My problem with vsftpd

Ask Fedora
1

Hello,
I’m using CentOS 8 x86_64 and I want to configure vsftpd service and limit a user to just specific directory. I did below steps to configure vsftpd:
1- I created an account and set a password for it:

# useradd jason
# passwd jason

Then I changed vsftpd configuration as below:

anonymous_enable=NO
local_enable=YES
write_enable=YES
local_umask=022
dirmessage_enable=YES
xferlog_enable=YES
log_ftp_protocol=YES
connect_from_port_20=YES
chroot_local_user=No
listen=NO
listen_ipv6=Yes

pam_service_name=vsftpd


# Home User
userlist_enable=YES
virtual_use_local_privs=YES
userlist_deny=NO
user_config_dir=/etc/vsftpd/user_config_dir


##
ssl_enable=YES
ssl_tlsv1_2=YES
ssl_sslv2=NO
ssl_sslv3=NO

pasv_min_port=40000
pasv_max_port=50000

rsa_cert_file=/etc/ssl/private/vsftpd.pem
rsa_private_key_file=/etc/ssl/private/vsftpd.pem

allow_anon_ssl=NO
force_local_data_ssl=YES
force_local_logins_ssl=YES

require_ssl_reuse=NO
ssl_ciphers=HIGH

debug_ssl=YES

Then I opened “/etc/vsftpd/user_list” and added “jason” account to it. After it:

# mkdir /etc/vsftpd/user_config_dir/
# touch /etc/vsftpd/user_config_dir/jason

Then opened “jason” file and added below lines into it :

local_root=/var/www/wp/
write_enable=YES

Other files are:

# cat ftpusers

# Users that are not allowed to login via ftp
root
bin
daemon
adm
lp
sync
shutdown
halt
mail
news
uucp
operator
games
nobody

And:

# cat user_list

# vsftpd userlist
# If userlist_deny=NO, only allow users in this file
# If userlist_deny=YES (default), never allow users in this file, and
# do not even prompt for a password.
# Note that the default vsftpd pam config also checks /etc/vsftpd/ftpusers
# for users that are denied.
#root
#bin
#daemon
#adm
#lp
#sync
#shutdown
#halt
#mail
#news
#uucp
#operator
#games
#nobody
jason

And finally, restarted the vsftpd service.
I’m using FileZilla and can connect to FTP server but jason user see its home directory and not “/var/www/wp/” and can see other parts of system too.
What is my problem? Which part is wrong?

Thank you.

1 Like
2

What are the permissions and ownership of /var/www/wp/ ?

This issue seems like maybe “others” do not have read+execute permissions there.
Also, if jason needs to read/write into that directory I would suggest he be made part of a specialized group and that group be given group ownership of /var/www/wp/ and then give group rwx permissions there. For security purposes “others” should not have write permissions there, and if you chose maybe not even read+execute permissions.

Another consideration is that by default any user logging in will see the directory that is designated as their home in /etc/passwd. If your user is supposed to see only the /var/www/wp/ directory then his home directory should be just that.

I cannot give you the fine-tune details for vsftp but it looks like you are probably close.

3

FTP as a protocol is mostly obsolete, you’d best replace it with SFTP.

2 Likes
4

The permission is:

drwxrwxr-x. 7 apache apache unconfined_u:object_r:httpd_sys_rw_content_t:s0   4096 Sep  3 12:33 wp

“jason” is a member of “apache” group.

5

What is your opinion about below tutorial:

The first thing we must do is create a directory that will house our FTP data:

# mkdir -p /data
# chmod 701 /data

Create the SFTP group and user:

# groupadd sftp_users
# useradd -g sftp_users -d /upload -s /sbin/nologin USERNAME
# passwd USERNAME

Create the new user SFTP directory

Now we're going to create an upload directory, specific to the new user, and then give the directory the proper permissions.

# mkdir -p /data/USERNAME/upload
# chown -R root:sftp_users /data/USERNAME
# chown -R USERNAME:sftp_users /data/USERNAME/upload

Configure sshd:

# nano /etc/ssh/sshd_config

At the bottom of that file, add the following:

Match Group sftp_users
ChrootDirectory /data/%u
ForceCommand internal-sftp
AllowTcpForwarding no


Match User tecmint
#specify chroot jail
ChrootDirectory /home/test
AllowTcpForwarding no

If I add my user to "apache" group then I don't need to create an extra group and below commands?
Code:
# chown -R root:sftp_users /data/USERNAME
# chown -R USERNAME:sftp_users /data/USERNAME/upload
1 Like
6

I would create the group as suggested since that way you are not allowing the apache daemon to access and write into that directory. For security I would even be cautious about putting the upload directory directly under the /var/www tree.

The tutorial shows creating a user with home directory where the uploads occur and putting him into a chroot jail for the uploads. I think that is a very good idea even when using vsftp.

2 Likes
7

I would also look in detail at the man page for vsftpd.conf. It gives a lot of different options with their usage and might also guide you in what you want to do.

8

His question was about vsftp. He is using secure ftp.

9

The general idea seems correct.
Although, I recommend to avoid modifying sshd_config and use the directory sshd_config.d instead.
Also ideally it’s best to create a system user useradd -r, disable password authentication and use key-based authentication.

10

It doesn’t really matter as the FTP protocol itself is on the verge of obsolescence the same way as Telnet and Gopher.
In addition, there’s virtually no reason in bothering with FTP/vsftpd when you can simply utilize SFTP/OpenSSH which is already preinstalled.

2 Likes
11

or rsync which is itself ssh based for remote transfers.

1 Like