Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

So I'm on a VPS - CentOS Linux installation. I have vsFTPd on the server. I currently have SFTP access to the server via my root user, but am now trying to create a new user with FTP access to a specific directory only on the server, I've done the following:

1. mkdir /var/www/mydomain.com
2. mkdir /var/www/mydomain.com/html
3. useradd <-username>
4. passwrd <-username>
5. chown –R <-username> /var/www/mydomain.com
5. groupadd <-groupname>
6. gpasswd -a <-username> <-groupname>
7. chgrp -R <-groupname> /var/www/mydomain.com
8. chmod -R g+rw /var/www/mydomain.com

What I'm struggling to do is to create the user to ONLY have access to /var/www/mydomain.com - I experience that the user correctly logs into the wished folder, HOWEVER I can then browse "back" to other directories. I want the user to stick in the specific folder and not being able to "browse" back.

Any ideas?

I've found different articles on chrooting, but simply haven't figured it out to use it in the steps included above.

share|improve this question
    
Should be passwd not passwrd –  Brad Jun 28 '14 at 16:56

5 Answers 5

up vote 16 down vote accepted

It's quite simple.

You have to add the following option on the vsftpd.conf file

chroot_local_user=YES

The documentation inside the configuration file is self-explanatory:

# You may specify an explicit list of local users to chroot() to their home
# directory. If chroot_local_user is YES, then this list becomes a list of
# users to NOT chroot().

This means, that the user will just have access on the folder you configured as HOME of the user.Below, i have an example of a user passwd entry:

upload_ftp:x:1001:1001::/var/www/sites/:/bin/bash

Edit 1: Set the home directory of the user with the following command

usermod -d /var/www/my.domain.example/ exampleuser
share|improve this answer
    
Hi nwildner! Thanks so much for taking the time to answer me on this. So in my vsftpd.conf file ive added the following line "chroot_local_user=YES" - then as I understand it I need to add a line similar to the one you show for my user? Must admit im not entirely sure what to write there with the example you provide. the "1001" etc what is that? Lets assume my user is called: "im_a_linux_noob" and the directory for that user is: "/var/www/mydomain.com" - how would that look like? –  user1231561 Jul 16 '13 at 14:16
    
And would I be able to do this without any additional steps of what ive done in my post? So doing 1-8 and then adding what you describe should do the trick? –  user1231561 Jul 16 '13 at 14:18
    
Hi. The example above is just a line(modified, of course) of the /etc/passwd file, that represents a user called upload_ftp, 1001:1001 is his User Id and Group ID, /var/www/sites is the home directory of the user(and the parameter that vsftpd reads from) and /bin/bash, the shell. Probably what is missing on your case is a home directory to the user, and it could be solved with the following command: usermod -d /var/www/mydomain.com <username>. Cheers :) –  nwildner Jul 16 '13 at 14:23
    
Ahh makes sence then. So just to be sure - that line from the passwd file, is not anything to put in the vsftpd.conf file, correct? Only chroot_local_user=YES is needed in the vsftpd.conf file...? Eitherways tried both scenarios - still same output for me :/ –  user1231561 Jul 16 '13 at 15:15
2  
Yup thanks a lot. One issue though. It works fine loggin in through normal FTP , however when I login as SFTP - then I can browse back again - any ideas? –  user1231561 Jul 16 '13 at 16:36

After you've changed your config to include chroot_local_user=YES

You could change the user's shell to /usr/sbin/nologin so that if the password leaks you will have mitigated some risk (set the home directory too)

usermod -d /var/www/my.domain.example -s /usr/sbin/nologin exampleuser

-d, --home HOME_DIR The user’s new login directory. If the -m option is given the contents of the current home directory will be moved to the new home directory, which is created if it does not already exist.

-s, --shell SHELL The name of the user’s new login shell. Setting this field to blank causes the system to select the default login shell.

https://security.appspot.com/vsftpd/FAQ.txt

share|improve this answer

Here are steps to setup a user and allow the user access only via FTP (i.e. no SSH) and also limit access to a specific (user home) directory on proftpd:

  1. Add new user: adduser newusername

  2. Set password: passwd newusername

  3. Modify user home directory from default to a new folder:

    usermod -d /target/directory username

  4. Edit shells file: vi /etc/shells and add /dev/null at the end

  5. Modify newusername entry in the passwd file: vi /etc/passwd to add /./ before the newusername so that the entry looks like this:

    newusername:x:502:502::/home/ftp/./newusernamehomedirectory/:/dev/null

    Details for steps 4 & 5 here:

  6. Edit /etc/proftpd/proftptd.conf file and uncomment the line DefaultRoot ~

share|improve this answer

Run this command:

useradd -d ftp_user:chown 711 /etc/init.d/
share|improve this answer
1  
You should consider expanding your post to have, at least, some helpful explanation or documentation. –  HalosGhost Oct 18 '14 at 6:00
    
This is an awful answer. You're essentially giving the ftp user full access to the /etc/init.d/ directory - complete madness. 711 explained - permissions-calculator.org/decode/0711 –  Tisch May 18 at 11:31

Set the root folder permissions to 711 with your root account.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.