1

Setup vsftpd easily

If I run this config:

listen=YES
anonymous_enable=NO
local_enable=YES
write_enable=NO
dirmessage_enable=YES
use_localtime=YES
xferlog_enable=YES
connect_from_port_20=YES
chroot_local_user=YES
secure_chroot_dir=/var/run/vsftpd/empty
pam_service_name=vsftpd
rsa_cert_file=/etc/ssl/private/vsftpd.pem

Then I get an error message:

500 OOPS: vsftpd: refusing to run with writable root inside chroot()

However, if I add in allow_writeable_chroot=YES as suggested here, then it just fails to connect:

Connection attempt failed with "ECONNREFUSED - Connection refused by server"

However, if I remove that line that was just added and perform sudo chmod a-w on the users home directory, they can now connect but the service is pointless as they can't upload anything.

Is there a way to restrict users to just their home directory, AND be able to connect and write to their home directory? Turning off chroot_local_user is not an option as they can then browse all the other users directories.

3

You're looking for the allow_writeable_chroot configuration option, but this does not exist in the version of vsftpd shipped with 12.04. See bug 1065714 for a similar enquiry and details of why we can't have this in 12.04.

Turning off chroot_local_user is not an option as they can then browse all the other users directories.

Have you considered switching to private user directories by default? If you don't want users to be able to browse other users' directories, then a more secure way of achieving this is with the permission mechanism baked in to the system, rather than through each individual service. See the user management section of the server guide for details on how to do this. Would turning off chroot_local_user then be an option for you?

  • Just finishted testing works perfectly. Thank you. – Programster Dec 5 '12 at 14:49
0

More details on the following link.

you can choose one of 3 ways: 1. Define option local_root= in configuration file. must by /home or other path to directory with users folders. In this way vsftpd chrooting to /home directory.

  1. Define option passwd_chroot_enable=yes in configuration file and change in /etc/passwd file user home directory from «/home/user» to «/home/./user» (w/o quotes). In this way vsftpd chrooting to /home directory.

  2. Download sources of vsftpd-ext, compile and overwrite exist vsftpd binaries or take it from repositories and add to configuration file option allow_writeable_root=yes.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.