Question about vsftpd security (or just ftp in general)

scorbett · 03-31-2006, 03:00 PM

In the man page for vsftpd.conf, I find the following note:

Quote:

chroot_local_user

If set to YES, local users will be (by default) placed in a chroot() jail in their home
directory after login. Warning: This option has security implications, especially if the
users have upload permission, or shell access. Only enable if you know what you are doing.
Note that these security implications are not vsftpd specific. They apply to all FTP dae-
mons which offer to put local users in chroot() jails.

Default: NO

Can anyone explain to me exactly what those security implications are? I want to allow local users to be able to ftp in to their home directories (and only to their home directories) to be able to upload/download stuff. Some users will also have a public_html directory that will be web-accessible. No one except me will have telnet or ssh access.

The rather cryptic wording of the above warning note in the man page has me curious - the only security implication I can think of is that users would be able to upload stuff to their public_html directory to make it web accessible, but that's the whole idea. Am I missing something? Am I about to open a glaring security hole on my server?

win32sux · 03-31-2006, 04:35 PM

Quote:

Originally Posted by scorbett

In the man page for vsftpd.conf, I find the following note:

Code:

chroot_local_user

If set to YES, local users will be (by default) placed in a chroot() jail in their home
directory after login. Warning: This option has security implications, especially if the
users have upload permission, or shell access. Only enable if you know what you are doing.
Note that these security implications are not vsftpd specific. They apply to all FTP dae-
mons which offer to put local users in chroot() jails.

Default: NO

Can anyone explain to me exactly what those security implications are? I want to allow local users to be able to ftp in to their home directories (and only to their home directories) to be able to upload/download stuff. Some users will also have a public_html directory that will be web-accessible. No one except me will have telnet or ssh access.

The rather cryptic wording of the above warning note in the man page has me curious - the only security implication I can think of is that users would be able to upload stuff to their public_html directory to make it web accessible, but that's the whole idea. Am I missing something? Am I about to open a glaring security hole on my server?

i'm not sure, but it sounds like the text might be trying to say the inverse of what you've interpreted... like, it might be saying that by using that option you will be "clamping-down" on users with stricter security... and more security usually means less usability, which i think is what is being talked about here...

dopehouse · 03-31-2006, 04:46 PM

The problem is that with normal ftp your password and username is transfered in cleartext over the net. So you should setup an sftp server, which uses ssl to encrypt the communication.

scorbett · 03-31-2006, 04:46 PM

Quote:

Originally Posted by win32sux

i'm not sure, but it sounds like the text might be trying to say the inverse of what you've interpreted... like, it might be saying that by using that option you will be "clamping-down" on users with stricter security... and more security usually means less usability, which i think is what is being talked about here...

If that's the case, then there's no problem here. I'd rather be too secure than not secure enough! Just from the way it's worded, though, it really sounds to me like you risk opening up a security hole by doing that. Maybe I'm just reading it wrong.

win32sux · 03-31-2006, 04:47 PM

Quote:

Originally Posted by dopehouse

The problem is that with normal ftp your password and username is transfered in cleartext over the net. So you should setup an sftp server, which uses ssl to encrypt the communication.

huh?? this has like *nothing* to do with the chroot question...

scorbett · 03-31-2006, 04:48 PM

Quote:

Originally Posted by dopehouse

The problem is that with normal ftp your password and username is transfered in cleartext over the net. So you should setup an sftp server, which uses ssl to encrypt the communication.

I already have an sftp server, but some of my users aren't very computer-literate and want to be able to use IE's built-in ftp capabilities so transfer their stuff, which is why I'm looking into settup up ftp as well.

win32sux · 03-31-2006, 04:52 PM

Quote:

Originally Posted by scorbett

If that's the case, then there's no problem here. I'd rather be too secure than not secure enough! Just from the way it's worded, though, it really sounds to me like you risk opening up a security hole by doing that. Maybe I'm just reading it wrong.

yeah, it is definitely worded kinda funny... then again, please remember that i am not 100% sure about my interpretation...

BTW, if you wanna harden your chroot jails (among other things) you can use grsecurity:

http://grsecurity.net/

dopehouse · 03-31-2006, 04:53 PM

Quote:

Originally Posted by win32sux

huh?? this has like *nothing* to do with the chroot question...

Sorry. Next time I'll read the question twice

dopehouse · 03-31-2006, 04:56 PM

Could it be because chroot have to run as root user? Not 100% sure.