VSFTPD and user lock to a path

bathory · 11-24-2014, 12:10 PM

Quote:

chroot_list_enable ?

i have this with the comment:

#chroot_list_enable=YES

maybe i must uncomment it and use it as YES ?

You don't need it. See the vsftpd.conf manpage:

Quote:

chroot_list_enable
If activated, you may provide a list of local users who are placed in a chroot() jail in their home directory upon login. The meaning is slightly different if chroot_local_user is set to YES. In this case, the list becomes a list of users which are NOT to be placed in a chroot() jail. By default, the file containing this list is /etc/vsftpd.chroot_list, but you may override this with the chroot_list_file setting.

Default: NO

ASTRAPI · 11-24-2014, 05:06 PM

Ok i leave it as it is but any ideas why is not working and the user can browse to / ?

Maybe a folders permissions are wrong?

ASTRAPI · 11-24-2014, 06:04 PM

Ok i found a working tutorial and all is working now using this:

Code:

http://www.thegeekstuff.com/2012/03/chroot-sftp-setup/

All great but now i want to use my path instead of the /sftp/guestuser/incoming

Code:

/home/nginx/domains/mydomain.com/public/uploads

I try to use this command:

Code:

usermod -d /home/nginx/domains/mydomain.com/public/uploads -s /sbin/nologin guestuser

and then restart the ssh but nothing

The user is going to the old path again...

The problem seems to be that is working only with a path that the username of a user exists and in path it doesn't exist

Running this grep guestuser /etc/passwd

i am getting the correct path but not working:

Code:

guestuser:x:504:504::/home/nginx/domains/mydoamin.com/public/uploads:/sbin/nologin

bathory · 11-25-2014, 12:57 AM

Quote:

I try to use this command:

usermod -d /home/nginx/domains/mydomain.com/public/uploads -s /sbin/nologin guestuser

and then restart the ssh but nothing

Huh! ssh has nothing to do with vsftpd.
I guess you're trying to setup sftp (that is based on ssh), but is totally different from ftp (based on a ftp server like vsftpd)
So using the vsftpd config posted above and using ftp, your user can transfer files in the desired location using the ftp protocol
If you want to use sftp, have a look here for an example (written for debian, but applies to any distro)

Regards

ASTRAPI · 11-25-2014, 11:58 AM

Yes ok this works but the problem is that i can't use a path without users name like:

Code:

/home/nginx/domains/mydomain.com/public

I must have the users name on the link to work....

Code:

/home/username

And the second problem is permissions as i have nginx:nginx and all working great with my site and if i change them to root:root then the site is not working..

bathory · 11-25-2014, 03:27 PM

Quote:

Yes ok this works but the problem is that i can't use a path without users name like:

/home/nginx/domains/mydomain.com/public

I must have the users name on the link to work....

/home/username

Are you talking about sftp or ftp? In both cases if you set the user homedir the same as the docroot, there should be no problem.

Quote:

And the second problem is permissions as i have nginx:nginx and all working great with my site and if i change them to root:root then the site is not working..

As I've told you nginx does not bother about ownership of docroot, assuming that you have 755 for folders and 644 for files

ASTRAPI · 11-25-2014, 04:00 PM

I am talking about sftp and yes i have 755 for folders and 644 for files but if i set the nginx folder to root:root then is not working the site

bathory · 11-26-2014, 12:34 AM

Quote:

Originally Posted by ASTRAPI

I am talking about sftp and yes i have 755 for folders and 644 for files but if i set the nginx folder to root:root then is not working the site

Please define "is not working the site". What is the error you get?
BTW why set ownership to root:root and not let the directory owned by the normal user?

ASTRAPI · 11-26-2014, 01:36 PM

Quote:

Originally Posted by bathory

Please define "is not working the site". What is the error you get?
BTW why set ownership to root:root and not let the directory owned by the normal user?

I am getting a blank white page and on error logs i get permission denied.

It works only with nginx:nginx permissions....

Thanks

bathory · 11-26-2014, 04:05 PM

Quote:

Originally Posted by ASTRAPI

I am getting a blank white page and on error logs i get permission denied.

It works only with nginx:nginx permissions....

Thanks

You didn't mention your distro, so I think you're using a RHEL or derivative and the error you get is because of SELinux.
If that's the case disable it temporarily and see what you get.
Or use:

Code:

chcon -R -t httpd_sys_content_t /home/nginx/domains/mydomain.com/public

ASTRAPI · 11-26-2014, 06:53 PM

I am using Centos and SElinux is disabled....

bathory · 11-27-2014, 12:42 AM

Quote:

Originally Posted by ASTRAPI

I am using Centos and SElinux is disabled....

Then it should work regardless ownership.
Anyway add the user in nginx group and see what happens. Other than that, I don't know what else to think.

ASTRAPI · 11-27-2014, 02:59 PM

Ok anyway thanks for your help !!!!

SAbhi · 11-27-2014, 09:46 PM

one of the reason why nginx is the only working could be avlue that was set on vsftpd.conf something like "vsftpd_user=nginx"