How To Set Up vsftpd for a User's Directory on Ubuntu 18.04

I’m thinking we simply change local_root to the path we want to give them access to

local_root=/var/www/example.com

Also, I think we can add the user to a group (find another tut) Then

chown -R :group /var/www/example.com

So more than 1 user can ftp in to CRUD ;-)

Can we get confirmation or more info? TIA

this can get complex, I managed to get this working, however I did this:

useradd --home /var/www/html/sammy sammy

BUT I found the ftp connection didn’t work because the directory didn’t map, so I needed to do this:

cd /home
ln -s /var/www/html/sammy

as, somewhere in the system, it was still though of that that user’s home directory was in fact in /home

To change the FTP user’s directory to /var/www/html/sammy/ftp instead of /home/sammy/ftp, you’ll need to update the user’s home directory and make a few configuration adjustments for permissions and security in vsftpd. Here’s how to do it:

Steps to Change the FTP Directory

1. Create the New Directory: Ensure the directory /var/www/html/sammy/ftp exists:

sudo mkdir -p /var/www/html/sammy/ftp

2. Change the FTP User’s Home Directory: Set the home directory for the FTP user (e.g., sammy) to the new directory:

sudo usermod -d /var/www/html/sammy/ftp sammy

3. Set Ownership and Permissions: To allow the FTP user access, you may need to set the directory’s ownership and permissions accordingly:

sudo chown -R sammy:sammy /var/www/html/sammy/ftp
sudo chmod -R 755 /var/www/html/sammy/ftp

4. Update vsftpd Configuration: In /etc/vsftpd.conf, make sure the following options are set to restrict the user to their home directory:

chroot_local_user=YES
allow_writeable_chroot=YES

5. Restart vsftpd: After updating the configuration, restart the vsftpd service to apply the changes:

sudo systemctl restart vsftpd

6. SELinux or AppArmor (If Enabled): If you’re running SELinux or AppArmor, you may need to adjust permissions. For SELinux:

sudo setsebool -P ftp_home_dir=1

After these steps, sammy should have access to /var/www/html/sammy/ftp as their FTP root directory. This setup will restrict the user to this directory and ensure vsftpd serves it as the user’s home for FTP operations.

I could not get it to work.

Allowing the root user to log in via FTP is generally not recommended for security reasons. However, if you want to enable root access for FTP and allow it to view all directories, here’s how you can configure it carefully with vsftpd.

Important Considerations

1. Security Risk: Allowing root access over FTP can expose the system to vulnerabilities. Use this configuration only in a secure, trusted environment.
2. Alternatives: Instead of allowing root FTP access, consider creating a dedicated user with sudo privileges or limiting FTP root access to specific trusted IP addresses.

Steps to Enable Root FTP Access

1. Allow Root FTP Access in vsftpd: Edit the vsftpd configuration file:

sudo nano /etc/vsftpd.conf

Add or update these settings:

userlist_deny=NO
userlist_enable=YES
userlist_file=/etc/vsftpd.userlist

• userlist_deny=NO allows only users listed in vsftpd.userlist to access FTP. - userlist_enable=YES activates this list.

2. Add root to the vsftpd User List: In /etc/vsftpd.userlist, add the root user:

echo "root" | sudo tee -a /etc/vsftpd.userlist

3. Allow Root Access by Shell Configuration: Ensure the root shell (/bin/bash or /bin/sh) is in /etc/shells, which vsftpd checks to allow FTP access:

sudo nano /etc/shells

• Ensure /bin/bash or the shell assigned to root is listed here.

• Enable chroot for Root: If you want root to see the entire filesystem (/), do not apply chroot_local_user=YES in vsftpd.conf for root. However, if you want to restrict root to a particular directory, enable chroot_local_user and set the home directory accordingly.

• Restart vsftpd: Apply the changes by restarting the vsftpd service.

Alternative: Create a Special FTP User with Root Privileges

A safer approach might be to create a dedicated user with the necessary permissions to view the /home directory but limited access to critical system directories. This could be done by adding the user to specific groups and setting appropriate permissions, thus avoiding exposing the root account itself.

The error Received message too long 1416128883 usually indicates that when you connect via SFTP, the server is sending unexpected output before starting the SFTP protocol. This can happen if there’s extra text or messages in the shell configuration files (like .bashrc, .bash_profile, or /etc/motd) that produce output even for non-interactive sessions.

