1

I'm aware this question has been asked a lot in the past, but my problem seems to be a bit different. I'm using vsftpd on my CentOS 7 server and I have specified chroot_local_user to YES in /etc/vsftpd/vsftpd.conf. The FTP user is called user, and their home directory is /home/user. When I try to log in, I get this:

500 OOPS: chroot
Login failed.
421 Service not available, remote server has closed connection

I've been searching for a solution, but people seem to only get refusing to run with writable root inside chroot(), not this. I have tried two things:

1.Remove all write permissions on /home/user:

[user@vps226220 ~]$ ls -al /home | grep user
dr-x------.  4 user      user      4096 Dec 12 00:56 user

2.Add allow_writeable_chroot=YES to /etc/vsftpd/vsftpd.conf, then sudo systemctl restart vsftpd.

In both cases nothing changed, I still get the same error. Note that if I set chroot_local_user=NO, it works fine, but of course this isn't an acceptable configuration for me.

My vsftpd version is 3.0.2, so I believe it should support allow_writable_chroot.

How can I solve this issue?

  • For some reason, chroot() syscall failed inside vsftpd subprocess. Or it will stop claims only when directory will be owned by root. Use strace to start master process and find out why. – user140866 Dec 12 '15 at 10:45
  • According to the some docs, the option name you might want is allow_writeable_chroot (note the e in "writeable"), not allow_writable_chroot? – Castaglia Mar 12 '16 at 16:06
  • NOTE that "allow_writable_chroot" does not work in the Vanilla vsftpd that comes with CentOS/Redhat 7. You need to install a third-party vsftpd for that. – UncaAlby Aug 29 '19 at 22:21
3

It's a SELinux question.

# setsebool -P ftp_home_dir 1
  • 5
    Try explaining the functionality of the suggested command rather than just blurting it out. That way, it would help others, looking for a similar solution. – MelBurslan Jun 27 '16 at 16:54
3

In newer versions of CentOS/RHEL, the ftp_home_dir option was removed; hence, you can use ftpd_full_access. I'm not fully aware of the security implications but this is how I got it to work:

 # setsebool -P ftpd_full_access on

links:

ftp_home_dir is missing in RHEL 7.3

Is it the end for FTP? “ftp_home_dir” Issue

0

We have a situation where a pre-programmed Robot User on Host A needs to PUSH files to a pre-programmed location on Host B. There should be little concern that the Robot User will attempt to push/pull files to/from any other location.

Further, we are disinclined to change the code to accommodate a pre-programmed writable sub-directory that the process would need to "cd" to.

So we solved this issue by setting the configuration parameter "chroot_local_user" to "NO".

0

After getting this error; I made all things which you mentioned, but I still had erorrs. I had checked logs and then applied these steps to solve my problem:

  1. ausearch -c 'vsftpd' --raw | audit2allow -M my-vsftpd
  2. semodule -i my-vsftpd.pp

After 2nd command, my-vsftpd.pp my-vsftpd.te files has been created my ftp host's file directory which was created for ftp host like below:

sudo adduser testuser
sudo passwd testuser
echo "testuser" | sudo tee –a /etc/vsftpd/user_list   (for conf file )   
sudo mkdir –p /home/testuser/ftp/upload
sudo chmod 777 /home/testuser/ftp
sudo chmod 777 /home/testuser/ftp/upload
sudo mkdir –p /home/testuser/ftp/upload
  • It would be great if you could describe what particular commands are doing. It will help understand others what exactly happens. – mrc02_kr Nov 20 '19 at 13:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.