Table of Contents
FTP (File Transfer Protocol) is a file transfer protocol. Running as Server-Client, this application allows multi-user access. The user logged on to the FTP server should not access different directories. It should only be able to access the directory designated for it. Otherwise, a security problem will arise. In this article, let's look for an answer to the question "How to restrict ftp user to a directory in Linux".
How to restrict ftp user to a directory?
There are different configuration options available with vsftpd to restrict (allow or deny) FTP user into some specific directory in Linux. Following are some of these files:
- chroot_local_user : If set to YES, local users will be (by default) placed in a
chroot()jail in their home directory after login.
- chroot_list_enable : If activated, you may provide a list of local users who are placed in a
chroot()jail in their home directory upon login.
- chroot_list_file : The option is the name of a file containing a list of local users which will be placed in a
chroot()jail in their home directory.
Example-1: Define a single chroot directory for all users
The ftp server package of Linux operating systems (Redhat, Centos, Debian, Ubuntu etc) is vsftpd. When this package is installed, the configuration information is written to
/etc/vsftpd/vsftpd.conf. The example vsftpd.conf file is as follows:
[foc@almalinux8 opt]$ cat /etc/vsftpd/vsftpd.conf anonymous_enable=NO connect_from_port_20=YES dirmessage_enable=YES local_enable=YES local_umask=022 listen=NO listen_ipv6=YES pam_service_name=vsftpd userlist_enable=YES write_enable=YES xferlog_enable=YES xferlog_std_format=YES
Open this file with an editor (vi, nano etc) and add the following lines (or modify existing entries if already present):
Save and exit file. Here, users'
/home directory is set to
/(root) directory. In other words, when the user logs in, they will have access to their own directories under
/home, and moving to the upper directory will be restricted.
When a user is created in Linux, the home directory is automatically created under
/home. If you want to continue in this way, simply follow the steps above. The only thing you need to pay attention to is the user home directory privileges:
[foc@almalinux8 home]$ ls -la total 4 drwxr-xr-x. 4 root root 32 Sep 8 23:09 . dr-xr-xr-x. 18 root root 255 Sep 5 23:29 .. drwx------. 18 foc foc 4096 Sep 9 15:41 foc drwx------ 3 ftpuser ftpuser 109 Sep 8 23:10 ftpuser
As seen above, each user's home directory is set to be accessible only to him. If you have a different authorization, set it to allow only the user's home directory to be accessed with the following command:
[foc@almalinux8 home]$ sudo chmod -R 700 /home/ftpuser
Then the vsftpd service is restarted:
[foc@almalinux8 ~]$ systemctl restart vsftpd.service
Let's take a look at the service status:
[foc@almalinux8 ~]$ systemctl status vsftpd.service ● vsftpd.service - Vsftpd ftp daemon Loaded: loaded (/usr/lib/systemd/system/vsftpd.service; enabled; vendor preset: disabled) Active: active (running) since Fri 2022-09-09 15:41:17 +03; 19s ago Process: 1667 ExecStart=/usr/sbin/vsftpd /etc/vsftpd/vsftpd.conf (code=exited, status=0/SUCCESS) Main PID: 1668 (vsftpd) Tasks: 1 (limit: 12212) Memory: 712.0K CPU: 2ms CGroup: /system.slice/vsftpd.service └─1668 /usr/sbin/vsftpd /etc/vsftpd/vsftpd.conf Sep 09 15:41:17 almalinux8 systemd: Starting Vsftpd ftp daemon... Sep 09 15:41:17 almalinux8 systemd: Started Vsftpd ftp daemon.
This step is completed with the two lines we added to
vsftpd.conf. Let's login with these settings:
foc@fedora:~$ ftp 192.168.122.15 Connected to 192.168.122.15 (192.168.122.15). 220 (vsFTPd 3.0.3) Name (192.168.122.15:foc): ftpuser 331 Please specify the password. Password: 230 Login successful. Remote system type is UNIX. Using binary mode to transfer files.
