Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I have created ftp-server using pure-ftpd following this wonderful tutorial. Everything works fine, except file access. Here is the problem.

Joe's home folder is /var/www/joe and Steve's home folder is /var/www/steve. When they log on to the ftp server they enter to their home folders and they cann't access folders of other users. But when Joe's writes a script in PHP in order to access Steve's file, he can access it. For instance, this script works fine for Joe:

$filename = "/var/www/steve/somefile";
$handle = fopen($filename, "r");
$contents = fread($handle, filesize($filename));
echo $contents;

Is it the problem of the ftp-server or the problem of apache's virtual-host file?

How can I solve this problem please? It is very urgent because it touches the security issue of the users.

Thank you beforehand!

share|improve this question

1 Answer 1

The problem is the HTTP server since (by default) scripts are run as the www-data user.

To continue your analogy, Steve likely has file permissions for /var/www/steve/somefile set to 755 - which grants read and execute permissions to any user. Because Apache executes PHP scripts as the www-data user, PHP scripts won't encounter any problems accessing the file.

Steve can prevent others from seeing his file by running the following command:

chmod 700 /var/www/steve/somefile

This will prevent other users (except for root of course) from being able to access the file. Note that the same problem applies to directories and because of this, other users may be able to see that the file exists (though they won't be able to read its contents).

Some FTP clients provides means of changing file permissions, so I would encourage you to consult the manual for your FTP client.

Tools such as Apache suEXEC will cause the PHP script to be executed under the user's actual account - but of course it won't protect against the vulnerability you're referring to.

share|improve this answer
    
But the problem is that, I don't have Steve's user account in linux, he is virtual user of pure-ftpd. –  Bakhtiyor Oct 4 '12 at 4:27
    
Then I'm guessing the files will be created and owned by the FTP user. In that case, there's really nothing anyone can do since the files will be created and owned by the same user. I would strongly recommend creating separate user accounts on the system for each user and having PureFTP use those - that way, each user is responsible for who can access each of their files. –  Nathan Osman Oct 4 '12 at 5:05

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.