FTP chroot_local_user Security implications
 

On Ubuntu Server 9.10 (legecy system) I have setup "vsftpd"

This is simply to allow clients to FTP stuff to their webserver without me having to do it for them.

I have created a noshell user with a home directory pointing to thier webserver root.

I have set the uploaded files flag to change permissions to the webserver user on upload and I have limited them to only browse their home directory using the chroot_local_user.

This part has a security warning and I fail to see what the problem is - several sites go on about the simplicity of jail breaking but surely without this set the user could stomp all over the file system anyway?

My Question is; is it better to have this than not have this set? I trust my users and the passwords are strong.

And... Is it better to use the "chroot_list_enable" rather than the blanket "chroot_local_user"?

In the face of this I would much rather have a list that says "ONLY ALLOW THE FOLLOWING USERS TO FTP IN".

Thanks
Paul

In short: yes but.
* Yes because even if FTP credentials would be leeched (not that uncommon for users running A Certain Other OS) it would not grant the user rights to perform system recon.


In turn I say there is no compelling reason to trust unprivileged users by default.
* Yes but be aware chrooting is part of system security but does not constitute system hardening, there's more required.
* Yes but be aware it does not prevent a user uploading any file and having Perl or PHP execute it. Examples: running scripts involving .htaccess modification, loading crontabs, MySQL injection, local or remote file inclusion and such due to running vulnerable applications or plugins in the web application stack. That's why keeping up to date, auditing and proper system hardening are important.


It's the choice of chrooting all users versus chrooting a list of users. A choice for the first option obviously ensures everyone is automagically chrooted so no newly added account need to be added to any list.


Using Vsftpd with a PAM stack you can use the listfile module to create a list of allowed local user accounts.