Let's run the ls command after logging in:
ftp> ls 227 Entering Passive Mode (192,168,122,15,151,163). 150 Here comes the directory listing. drwx------ 18 1000 1000 4096 Sep 10 11:14 foc drwxrwx--- 3 1001 1001 109 Sep 08 20:10 ftpuser 226 Directory send OK.
We can see that it lists the users under the
/home directory. Let's try to change to the parent directory:
ftp> cd .. 250 Directory successfully changed. ftp> ls 227 Entering Passive Mode (192,168,122,15,98,212). 150 Here comes the directory listing. drwx------ 18 1000 1000 4096 Sep 10 11:14 foc drwxrwx--- 3 1001 1001 109 Sep 08 20:10 ftpuser 226 Directory send OK.
It has not moved to the parent directory, we are still under
/home. Let's try to change to a different directory:
ftp> cd /etc 550 Failed to change directory.
ftp> cd foc 550 Failed to change directory.
Permission denied. Let's go to the user's home directory:
ftp> cd ftpuser 250 Directory successfully changed. ftp> ls 227 Entering Passive Mode (192,168,122,15,121,25). 150 Here comes the directory listing. -rwxrwx--- 1 0 0 24 Sep 08 20:10 FTP_CHECK 226 Directory send OK.
The operation is successful so we have successfully restricted user to a directory using FTP.
Example-2: Define a different root directory for each user
In this step, let's define a different directory for the root directory and give the home directory different from the standard when creating a new user. Let's create a directory in the /(root) directory for the ftp user home directory:
[foc@almalinux8 ~]$ sudo mkdir /ftp
Next, let's define the permissions:
[foc@almalinux8 home]$ sudo chmod 770 -R /ftp
[foc@almalinux8 home]$ sudo chown -R faruk:ftp /ftp/faruk
Create new FTP User
First of all, let's explain the steps to be considered when creating a new user. Let's create the new user's home directory under /ftp with the -d parameter:
[foc@almalinux8 ~]$ sudo adduser faruk -d /ftp/faruk
Then let's authorize this directory to be its own only:
[foc@almalinux8 home]$ sudo chmod -R 700 /ftp/faruk
[foc@almalinux8 home]$ sudo usermod -G ftp faruk
Let's create the new user's password:
[foc@almalinux8 home]$ sudo passwd faruk Changing password for user faruk. Retype new password: passwd: all authentication tokens updated successfully.
Configure vsftpd.conf to restrict user
In the above step, we have given the root directory of ftp users as
/ftp/faruk. Let's edit
vsftpd.conf to be under
/ftp here. Add the following lines to
Let's create a configuration file for the user under the /etc/vsftpd_user_conf directory:
[foc@almalinux8 ~]$ sudo touch /etc/vsftpd_user_conf/faruk
Let's define the root directory of that user for this file:
[foc@almalinux8 ~]$ sudo nano /etc/vsftpd_user_conf/faruk local_root=/ftp/faruk
save and exit file. Then the vsftpd service is restarted:
[foc@almalinux8 ~]$ systemctl restart vsftpd.service
Now let's login with faruk user:
foc@fedora:~$ ftp 192.168.122.15 Connected to 192.168.122.15 (192.168.122.15). 220 (vsFTPd 3.0.3) Name (192.168.122.15:foc): faruk 331 Please specify the password. Password: 230 Login successful. Remote system type is UNIX. Using binary mode to transfer files. ftp> ls 227 Entering Passive Mode (192,168,122,15,117,226). 150 Here comes the directory listing. -rw-r--r-- 1 0 0 0 Sep 10 19:05 WELCOME 226 Directory send OK. ftp>
You can now define a different home directory for each user. You do not have to collect all users' home directories in one place. In this way, you can restrict ftp user to a directory.
We have explained the steps to be done for directory authorization for the user on a previously installed FTP server. You can get help for installing a new FTP server here. You can restrict ftp user with the above steps during installation.
serverfault.com - Create new vsftpd user and lock to (specify) home / login directory
unix.stackexchange.com - Limit FTP access only to the /var/www with vsftpd
man page for vsftpd.conf