VSFTP chroot or jail users - limit users to only their home directory howto
Patrick asks:
How do I limit users of vsftp to only their home directory? Therefore, that user cannot go outside other directories to browser something.
Yesterdays VSFTPD troubleshooting note (read as post) brought me back this question.
If you do not wish FTP users to be able to access any files outside of their own home directory, set up chroot jail.
For consider following example:
- Ftp username : user1
- FTP home directory: /home/user1
$ ftp ftp.domain.com
Output:
Connected to ftp.domain.com. 220 (vsFTPd 2.0.5) Name (ftp.domain.com:user1): user1 331 Please specify the password. Password: 230 Login successful. Remote system type is UNIX. Using binary mode to transfer files. ftp> pwd 257 "/home/user1" ftp> cd /etc 250 Directory successfully changed. ftp> ls 200 PORT command successful. Consider using PASV. 150 Here comes the directory listing. 150 Here comes the directory listing. -rw-r--r-- 1 0 0 7959 Mar 02 22:20 Muttrc drwxr-xr-x 3 0 0 4096 Jul 24 12:20 Wireless drwxr-xr-x 16 0 0 4096 Jul 30 22:58 X11 drwxr-xr-x 4 0 0 4096 Sep 05 2005 Xprint -rw-r--r-- 1 0 0 2188 Sep 05 2005 adduser.conf -rw-r--r-- 1 0 0 47 Aug 16 14:52 adjtime -rw------- 1 0 0 4330 Aug 18 2005 afick.conf -rw-r--r-- 1 0 0 194 Sep 05 2005 aliases -rw-r--r-- 1 0 0 12288 Jul 19 21:27 aliases.db drwxr-xr-x 2 0 0 8192 Aug 15 09:33 alternatives ... ..... ..
Now normal user can go to /etc directory (may be to all other directories) and if there is read only permission to sensitive files user can download the file via ftp.
To avoid this security problem you can lock ftp user in a jail.
Open vsftpd configuration file - /etc/vsftpd/vsftpd.conf
# vi /etc/vsftpd/vsftpd.conf
Make sure following line exists (and uncommented):
chroot_local_user=YES
Save and close the file. Restart vsftpd.
# /etc/init.d/vsftpd restart
Now all users of VSFTPD/FTP will be limited to accessing only files in their own home directory. They will not able to see /, /etc, /root and /tmp and all other directories. This is an essential security feature.
E-mail this to a friend
Printable version
You may also be interested in other helpful articles:
- Chroot in OpenSSH / SFTP Feature Added To OpenSSH
- Bash Shell Tip: Copy Set of Files to All Users Home Directory
- FreeBSD : How to setup shared directories
- rssh: Per User Configuration Options For Chroot Jail
- Linux Configure rssh Chroot Jail To Lock Users To Their Home Directories Only
Discussion on This Article:
Leave a Reply
We encourage your comments, and suggestions. But please stay on topic, be polite, and avoid spam. Thank you very much for stopping by our site!
What if I need a ‘root’ type FTP account; I want to chroot all but one user?
“What if I need a ‘root’ type FTP account; I want to chroot all but one user?”
Create a user account with the root directory as the server root directory i.e. ‘/’. Or for better security, use the main directory of all sub-directories you would like to access, as the home directory. e.g. if you have ftp accounts for /var/www/html2 and /var/www/html3, then use /var/www as the home directory for the main ftp account.
hi,
i have just installed cerberus ftp server inside my network with an ip address of 192.168.x.xx…problem is i cannot connect with it outside because i really don’t knw(noobs) how to forward port 21 to it from my internet gateway.btw, my gateway runs on mandrake 10.can u tell me what to do specifically the commands to make it work? many thanks…
joel,
You can use port forwarding from your router itself. If you want software based port forwarding use -
Internet TCP redirection server called rinetd. You can also use iptabled DNAT rules for same.
hi nixcraft,
thanks for the reply.i was just wondering can i just add this rule to your fw_proxy script that you made..
iptables -t nat -I PREROUTING -p tcp -i INTERNET –dport 21 -j DNAT –to 192.168.x.xx:21
will that work or is there anything else that i should add?
thanks again
nixcraft,
sorry, fw.proxy was posted by vivek,my apologies to him and to you also.anyway im still on my problem.i have installed fw.proxy script on my gateway machine running mandrake 10 and run all the commands there.even tried adding the iptable rule that i have just mentioned but i still cannot connect outside my network.im totally out of my mind figuring it out how to work.pls bail me out on this one…
joel
Lan is at eth0 and internet is eth1 (to isp router)
Gateway ip is 192.168.0.1
FTP server is at 192.168.0.5
You want to redirect to 192.168.0.5 at port 21, use following
iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 21 -j DNAT --to-destination 192.168.0.5HTH
Hi,
I’ve been trying this on a redhat system but its not restricting the user to their home directory. It’s all they have permission on but they can still list all the files under /,/dev,/bin etc…
It might be because I have a symlink in their home folder to another part of the file system they have permission on. Would it be better to make the symlink the other way around? I’ve done everyhitng I can work out that I need to do so I don’t get why they can sill list any other directories…
Cheers
Ref: chroot ftp users. This is taken from the vsftpd.conf file:
# You may specify an explicit list of local users to chroot() to their home
# directory. If chroot_local_user is YES, then this list becomes a list of
# users to NOT chroot().
chroot_list_enable=YES
chroot_list_file=/etc/vsftpd/vsftpd.chroot_list
This works very well for my systems.
Hi:
I want to be able to add another folder to the list of folders that the users are permitted to use.
Viz.:
/home/user
/var/www/html
Is this possible?
Rgds. Mentor
Thank you very much…Works like a charm…
You can use the command “mount –bind olddir newdir”. The call ‘–bind’ mounts part of the file system to another area. You may have try to use links but these are prohibited for security reasons.
hi guys
i face this problem and i do the solution up
but the same thing nothing change the user can
able to see / & /etc
and i have question
what i put in chroot_user_list file
only the username ?
need your advice
Suppose if I have 5 users, I want to limit only 2 users to their home directory and remaining users to have full access. How to do that?