I'm unfamiliar with deb based systems, so my apologies if the solution is simple.

I'm trying to setup vsftpd to jail users to their home directories. I get the 500 OOPS: vsftpd: refusing to run with writable root inside chroot()

I research this problem, and find the common solution is to use the backport provided by thefrontiergroup like so:

sudo add-apt-repository ppa:thefrontiergroup/vsftpd

When I do this, I get a python error:

You are about to add the following PPA to your system:
 vsftpd 2.3.5 with the allow_writeable_chroot feature backported from vsftpd 3.
 More info: https://launchpad.net/~thefrontiergroup/+archive/vsftpd
Press [ENTER] to continue or ctrl-c to cancel adding it

Exception in thread Thread-1:
Traceback (most recent call last):
  File "/usr/lib/python2.7/threading.py", line 551, in __bootstrap_inner
  File "/usr/lib/python2.7/dist-packages/softwareproperties/ppa.py", line 99, in run
  File "/usr/lib/python2.7/dist-packages/softwareproperties/ppa.py", line 132, in  add_ppa_signing_key
    tmp_keyring_dir = tempfile.mkdtemp()
  File "/usr/lib/python2.7/tempfile.py", line 322, in mkdtemp
    name = names.next()
  File "/usr/lib/python2.7/tempfile.py", line 141, in next
    letters = [choose(c) for dummy in "123456"]
  File "/usr/lib/python2.7/random.py", line 274, in choice
    return seq[int(self.random() * len(seq))]  # raises IndexError if seq is empty
ValueError: cannot convert float NaN to integer

Attempting to find another solution, I find a recommendation to change the permissions of the home directories as in this article vsftpd - restrict users to home directory However, following this would lead to a lot of manual permission resetting, because I want a subdirectory of each user to be accessible via apache like is described in the UserDir apache config http://httpd.apache.org/docs/2.2/howto/public_html.html

In the end, I want to be able to adduser foo and magically end up with the ability for foo to have full R/W privelages in /home/foo WITHOUT being able to see any other part of the filesystem, to have http://x.x.x.x/~foo/ accessible for anybody, and shell access if I change their shell from nologin to bash.

Ubuntu 12.04 LTS, vsftpd 2.3.5

Please offer any advice... I'm stuck scratching my head!


I'm just guessing here, because your situation isn't exactly the same, but..

apt-get install python-software-properties

(or perhaps apt-get update python-software-properties)?

That was a pre-requisite step on the 12.04 system I was setting up, but I also got "add-apt-repository: command not found" error, not python errors. It's those errors which make me think that python is your problem, since that command executed successfully for me once I had installed python-software-properties.

The only other alternative I can come up with--too late to try/fix my own setup--rather than adding an external repository, would be to make everyone's home /home/, and then modify the permissions on all other directories so that the only directory they're allowed to SEE when they read /home/ is "foo".. They'd still have to navigate into it or you'd have to somehow script changing their CWD after login, but when the initial screen shows nothing but "foo" and is unwritable, it should be fairly low impact to have to "cd foo" or click on the foo folder if using a GUI. And apparently this is not so simple as I'd imagined, I was thinking of IIS with NTFS permissions when I imagined a permission setting that determines whether a directory can be seen.. I did find that there's an option in vsftpd.conf named "hide_files," which might be able to accomplish this with carefully selected terms (it allows you to specify a regex, but I don't know if you could do something like expand a variable based on the current user's login to make it different for each user...)

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.