1

I am setting up my Ubuntu 14.04 server.

I want to have an FTP access (I use vsftpd), mainly for my apache2 server, so I added a new user to the www-data group. I also set up the settings for vsftpd.conf, only allowing local users, and chroot_local_user=YES.

I changed the home directory of my new user to /var/www/home. The permission are 755 (local_umask=022).

I can now create files, download them in the /var/www/home/ directory and can not change to the root directory / on purpose for security reasons.

But which strategy can I now use, when I want to change some conf files, download log files and so on, when I only allow the users to stay in their home directory?

Which other security methods are highly recommend, to make my ftp server secure?

closed as primarily opinion-based by Anthon, muru, cuonglm, X Tian, eyoung100 Sep 23 '15 at 3:39

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise. If this question can be reworded to fit the rules in the help center, please edit the question.

2

This is not how I would do this, but answering your question anyway:

From man vsftpd.conf:

chroot_list_enable
      If  activated,  you  may  provide  a list of local users who are
      placed in a chroot() jail in their home  directory  upon  login.
      The meaning is slightly different if chroot_local_user is set to
      YES. In this case, the list becomes a list of  users  which  are
      NOT  to be placed in a chroot() jail.  By default, the file con‐
      taining this list is /etc/vsftpd.chroot_list, but you may  over‐
      ride this with the chroot_list_file setting.

      Default: NO

so:

chroot_list_enable=YES
chroot_list_file=/etc/vsftpd.chroot_list

and add any user you don't want to be chrooted to that list so you can "change some conf files, download log files and so on".

  • okay thank you, but is it overall a good way to go ? I mean then when someone gets access to the account, he can do everything. What is better to do? I mean would it be better to upload/download files in a homedirectory and then with sudo permissions move them on the servers to the folders, where they belong? I mean it is less comfortable, but probably more save, right? – amigo89 Sep 22 '15 at 20:58
  • As you're a reputation 1 user: If this answer helped you, don't forget to click the grey at the left of this text, which means Yes, this answer is valid! ;-) – Fabby Sep 22 '15 at 20:58
  • @amigo89: What you put in your comment is a totally different question unfortunately. (and very much off topic here as it asks "what's the best for me?") For the record: I did not downvote our question; just edited and answered... – Fabby Sep 22 '15 at 21:00

Not the answer you're looking for? Browse other questions tagged or ask your own question.