4

I'm setting up an FTP server to replace an old windows server install. I'm using vsftpd on Ubuntu 16.04.

There are multiple users (automated test systems) external to the company, and we want to make the change transparent - no changes required to client machines

I have followed this guide and setup the virtual users and chroot jail. This works correctly, and when I log in using Filezilla, I can see that I am successfully chrooted into the virtual user's home directory (home/vftp/$USER).

However. This directory must not be writeable, to prevent breakout from the jail, so I have created a sub-directory home/vftp/$USER/uploads with write permissions. Because I don't want to have to make changes on the client machines, I need for them to be changed to this uploads directory upon login so that they just login + upload without having to change directory.

I'm aware that I can allow a writeable root (and hence not require a subfolder) with allow_writeable_chroot=YES, but as this is an externally-facing machine that's not really a great idea.

Is there a way that I can put the user in a chroot jail, but switch their working directory to a sub-directory?

SiHa
  • 148
  • I don't know a working solution, but I would probably look into pam_exec, matching on group, on successful login, exec a script which has the commands to put them in the subdir. I am not sure that all clients will play well with this however. – Aaron Apr 11 '18 at 21:39
  • @Aaron Thanks. That's exactly what I'd concluded yesterday, too, after some more searching of the interwebs. Some experimenting required now methinks. – SiHa Apr 12 '18 at 07:04

1 Answers1

1

If you can set the user home directory, you can specify passwd_chroot_enable=YES in vsftpd.conf along with a home directory such as /home/vftp/USER/./uploads in /etc/passwd.

It will create the chroot jail in /home/vftp/USER and use the uploads subdirectory as the user HOME directory.

Christophe Drevet
  • 2,052
  • Thanks - I can't mark as accepted, because we went a different way eventually, so I can't test it out. – SiHa Apr 15 '19 at 08:00