Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

Setup vsftpd easily

If I run this config:

listen=YES
anonymous_enable=NO
local_enable=YES
write_enable=NO
dirmessage_enable=YES
use_localtime=YES
xferlog_enable=YES
connect_from_port_20=YES
chroot_local_user=YES
secure_chroot_dir=/var/run/vsftpd/empty
pam_service_name=vsftpd
rsa_cert_file=/etc/ssl/private/vsftpd.pem

Then I get an error message: 500 OOPS: vsftpd: refusing to run with writable root inside chroot()

However, if I add in: allow_writeable_chroot=YES as suggested here, then It just fials to connect: Connection attempt failed with "ECONNREFUSED - Connection refused by server".

However, if I remove that line that was just added and perform sudo chmod a-w on the users home directory they can now connect but the service is pointless as they cant upload anything.

Is there a way to restrict users to just their home directory, AND be able to connect and write to their home directory? Turning off chroot_local_user is not an option as they can then browse all the other users directories.

Stu

share|improve this question

2 Answers 2

up vote 1 down vote accepted

You're looking for the allow_writeable_chroot configuration option, but this does not exist in the version of vsftpd shipped with 12.04. See bug 1065714 for a similar enquiry and details of why we can't have this in 12.04.

Turning off chroot_local_user is not an option as they can then browse all the other users directories.

Have you considered switching to private user directories by default? If you don't want users to be able to browse other users' directories, then a more secure way of achieving this is with the permission mechanism baked in to the system, rather than through each individual service. See the user management section of the server guide for details on how to do this. Would turning off chroot_local_user then be an option for you?

share|improve this answer
    
Thanks yeah, I can switch off chroot_local_user then. –  Programster Dec 5 '12 at 14:44
    
Just finishted testing works perfectly. Thank you. –  Programster Dec 5 '12 at 14:49

More details on the following link.

you can choose one of 3 ways: 1. Define option local_root= in configuration file. must by /home or other path to directory with users folders. In this way vsftpd chrooting to /home directory.

  1. Define option passwd_chroot_enable=yes in configuration file and change in /etc/passwd file user home directory from «/home/user» to «/home/./user» (w/o quotes). In this way vsftpd chrooting to /home directory.

  2. Download sources of vsftpd-ext, compile and overwrite exist vsftpd binaries or take it from repositories and add to configuration file option allow_writeable_root=yes.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.