So for a school assignment, I have to set up a FTP server (vsftp) on OpenSUSE. The teacher told us to use a chroot list, but whenever I use a chroot list, all users have full control over the whole filesystem. What am I doing wrong?

Situation A directory containing data. Inside of that directory are 2 other directories. One of them belongs to Herman and the other one belongs to Franz. Franz and Herman should be able to work in their own directory, so I pointed their home directory to the respective directories (/data/Franz and /data/Herman). Herman shouldn't be able to read or write in Franz' directory, and vice versa. Lastly I changed the rights and ownerships of the directories to look something like this:

   drwxrwxr-x 15 Herman FTP 4096 May 13 15:23 Herman
   drwxrwxr-x 18 Franz  FTP 4096 May 13 14:48 Franz

Here are the things I've changed in the vsftpd.conf file. Beside that, everything is untouched and default.

   write_enable = YES
   local_enable = YES
   chroot_local_user = YES
   allow_writeable_chroot = YES
   anonymous_enable = NO
   listen = YES
   listen_ipv6 = NO (we may do not use IPv6)

I have already tried to uncomment chroot_list_enable=YES and create the file containing all the users I want in the chroot_list. This seems to break things. Whenever I uncomment everything regarding to chroot_lists, it works as expected, but it is "wrong" according to my teacher. He isn't really explaining things clear, so thats why I'm asking here!

Could anyone push me into the right direction? Thanks :)

Many thanks <3


The documentation, as found with man vsftpd.conf writes the following,

chroot_list_enable If activated, you may provide a list of local users who are placed in a chroot() jail in their home directory upon login.

OK so far. But it then continues,

The meaning is slightly different if chroot_local_user is set to YES. In this case, the list becomes a list of users which are NOT to be placed in a chroot() jail. [...]

Reading on slightly further we see the explanation for chroot_local_user,

chroot_local_user If set to YES, local users will be (by default) placed in a chroot() jail in their home directory after login. [...]

I see in your configuration that you have enabled chroot_local_user = YES. So when you "uncomment chroot_list_enable=YES and create the file containing all the users I want in the chroot_list" you are actually creating a file of the users that you do not want in the chroot environment.

  • 1
    Ahhh, yes! Makes sense! It's more clear now, thank you! – InnoDB68 Jun 18 at 7:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.