1

I am setting up my Ubuntu 14.04 server.

I want to have an FTP access (I use vsftpd), mainly for my apache2 server, so I added a new user to the www-data group. I also set up the settings for vsftpd.conf, only allowing local users, and chroot_local_user=YES.

I changed the home directory of my new user to /var/www/home. The permission are 755 (local_umask=022).

I can now create files, download them in the /var/www/home/ directory and can not change to the root directory / on purpose for security reasons.

But which strategy can I now use, when I want to change some conf files, download log files and so on, when I only allow the users to stay in their home directory?

Which other security methods are highly recommend, to make my ftp server secure?

2

This is not how I would do this, but answering your question anyway:

From man vsftpd.conf:

chroot_list_enable
      If  activated,  you  may  provide  a list of local users who are
      placed in a chroot() jail in their home  directory  upon  login.
      The meaning is slightly different if chroot_local_user is set to
      YES. In this case, the list becomes a list of  users  which  are
      NOT  to be placed in a chroot() jail.  By default, the file con‐
      taining this list is /etc/vsftpd.chroot_list, but you may  over‐
      ride this with the chroot_list_file setting.

      Default: NO

so:

chroot_list_enable=YES
chroot_list_file=/etc/vsftpd.chroot_list

and add any user you don't want to be chrooted to that list so you can "change some conf files, download log files and so on".

  • okay thank you, but is it overall a good way to go ? I mean then when someone gets access to the account, he can do everything. What is better to do? I mean would it be better to upload/download files in a homedirectory and then with sudo permissions move them on the servers to the folders, where they belong? I mean it is less comfortable, but probably more save, right? – amigo89 Sep 22 '15 at 20:58
  • As you're a reputation 1 user: If this answer helped you, don't forget to click the grey at the left of this text, which means Yes, this answer is valid! ;-) – Fabby Sep 22 '15 at 20:58
  • @amigo89: What you put in your comment is a totally different question unfortunately. (and very much off topic here as it asks "what's the best for me?") For the record: I did not downvote our question; just edited and answered... – Fabby Sep 22 '15 at 21:00

Not the answer you're looking for? Browse other questions tagged or ask your own question.