Here’s how to fix it:

1. Check for Extraneous Output in Shell Configuration Files

Open the shell initialization files, such as .bashrc or .bash_profile, for the SFTP user and remove any output-producing commands (like echo, print, or any commands that output text).

For example, check:

nano ~/.bashrc
nano ~/.bash_profile

Look for and remove any lines that produce output, like:

echo "Welcome to the server!"

Additionally, wrap any necessary output commands within an if statement that only executes in interactive shells:

if [ "$PS1" ]; then
    echo "Welcome to the server!"
fi

2. Check /etc/motd and /etc/issue Files

The /etc/motd (Message of the Day) or /etc/issue files might also be configured to print messages upon login. These files should not affect SFTP, but it’s worth checking if any output-producing commands are present.

sudo nano /etc/motd
sudo nano /etc/issue

If you see any text, try removing it temporarily to see if the SFTP connection issue resolves.

3. Confirm SFTP-only Shell Configuration (if applicable)

If you’re using an SFTP-only setup, make sure that the user’s shell is set to /usr/sbin/nologin or /bin/false to prevent shell access but still allow SFTP connections. Update the shell with:

sudo usermod -s /usr/sbin/nologin ftpuser

4. Test the SFTP Connection

After making these changes, try reconnecting with SFTP. If any commands are producing output in a non-interactive session, this should now be suppressed, and SFTP should work without the “Received message too long” error.

You have two options for making /var/www accessible via FTP:

1. Create a Symlink to /var/www in the user’s FTP directory.
2. Change the FTP Directory Directly to /var/www in the vsftpd.conf.

Option 1: Create a Symlink from /home/user/ftp/files to /var/www

1. Create the Symlink:

ln -s /var/www /home/user/ftp/files

2. Adjust Permissions: Ensure the FTP user has the correct permissions to access /var/www. You can either adjust the directory permissions or add the user to the group that owns /var/www:

sudo chown -R ftpuser:ftpuser /var/www
# OR add ftpuser to the group
sudo usermod -aG www-data ftpuser

3. Update vsftpd Configuration (if necessary): If the symlink isn’t accessible due to the vsftpd chroot restriction, you may need to allow symlink following in vsftpd.conf:

allow_writeable_chroot=YES

4. Then restart vsftpd:

sudo systemctl restart vsftpd

Option 2: Change FTP Directory Directly to /var/www

If you’d rather make /var/www the FTP root directory, here’s how:

1. Edit the FTP User’s Home Directory: Set /var/www as the home directory for the FTP user:

sudo usermod -d /var/www ftpuser

2. Update vsftpd Configuration: Ensure the FTP user has access to the new directory by setting chroot_local_user=YES in vsftpd.conf to prevent directory traversal outside the home:

chroot_local_user=YES

3. Set Permissions: As with the symlink method, verify the FTP user has necessary permissions to /var/www:

sudo chown -R ftpuser:ftpuser /var/www

4. Then restart vsftpd:

sudo systemctl restart vsftpd

You have two options for making /var/www accessible via FTP:

1. Create a Symlink to /var/www in the user’s FTP directory.
2. Change the FTP Directory Directly to /var/www in the vsftpd.conf.

Let’s go through both methods:

Option 1: Create a Symlink from /home/user/ftp/files to /var/www

1. Create the Symlink:

   bash Copy code

   ln -s /var/www /home/user/ftp/files

2. Adjust Permissions: Ensure the FTP user has the correct permissions to access /var/www. You can either adjust the directory permissions or add the user to the group that owns /var/www:

   bash Copy code

   sudo chown -R ftpuser:ftpuser /var/www # OR add ftpuser to the group sudo usermod -aG www-data ftpuser

3. Update vsftpd Configuration (if necessary): If the symlink isn’t accessible due to the vsftpd chroot restriction, you may need to allow symlink following in vsftpd.conf:

   plaintext Copy code

   allow_writeable_chroot=YES

   Then restart vsftpd:

   bash Copy code

   sudo systemctl restart vsftpd

Option 2: Change FTP Directory Directly to /var/www

If you’d rather make /var/www the FTP root directory, here’s how:

1. Edit the FTP User’s Home Directory: Set /var/www as the home directory for the FTP user:

   bash Copy code

   sudo usermod -d /var/www ftpuser

2. Update vsftpd Configuration: Ensure the FTP user has access to the new directory by setting chroot_local_user=YES in vsftpd.conf to prevent directory traversal outside the home:

   plaintext Copy code

   chroot_local_user=YES

3. Set Permissions: As with the symlink method, verify the FTP user has necessary permissions to /var/www:

   bash Copy code

   sudo chown -R ftpuser:ftpuser /var/www

4. Restart vsftpd: Restart the service to apply changes:

   bash Copy code

   sudo systemctl restart vsftpd

Note: Using a symlink can be simpler if you need to keep the original FTP directory structure. However, setting the FTP root to /var/www directly can offer a more straightforward experience for the FTP user. Either approach should work, so choose the one that best fits your needs!

You have two options for making /var/www accessible via FTP:

1. Create a Symlink to /var/www in the user’s FTP directory.
2. Change the FTP Directory Directly to /var/www in the vsftpd.conf.

Option 1: Create a Symlink from /home/user/ftp/files to /var/www

1. Create the Symlink:

ln -s /var/www /home/user/ftp/files

2. Adjust Permissions: Ensure the FTP user has the correct permissions to access /var/www. You can either adjust the directory permissions or add the user to the group that owns /var/www:

sudo chown -R ftpuser:ftpuser /var/www
# OR add ftpuser to the group
sudo usermod -aG www-data ftpuser

3. Update vsftpd Configuration (if necessary): If the symlink isn’t accessible due to the vsftpd chroot restriction, you may need to allow symlink following in vsftpd.conf:

allow_writeable_chroot=YES

4. Then restart vsftpd:

sudo systemctl restart vsftpd

Option 2: Change FTP Directory Directly to /var/www

If you’d rather make /var/www the FTP root directory, here’s how:

1. Edit the FTP User’s Home Directory: Set /var/www as the home directory for the FTP user:

sudo usermod -d /var/www ftpuser

2. Update vsftpd Configuration: Ensure the FTP user has access to the new directory by setting chroot_local_user=YES in vsftpd.conf to prevent directory traversal outside the home:

chroot_local_user=YES

3. Set Permissions: As with the symlink method, verify the FTP user has necessary permissions to /var/www:

sudo chown -R ftpuser:ftpuser /var/www

4. Then restart vsftpd:

sudo systemctl restart vsftpd

You have two options for making /var/www accessible via FTP:

1. Create a Symlink to /var/www in the user’s FTP directory.
2. Change the FTP Directory Directly to /var/www in the vsftpd.conf.

Let’s go through both methods:

Option 1: Create a Symlink from /home/user/ftp/files to /var/www

1. Create the Symlink:

   bash Copy code

   ln -s /var/www /home/user/ftp/files

2. Adjust Permissions: Ensure the FTP user has the correct permissions to access /var/www. You can either adjust the directory permissions or add the user to the group that owns /var/www:

   bash Copy code

   sudo chown -R ftpuser:ftpuser /var/www # OR add ftpuser to the group sudo usermod -aG www-data ftpuser

3. Update vsftpd Configuration (if necessary): If the symlink isn’t accessible due to the vsftpd chroot restriction, you may need to allow symlink following in vsftpd.conf:

   plaintext Copy code

   allow_writeable_chroot=YES

   Then restart vsftpd:

   bash Copy code

   sudo systemctl restart vsftpd

Option 2: Change FTP Directory Directly to /var/www

If you’d rather make /var/www the FTP root directory, here’s how:

1. Edit the FTP User’s Home Directory: Set /var/www as the home directory for the FTP user:

   bash Copy code

   sudo usermod -d /var/www ftpuser

2. Update vsftpd Configuration: Ensure the FTP user has access to the new directory by setting chroot_local_user=YES in vsftpd.conf to prevent directory traversal outside the home:

   plaintext Copy code

   chroot_local_user=YES

3. Set Permissions: As with the symlink method, verify the FTP user has necessary permissions to /var/www:

   bash Copy code

   sudo chown -R ftpuser:ftpuser /var/www

4. Restart vsftpd: Restart the service to apply changes:

   bash Copy code

   sudo systemctl restart vsftpd

Note: Using a symlink can be simpler if you need to keep the original FTP directory structure. However, setting the FTP root to /var/www directly can offer a more straightforward experience for the FTP user. Either approach should work, so choose the one that best fits your needs!

