1

So here at work, I was asked to migrate some of our services from Windows to Linux using free software, including for proxy, DNS, and FTP. I was also asked to try to avoid GUIs, so I went for CentOS 7.

After a long fight, I managed to have CentOS 7 up and running with vsftpd running. I created an admin account and everything worked like a charm.

What I'm having trouble doing is copying the directory tree I have in my actual FTP. I use said FTP to transfer files to my 30 clients. Each one has a folder numbered from 1 to 30 by customer ID and they can only access their own folder and subfolders with full permissions. These client folders are nested under a "Clients" folder which is managed by the area in charge of uploading files to each client. This area should have full access to every customer id folder. Right now it looks like this:

-FTP
    -Clients
        -01
        -02
        -##
        -30

To accomplish something similar, i created the following accounts:

adduser uploaders -d /home/clients
adduser clientname01 -d /home/clients/01
adduser clientname02 -d /home/clients/02
adduser clientname## -d /home/clients/##
adduser clientname30 -d /home/clients/30

And jailed them to their chroot

chroot_local_user=YES
  • When I log in to the uploaders account I am locked in my chroot but I can't access the numbered folders

  • When I log in to any of my clients' accounts I'm standing on the root directory and can access almost every folder there.

What would be the correct way to achieve what I'm trying?

  • 1
    For security reasons, I'd strongly suggest using SCP or SFTP over FTP especially if you are handling data that is belongs to your clients. – mdpc Aug 19 '14 at 19:42
1

If you're setting your users' home directory using adduser then there is no need to chroot - your users will have automatic access to their home directories with the local_enable option.

If the files are in a different location, simply change their home to be this location. As long as they aren't expected to ssh in, then there should be no issues.

Make sure your vsftpd.conf file has:

anonymous_enable=NO
local_enable=YES
write_enable=YES

and doesn't have any chroot lines. write_enable should be NO if you don't want your users to write to their home directories via FTP.

  • That doesn't seem to work, what im trying to do is to jail my clients to their clientid folder and jail the uploaders to the folder containing all the clientid folders. I think what's giving me trouble is nesting home folders. Because with my uploaders account I'm jailed in /home/clients but can't access any /home/clients/## folder as those are home to other users. On the other hand when I log with any of my clients accounts I appear on my root as their home folder is inside the uploaders account home folder. – Tomas Ferrin Aug 20 '14 at 15:03
  • What about changing the uploaders home directory to /home/clients/uploaders and create soft links from this directory (manually on the server) to each of the clients home directory? Not certain if it will work! – garethTheRed Aug 20 '14 at 15:15
  • Ok, i tried it but it didnt exactly work, however it guided me to the solution. The correct way to do it is to create the directory somewhere else, say /media/ftp/clients/02 and mount --bind that directory from both home folders (/home/uploaders/02 and /home/clients/02/02). Vsftp doesn't allow symlinking. – Tomas Ferrin Aug 20 '14 at 16:09
  • Of course. It seems to ring a bell, now that you've mentioned it! Glad it's working. – garethTheRed Aug 20 '14 at 16:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.