1

I have just installed vsftpd and created a new user: sudo useradd new_user -m. Then I have uncommented the line below at /etc/vsftpd.conf:

chroot_local_user=YES 

to permit the user to see (access) only her/his home directory.

I have then restarted vsftpd.

The problem: when I connect through ssh or a ftp client using that new user, the new user can see (access) every computer directories, and I expected she/he to see only her/his home directory.

Im on Ubuntu 14.04

0

Try

passwd_chroot_enable=yes

passwd_chroot_enable

If enabled, along with chroot_local_user , then a chroot() jail location may be specified on a per-user basis. Each user's jail is derived from their home directory string in /etc/passwd. The occurrence of /./ in the home directory string denotes that the jail is at that particular location in the path.

Also note AFAIR vsftp has to run as root to let any chroot settings work!

See also

run_as_launching_user

[...] Specifically, vsftpd does not / cannot use chroot technology to restrict file access when this option is set (even if launched by root). [...]

  • thanks, but doesn't work. I stil can access every directories with that user. – tirengarfio Oct 7 '16 at 21:05
  • Have you checked my last edits? Is vsftp running as root? – rudimeier Oct 7 '16 at 21:10
0

My apologies but I don't have an unmodified copy of /etc/vsftpd.conf from Ubuntu 14.04 handy for comparison. Perhaps this will help.

If you have chroot_list_enable activated, you may provide a list of local users who are placed in a chroot() jail in their home directory upon login.

The meaning is slightly different if chroot_local_user is set to YES. In this case, the list becomes a list of users which are NOT to be placed in a chroot() jail. By default, the file containing this list is /etc/vsftpd.chroot_list, but you may override this with the chroot_list_file setting, Excerpt from man page for that seting is below.

chroot_list_file

The option is the name of a file containing a list of local users which will be placed in a chroot() jail in their home directory. This option is only relevant if the option chroot_list_enable is enabled. If the option chroot_local_user is enabled, then the list file becomes a list of users to NOT place in a chroot() jail.

Default: /etc/vsftpd.chroot_list 

Sources:

https://security.appspot.com/vsftpd/vsftpd_conf.html

https://linux.die.net/man/5/vsftpd.conf

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.