| linux, ftp

vsftp

1 Demo

Scenario of a super user(full access to all folders) and multi normal users(only their own folders).

  1. Add group gftp for all ftp users; 

    groupadd gftp

  2. Set super user's home directory as /srv/ftp/echo; 

    mkdir /srv/ftp/echo
    chown echo:gftp /srv/ftp/echo -R
    useradd -d /srv/ftp/echo -g gftp echo
    passwd echo

  3. Set all normal users' home to subdirectory like /srv/ftp/echo/demo; 

    mkdir /srv/ftp/echo/demo
    chown demo:gftp /srv/ftp/echo/demo -R
    useradd -d /srv/ftp/echo/demo -g gftp demo
    passwd demo

  4. Set all normal users' home directory to be accessed by group gftp by chmod; 

    chmod g+rw /srv/ftp/echo/demo -R
  5. Add allow_writeable_chroot=YES and chroot_local_user=YES in /etc/vsftpd.conf

2 Details

2.1 Add user group for vsftpd

Setting a group for ftp, and ftp users are add to this group. This will be more appropriate for security and privacy. 

groupadd gftp
# groups
# newgrp
# groupdel
# groupmod

2.2 Add users to ftp group

mkdir /srv/ftp/echo
chown echo:gftp /srv/ftp/echo -R
useradd -d /srv/ftp/echo -g gftp echo
passwd echo
### Another User that sharing all files with OTHER GROUP USERS.
mkdir /srv/ftp/echo/demo
useradd -d /srv/ftp/echo/demo -g gftp demo
### Group own this folder, that means demo is the least privilege user.
chown demo:gftp /srv/ftp/echo/demo -R
chmod g+rw /srv/ftp/echo/demo -R
passwd demo

2.3 Install vsftpd

sudo apt-get install vsftpd

2.4 Config vsftpd

sudo vim /etc/vsftpd.conf
anonymous_enable=NO
write_enable=YES
utf8_filesystem=YES
### Restrict user to their own/local root directory, without access to upper folders.
### And this config may cause 500 ERROR.
chroot_local_user=YES
### If you want to specify users having access to other folders exclusively,
### then users in ~chroot_list_file~ are exceptions with ~chroot_local_user~ being ~YES~.
chroot_list_enable=YES
chroot_list_file=/etc/vsftpd/chroot_list

2.5 Run vsftpd

service vsftpd start
service vsftpd stop
ftp localhost

3 Issues

3.1 530

Comment the last line of this file. 

# vim /etc/pam.d/vsftpd
auth required  pam_shells.so

3.2 500

500 OOPS: vsftpd: refusing to run with writable root inside chroot()
# For old versions
allow_writeable_chroot=YES
# For extended vsftp
allow_writable_chroot=YES