vsftp chroot

goodiemobster · 01-31-2022, 08:54 AM

Hi,

I have set up vsftp on an ubuntu 20 server but I can't restrict (the only) user to only be able to upload to /var/www/vhosts/my.site.com

Once connected he can browse to all dirs

vsftpd.conf:

Code:

connect_from_port_20=YES
listen=YES
listen_ipv6=NO
pam_service_name=vsftpd
syslog_enable=YES
anonymous_enable=NO
local_enable=YES
local_root=/var/www/vhosts/my.site.com
local_umask=002
write_enable=YES
seccomp_sandbox=NO
chroot_local_user=YES
allow_writeable_chroot=YES

Any advice much appreciated! tnx in advance!

Turbocapitalist · 01-31-2022, 10:35 AM

There are so very few legitimate use-cases for 1970s FTP these days in 2022 that I would ask what are your reasons for trying it? Usually most calls for assistance with FTP turn out to be X Y Problems, plus it is quite difficult to set up compared to SFTP.

I would also point out that if you are connecting with SSH then you already have SFTP and can use that. Additionally, most graphical "FTP" clients have built-in SFTP support since many years back. CyberDuck, FileZilla, Nautilus, WinSCP, and so on all can use SFTP. The best part is that SFTP support is part of OpenSSH-server out of the box and is easy, almost trivial to chroot.

goodiemobster · 01-31-2022, 10:45 AM

Hi,
Tnx for your reply, I know but our company uses worldwide devs on freelance basis for scraping and some of those devs want it like this.
In our older environment we used plesk for them which was easier to configure.

wpeckham · 01-31-2022, 10:48 AM

Your obsolete solution may be found in articles like this one https://ylmzmtl.com/vsftpd_chroot_home_dir/.

Turbocapitalist · 01-31-2022, 11:01 AM

Quote:

Originally Posted by goodiemobster

Hi,
Tnx for your reply, I know but our company uses worldwide devs on freelance basis for scraping and some of those devs want it like this.

Time for them to examine their software for SFTP support. It's high-risk to use FTP these days and it'd be safer, taking into account improvements and simplifications from the last 2+ decades. But to stall, you can see the link in #4 above.

TB0ne · 02-01-2022, 08:27 AM

Quote:

Originally Posted by goodiemobster

Hi,
Tnx for your reply, I know but our company uses worldwide devs on freelance basis for scraping and some of those devs want it like this. In our older environment we used plesk for them which was easier to configure.

What is 'scraping' in this context, please?? And if these 'worldwide devs' work for your company, then it is YOUR COMPANY that sets the rules. It's as simple as saying, "We are now using SFTP; if you'd like to work with us, this is what you're going to use, because FTP is incredibly insecure.".