Background information:

I'm using Serverpilot to manage my Ubuntu server which doesn't provide any FTP service.

  • There is a user: serverpilot
  • With the home directory: /srv/users/serverpilot/
  • And there is a website running in this directory: /srv/users/serverpilot/apps/website/public/.

What I want:

Now I would like to have a FTP account which can only read and write to this directory: /srv/users/serverpilot/apps/website/public/ftpdir/.

What I've tried:

  • I've installed vsftpd: sudo apt-get install vsftpd
  • Created a new user with that directory as home: sudo useradd -m -d /srv/users/serverpilot/apps/website/public/ftpdir ftpuser (wich is probably not a good idea to have a home directory of a user in another users home directory)
  • I've changed the password with sudo passwd ftpuser
  • Edited the default vsftpd configuration with sudo vi /etc/vsftpd.conf
    • local_enable=YES so the ftpuser can be used as ftp login
    • write_enable=YES the user is able to write
    • chroot_local_user=YES can't access anything outside it's home dir
    • pam_service_name=ftp because I was getting a 530 Login incorrect error
  • And opened my firewall with: sudo ufw allow 21/tcp

The problems:

  • Other users beside the ftpuser can also be used as FTP login. I just want to have 1 ftp user and not allow other system users to use FTP.
  • The ftpuser can also SSH into the server.
  • I'm getting a 553 error: could not create file error when trying to upload a file, to fix this I came across this question: https://askubuntu.com/a/320186 but I don't think this is the right way because the file should be owned by the serverpilot user, not the ftpuser user. The website running under the serverpilot user should proces the uploaded files.

How I've solved it before:

In the past on another server I've changed the directory ownership and after adding these extra vsftpd configuration options it was finally working:

file_open_mode=0775
local_umask=022
allow_writeable_chroot=YES
pam_service_name=vsftpd

But on that server I had problems with processing the uploaded files because of the ownership, so there I'm using the file_get_contents() PHP function to get the files over the web instead of direct access them on the server which isn't that nice.

The final question:

How can I simply have 1 ftp login which can read and write to a directory in a users home directory where the ownership stays on the user where the home directory is from?

  • Does it have to be FTP? Won't SFTP do? – muru Jun 5 '16 at 20:09
  • SFTP won't do, it's for a external service which one support FTP to upload certain files to my server. – Roy Jun 7 '16 at 8:06
up vote 2 down vote accepted
+50

local_enable=YES is what is enabling the other users to login, you should add your user to the explict user list instead

from the manual:

local_enable
Controls whether local logins are permitted or not. If enabled,       normal user accounts in /etc/passwd (or wherever your PAM config references) may be used to log in. This must be enable for any non-anonymous login to work, including virtual users.
Default: NO

userlist_file
This option is the name of the file loaded when the userlist_enable option is active.
Default: /etc/vsftpd.user_list

To sort your permissions issues enable the SITE CHMOD command and get your ftp client to use it

chmod_enable
When enabled, allows use of the SITE CHMOD command. NOTE! This only applies to local users. Anonymous users never get to use SITE CHMOD.
Default: YES

vsftpd doesn't support limit users but proftpd is more powerfull and has an option in configuration file (proftpd.conf) to limit login to some user like this:

<Limit LOGIN>
AllowUser barb
AllowUser dave
AllowGroup ftpuser
DenyAll
</Limit>

Edit

  1. for your first problem the solution is as above.
  2. second problem also can solve by adding DenyUsers ftpuser to /etc/ssh/sshd_config
  3. and third problem can solve by adding ftpuser to the group of serverpilot and add serverpilot to the group of ftpuser. also you must change permission of folder /srv/users/serverpilot/apps/website/public/ftpdir to 775.

Remember that folder /srv/users/serverpilot/ must have 755 permission.

  • Thanks for your reply! But it's not answering my other questions/problems, any thoughts on that? – Roy Jun 3 '16 at 11:07
  • for read/write problem you can change group permission of user home directory to rwx and add your ftp user to the group of user whom the home directory is from. – Ghasem Pahlavan Jun 3 '16 at 11:17
  • And what about the users home directory? Is it okay to have a users home directory inside another users home directory? Is there not a FTP solution with FTP logins separated from the system users? Just install, create a FTP login and define it's directory. – Roy Jun 3 '16 at 11:27

You can use pure-ftpd 's PureDB function to create a ftp login only for the pure-ftpd service.

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.