0

I want to setup vsftpd to allow a user (foouser) to upload and create directories to /var/www/ with the intention of allowing entire webstites to be uploaded.

Current Permissions:

  1. Apache runs at www-data.
  2. document root is: /var/www/
  3. Permissions are www-data:www-data for /var/www (recursively.)

Steps already taken:

Created user: foouser

 useradd foouser

Added foo user to www-data group.

 usermod -a -G www-data foouser

Set /var/www/ as foouser's homedir:

 usermod -d /var/www/

Here's my vsftpd.conf file:

 root@c9e0266eb8c8:/var# cat /etc/vsftpd.conf | grep -v ^#
 listen=YES
 local_enable=YES
 write_enable=YES
 local_umask=022
 dirmessage_enable=YES
 use_localtime=YES
 xferlog_enable=YES
 connect_from_port_20=YES
 chown_uploads=YES
 chown_username=www-data
 xferlog_file=/var/log/vsftpd.log
 xferlog_std_format=YES

But, I still cannot upload the file:

 Command:   USER foouser
 Response:  331 Please specify the password.
 Command:   PASS ******
 Response:  230 Login successful.
 Status:    Server does not support non-ASCII characters.
 Status:    Connected
 Status:    Starting upload of /home/michael/settings.json
 Command:   CWD /var/www
 Response:  250 Directory successfully changed.
 Command:   TYPE I
 Response:  200 Switching to Binary mode.
 Command:   PASV
 Response:  227 Entering Passive Mode (172,17,0,2,174,22).
 Command:   STOR settings.json
 Response:  553 Could not create file.
 Error: Critical file transfer error

NOW... if I change the directory permissions from www-data to foouser:foouser, I can upload just fine, but that (of course) breaks apache.

What am I doing wrong?

Edit: Allowing anonymous file upload to /var/www/ would also be fine. This is a docker container, so an insecure practice like that is fine since this will be used for development not production.

DrDamnit
  • 348
  • 4
  • 16
  • What is the output of command 'cat /etc/passwd | grep foouser' It should be like below. 'foouser:x:501:501::/var/www/:/bin/bash' or else like below for no ssh login user 'foouser:x:501:501::/var/www/:/bin/nologin' – Shailesh Sutar Oct 24 '16 at 20:37
  • have you checked your selinux is enabled or not ? – asmath Jun 21 '21 at 04:33

1 Answers1

0

I think you need to add passive mode configurations to your '/etc/vsftpd.conf` file since your connection is entering into passive mode. Below are the configs. 

# Additional configuration
pasv_enable=YES
pasv_min_port=1024
pasv_max_port=1048
pasv_address=xx.xx.xx.xx #Public IP of your server
local_root=/var/www

You can set pasv_min_port and pasv_max_port as per your need. but make sure you allow them into your firewall.

Shailesh Sutar
  • 1,427
  • 4
  • 22
  • 40