For security reason, I wanted to have the guest users (which I created for them to access my ftp server) 'jailed' to their designated home directory so that they could not 'cd' above their home dir. Upon advice from other experts of Linux OS, I tried the following setup (I'm using RH 8.0 installed with the vsftp by default) but to no avail.

User name: theguest
Designated home dir: /home/theguest
UID:501
GID:501

Steps to set up the required account:

- adduser theguest
- passwd theguest

- vi /etc/passwd (to add /./ to the home dir as follows)
theguest:*:501:501::/home/theguest/./:/etc/ftponly
- vi /etc/shells to add "/etc/ftponly" to the end of the file
- vi /etc/group to add "client::501:theguest"
- vi /etc/ftpaccess to add the following lines
class local real,guest,anonymous
guestgroup client

- chown theguest.client /home/theguest
- chmod 755 /home/theguest

- cp -a /var/ftp/etc ~theguest
- cp -a /var/ftp/bin ~theguest
- cp -a /var/ftp/lib ~theguest

- cd /home/theguest
- chown root.daemon etc bin lib
- chmod 111 etc bin lib

- cd ~theguest/etc
- vi ~theguest/etc/passwd to contain the following:
root:*:0:0::/:/etc/ftponly
theguest:*:501:501::/home/theguest/./:/etc/ftponly
- vi ~theguest/etc/group to contain the following:
root::0:root
client::501:theguest

- chown root.daemon passwd group
- chmod 444 passwd group

But unfortunately, the above setup DID NOT work at all! Designated guest users still could 'CD' above their home dir! Did I miss something/steps?

My friend (who are using RH 7.3 with WU-fpt installed) advised me to add the following command to etc/ftpaccess to have the same effect of 'chrooting' the home dir. of the guest users.

restricted-UID*

Still, it did not have any effect on my server. Is the above command a global one which is applicable to all ftp servers?

Can anyone here please advise on that?

Cheers

Well all the steps you took is the normal way to get a daemon running in a chrooted environment. The only thing you didn't do was actually run the ftp server with a chroot command. It's usually quite a hastle to get a daemon running in a chrooted environment if all you want to do is restrict users to their home directories. So most FTP servers allow this to be done by adding an extra line to the configuration file. I don't know wu-ftpd but the instructions you where given to add that line in the /etc/ftpaccess is specific to wu-ftpd. With proftpd you would add the following line to the proftpd.conf file:
DefaultRoot ~

And then again I know nothing about vsftp so I don't know if there are other options for getting this done besides setting up a complete chroot environment.

Hi

You have to add two entries in your configuration file like this

chroot_list_enable=YES
chroot_list_file=/etc/name_of_file_you_want (default is /etc/vsftpd.chroot_list)

and that should do the trick.

Azael

Thanks for the prompt reply. I got another question: How can I assign / preset limited capacity to each individual users which I created? Say, 10 mb for user1 (e.g. for uploading stuff) and 30 mb for user2.....

Cheers

Hi, there!
When I used quotacheck -a to create quota file, I got the following error message:
Quotecheck: cannot get the qouta file name for /dev/hd3

I have modified the /etc/fstab as follows before the quotecheck -a command:
.../home ext3 defaults,usrquota,grpquota 1 2

Can anyone please advise?
Cheers.

You have to create the Quata files (aquata.user) before you run the quotacheck command. I had experienced the same problem when tried to use quotacjeck without creating files.