Hi;

I just setup a vsftpd server and I am baffled about one issue. I allow local login and have not chroot anybody and disallow anonymous login. When connected as a local user I can browse the servers file system including the root (/) directory. There I can download whatever file I want but not write to it.
All permissions are untouched since installing the server.
Looking at the file permissions they are in general rwxr-xr-x (root root)

Isn't this a security threat? If so it seems strange as these are the default permissions. I don't dare changing the permissions for the entire file system.

Hope somebody can clarify this issue for me.

Thanks!

In short, yes this can be a security threat. You mentioned you have not chrooted users. A chroot jail is most likely what you are looking for, however. I can suggest a few places to look as I have set this up before in the past using these same pages (I kept them bookmarked).

This creates a script to auto setup a chroot jail. It's very easy to understand and follow:
http://www.fuschlberger.net/programs...p-chroot-jail/

This helps explain how to setup a chrooted environment for rssh:
http://www.cyberciti.biz/tips/howto-...ail-setup.html

This user, Falko Timme is brilliant with detailing his walkthroughs. For some reason anytime I look for how to do something, I always seem to find his guides:
http://www.howtoforge.com/chrooted-s...l-debian-lenny

Rich