I needed to provide multiple users FTP logins, some able to write, some only to read, to a single FTP root directory. I very much wanted that they not see of the file system anything above that directory. After searching—it appears this is a common problem—I defined the user_local config option as the root directory and confined the users to that directory using the chroot_local_users option, or chroot jail. This basically works.
My problem is that, though I do not know why, relying on chroot jail for security is frowned upon generally and most importantly by (at least one member of) the kernel development team.
So, how can I confine my login users to (even) seeing nothing above the defined root directory without chroot jail?? (this is the "secure" part of the question alluded to in the title)
Also, for security reasons (that I do not yet understand), modern versions of
vsftpd do not allow the user's root directory to be writable, thus leaving two options: 1. or to disable the security feature and leave the root writeable or 2. to remove the write bits from the root and create a writable sub-directory therein. The former is playing with fire and the latter is ugly and error prone (users trying to write into the root and getting errors…) I chose the latter.
So, how is FTP service done right? Meaning how can users be prevented from seeing irrelevant parts of the file system in secure way? Is FTP an inherently insecure way of distributing files? If so, is there a better way. Trying to get this right…