmod to allow access to the individual user, while allowing r-x rights for the group – td512 May 12 '15 at 11:50
  • Why don't you just use SFTP instead? – paradroid May 12 '15 at 13:01
  • What's the benefit over SFTP over FTPS? I was just using FTPS for the learning experience but am open to suggestions The group already has r-x access. Do you have a chmod example for an individual user? Wouldn't I have to chown for that? – mactire May 12 '15 at 15:07
  • @mactire SFTP uses the same credentials and ACLs as SSH. You do not need to set anything else up. You just need an SFTP client, which works very much the same way as an FTP client. – paradroid May 13 '15 at 23:19
  • For shared hosting, you need to consider more than just FTP. If your webserver executes PHP or whatnot as www-data (group) and every directory is readable or even writable by www-data, everyone can read (or even write) each others data. Unfortunately, there’s no painless solution. – Daniel B May 14 '15 at 17:15
2

The best option here would be to uninstall ftp and use sftp only. It's easy to use and highly secure (military-grade secure). ACL of the wwwdoc folder needs to be setup in a way that user can write to it and change containing files/folders ownership. To connect to the server, make users use SFTP client (sftp or scp command for Linux users, WinSCP for Windows users).

  • scp is not a SFTP client. – Daniel B May 14 '15 at 17:10
  • It's not, but can be used as one. – Tomas Tudja May 14 '15 at 17:14
  • No, it can’t. It uses the SCP protocol. It uses SSH as well but is completely different from SFTP. – Daniel B May 14 '15 at 17:16

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.