LinuxQuestions.org
Download your favorite Linux distribution at LQ ISO.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices


Reply
  Search this Thread
Old 12-26-2015, 04:27 PM   #1
tripialos
Member
 
Registered: Apr 2012
Posts: 169

Rep: Reputation: Disabled
Question FTP file permissions behavour


I am facing a wierd behavour on my FTP setup which i dont know if this is normal.

I have setup an ftp server on a Centos6 machine using vsftpd. This service is just a demo in order for me to tests various "staff".

My setup allows anonymous connections to the ftp server with upload and download rights. The folder i am sharing is
Code:
/var/ftp/ftpshares
I changed the group of the folder to
Code:
ftp group
and gave permission of 775:

Code:
ll -la
total 16
drwxr-xr-x.  4 root root 4096 Dec 22 06:35 .
drwxr-xr-x. 24 root root 4096 Nov 29 14:18 ..
drwxr-xr-x.  2 root ftp  4096 Dec 22 06:42 ftpshares
drwxr-xr-x.  2 root root 4096 Mar  6  2015 pub
With the above permissios, when i login to fpt as anonymous i can
a) view the contents of directory
b) cannot upload (write)


Now when i change ftpshares folder to 775 i can also upload files as anonymous:
Code:
#ls -la
total 16
drwxr-xr-x.  4 root root 4096 Dec 22 06:35 .
drwxr-xr-x. 24 root root 4096 Nov 29 14:18 ..
drwxrwxr-x.  2 root ftp  4096 Dec 22 06:44 ftpshares
drwxr-xr-x.  2 root root 4096 Mar  6  2015 pub
I belive this is normal since i am giving "write" permissions to the group (ftp) of the folder. I assume that these permissions are only reflect the group permissions of the folder which is the group ftp.

Now where it gets wierd (at least for me), is that when i remove the "others" read permissions from the folder then when i login to the ftp server as anonymous i cannot view/list the file within the folder. Permissions are set as bellow:

Code:
[root@server ftp]# ls -la
total 16
drwxr-xr-x.  4 root root 4096 Dec 22 06:35 .
drwxr-xr-x. 24 root root 4096 Nov 29 14:18 ..
drwxrwxr-x.  2 root ftp  4096 Dec 22 06:44 ftpshares
drwxr-xr-x.  2 root root 4096 Mar  6  2015 pub
[root@server ftp]# chmod -R 771 ftpshares/
[root@server ftp]# ls -la
total 16
drwxr-xr-x.  4 root root 4096 Dec 22 06:35 .
drwxr-xr-x. 24 root root 4096 Nov 29 14:18 ..
drwxrwx--x.  2 root ftp  4096 Dec 22 06:44 ftpshares
drwxr-xr-x.  2 root root 4096 Mar  6  2015 pub
[root@rhce-server ftp]#
With the above permissions i can write/upload files but i CANNOT view contents of folder.

Why is this happening, why the anonymous user loses the rights to ls/read the contents of the ftp directory if read permission is removed from the "others restriction".

As far as i know anonymous users are "bound" to the ftp user wihtin the system hence when an anoymous user logins on the server the permissions would have been thus of "group" permissions assigned to the folder.

I dont understand how both "group" and "other" permissions affect the behavour of ftp folder to be shared.

Anyone came across with this?

Last edited by tripialos; 12-26-2015 at 04:32 PM. Reason: grammar
 
Old 12-27-2015, 09:48 AM   #2
jpollard
Senior Member
 
Registered: Dec 2012
Location: Washington DC area
Distribution: Fedora, CentOS, Slackware
Posts: 4,797

Rep: Reputation: 1425Reputation: 1425Reputation: 1425Reputation: 1425Reputation: 1425Reputation: 1425Reputation: 1425Reputation: 1425Reputation: 1425Reputation: 1425
Check your SELinux permissions. By default (I don't use ftp...) the defined permissions are:

Code:
$ getsebool -a | grep ftp
ftp_home_dir --> off
ftpd_anon_write --> off
ftpd_connect_all_unreserved --> off
ftpd_connect_db --> off
ftpd_full_access --> off
ftpd_use_cifs --> off
ftpd_use_fusefs --> off
ftpd_use_nfs --> off
ftpd_use_passive_mode --> off
httpd_can_connect_ftp --> off
httpd_enable_ftp_server --> off
sftpd_anon_write --> off
sftpd_enable_homedirs --> off
sftpd_full_access --> off
sftpd_write_ssh_home --> off
tftp_anon_write --> off
tftp_home_dir --> off
Unless sftpd_anon_write is allowed the ftp server is prevented from writing.

Anonymous FTP is known to be a security problem, thus the added constraints on the server (reference the manpage on sftpd_selinux).

As for the inability of the anonymous user to read directories: I believe it is because the anonymous user is the user "nobody", and without world read access that user cannot read the directory.

Last edited by jpollard; 12-27-2015 at 10:00 AM.
 
Old 12-28-2015, 03:57 AM   #3
tripialos
Member
 
Registered: Apr 2012
Posts: 169

Original Poster
Rep: Reputation: Disabled
Quote:
Originally Posted by jpollard View Post
Check your SELinux permissions. By default (I don't use ftp...) the defined permissions are:

Code:
$ getsebool -a | grep ftp
ftp_home_dir --> off
ftpd_anon_write --> off
ftpd_connect_all_unreserved --> off
ftpd_connect_db --> off
ftpd_full_access --> off
ftpd_use_cifs --> off
ftpd_use_fusefs --> off
ftpd_use_nfs --> off
ftpd_use_passive_mode --> off
httpd_can_connect_ftp --> off
httpd_enable_ftp_server --> off
sftpd_anon_write --> off
sftpd_enable_homedirs --> off
sftpd_full_access --> off
sftpd_write_ssh_home --> off
tftp_anon_write --> off
tftp_home_dir --> off
Unless sftpd_anon_write is allowed the ftp server is prevented from writing.

Anonymous FTP is known to be a security problem, thus the added constraints on the server (reference the manpage on sftpd_selinux).

As for the inability of the anonymous user to read directories: I believe it is because the anonymous user is the user "nobody", and without world read access that user cannot read the directory.
I have enabled all SELinux settings in order for anonymous users to have write access on the ftp share. I think anonymous user uses the ftp user because the folder group ownership is set to ftp. When i remove the write permissions on the particular folder from the group (fp), then i cannot upload as anonymous. When i give write permissions (g+w) then anonymous can upload hence I concluded that anonymous users are assigned as "ftp" user. Also, uploaded files from anonymous user have ftp:ftp.

If indeed this is the case, and folder permissions affecting ftp services are this of the "group" (Assuming folder is owned by group ftp) why does the "world" read permission also affect the ftp user...
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
FTP File Permissions Hambone_20003 Linux - Software 3 07-26-2007 06:24 PM
FTP File Permissions Issue KrGAce Linux - Networking 1 01-11-2006 06:33 PM
ftp changes file permissions! seran Linux - General 2 07-13-2005 07:34 AM
File/Folder Permissions with FTP scottpioso Linux - Security 8 03-12-2004 02:19 PM
locking a usage policy file/ftp file permissions gbow Linux - Newbie 0 02-16-2004 05:35 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie

All times are GMT -5. The time now is 04:04 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration