Home / server / Questions / 101987
Accepted
TraderJoeChicago
Asked: 2010-01-13 09:45:39 +0800 CST

Setting up FTP server on ubuntu so user XXXX has only acess to /var/www/

  • 772

I tried using vsftpd but the result was that my user had access to the whole filesystem.

I created a group www, changed /var/www to belong to that group and then added the new user 'ftpuser' to this group.

But when I logged the user had access to everything in the filesystem.

Is there a good and simple ftp server for linux that you guys recommend? I need to be able to easily manage permissions, like which user access which directories.

Thanks,

-Sergio

linux ftp ubuntu

4 Answers

  1. Best Answer

    You need to make sure you configure VSFTPd to chroot that user. Look at the chroot_local_user setting. That way they will only have access to their folder.

    • 3

  2. You're doing it wrong. You would be far better off creating a vhost in Apache rather than using the default /var/www. That way you can create the vhost filesystem root in /home/user/public_html. All (most?) ftp servers will default to serving a user's home directory when they login, and so you don't need to do any more configuring.

    Also consider whether ftp is really the best option. FTP is insecure as it has no encryption by default - consider using scp/sftp instead. Again, you won't need to do any extra configuring because you'll be serving the users' home directory by default. And you've probably already got an ssh server running which will provide you with scp.

    A good sftp/scp client for Windows is Winscp.

    • 1

  3. I don't know how to do this with VSFTPd; in fact, I tried, and gave up (I have other projects to do).

    But I did have a similar problem, and the way I solved it was by forcing them to use SFTP. This can be configured through some careful modification of your OpenSSH Server configuration (/etc/ssh/sshd_config). Search for SFTP & "ChrootDirectory" and you'll find several tutorials.

    A few gotchas: Your entire path to your chroot jail directory MUST be owned by root and MUST be read-only by your SFTP user(s).

    If you want to give certain users access to certain sites, but you still want to manage them all in one place as the sysadmin, consider creating a separate SFTP jail (I called mine /var/www/ftp, whereas my sites live at /var/www/html) and then hard-linking the directories into the new directory with "mount --bind". Note that you must first create the individual mount directories, and that you must specify the full path to both your target directory and your mountpoint directory.

    Final Note: I realize this is an old question, but if this answer had been here when I was looking earlier this week, it would have saved me two solid days of research.

    • 0

  4. I came across the same issue and found this thread marked as resolved, hope it helps :)

    P.S. this one seems better.

    • 0