You’re absolutely correct about port 990. Port 990 is specifically used for Implicit FTPS, where the SSL/TLS connection is established as soon as the client connects to the server. In contrast, Explicit FTPS uses ports 20 and 21, with TLS/SSL negotiation happening only after the connection is initiated, which allows for greater flexibility and backward compatibility.

Here’s a breakdown of when and why port 990 is needed:

1. Implicit FTPS Mode

• In Implicit FTPS, the connection to the server is expected to be encrypted immediately, without any negotiation over port 21.
• To enable Implicit FTPS, you need to set implicit_ssl=YES in vsftpd.conf and specify that vsftpd should listen on port 990:

implicit_ssl=YES
listen_port=990

• Firewall Setup: Open port 990 in the firewall to allow clients to connect over Implicit FTPS.

2. Explicit FTPS Mode (Default)

• In Explicit FTPS (the most common setup), the connection is established on port 21, and SSL/TLS is negotiated after the connection is initiated.
• This mode does not require port 990 to be open because it uses port 21 for commands and port 20 for data (along with the passive port range).
• Firewall Setup: No need to open port 990; instead, open port 21, port 20 (for data in active mode), and the passive port range you specified in vsftpd.conf.

Example Configuration for Both Modes

1. Implicit FTPS (requires port 990):

ssl_enable=YES
implicit_ssl=YES
listen_port=990
force_local_data_ssl=YES
force_local_logins_ssl=YES
pasv_min_port=40000
pasv_max_port=50000

2. Explicit FTPS (does not use port 990):

ssl_enable=YES
implicit_ssl=NO
listen_port=21
force_local_data_ssl=YES
force_local_logins_ssl=YES
pasv_min_port=40000
pasv_max_port=50000

After setting up, remember to adjust your firewall:

• For Implicit FTPS: Open port 990, plus the passive range.
• For Explicit FTPS: Open ports 20 and 21, plus the passive range.

Since Explicit FTPS is often sufficient for secure file transfers, you usually only need ports 20, 21, and the passive range, without opening port 990.

Yes, adding /usr/sbin/nologin to /etc/shells is the correct and commonly used way to allow FTP access for users while preventing them from gaining shell access. Here’s how it works and why it’s effective:

1. Purpose of /usr/sbin/nologin: Setting a user’s shell to /usr/sbin/nologin prevents them from logging into the shell directly. When they try to access the shell, it displays a “This account is currently not available” message and terminates the session, providing a simple way to disable shell access.

2. Adding to /etc/shells: The FTP server (like vsftpd) often checks /etc/shells to verify allowed shells before granting FTP access. By adding /usr/sbin/nologin to /etc/shells, you’re explicitly permitting FTP access for users with that shell set, without granting them interactive shell access.

3. Steps to Configure:

   • Edit the /etc/shells file to include /usr/sbin/nologin as a valid shell:

/usr/sbin/nologin

-   Assign `/usr/sbin/nologin` as the shell for any user who should have FTP-only access:

sudo usermod -s /usr/sbin/nologin ftpuser

After this setup, users assigned /usr/sbin/nologin will have access to FTP but will be unable to access the shell, effectively restricting their permissions as intended.

Hey man, you probably already have fixed it but for those who don’t know why that happens…

So, I had to roll back the server to unsafe non-encryption FTP mode to figure this out. When I did so, it said you can’t login to writable chroot, so that’s the reason.

If you’re completely sure you need to have write access to files (e.g. you’ve configured your account to have access to /var/www/somesite/ to edit some of your website files) you have to allow access to writable chroot.

Beware that this is considered non-safe practice and creates many security holes that you can read about yourself, especially when you allow this in normal user home directory (/home/{{user}}/) and not in /var/www/somesite/ directory.

The best way would be to change files and folders permissions to non-writable and then everything will start working normal again.

To allow access to writable chroot do this and make sure you know about all of the possible security holes this thing opens:

sudo nano /etc/vsftpd.conf

Add this line to the file and save it:

allow_writeable_chroot=YES

Then restart vsftpd:

sudo systemctl restart vsftpd