Cant restrict FTP access to www directory - CentOS7

Question

Objective:

I am trying to create a simple sftp access to the /var/www/ directory.

My Problem:

When I login via ftp, although I get access to the /var/www/ -I have access to the root directory also. I changed the chroot option as mentioned below to YES but still the problem persists. I cant seem to restrict access just to the /var/www folder.

Any help is appreciated.

Environment

CentOS7

Config

Below is my /etc/vsftpd/vsftpd.conf file

I created the user like so;

sudo useradd -m ftpuser -d /var/www/
sudo passwd ftpuser

With the config file below, I have tried both with

chroot_local_user=YES

and

chroot_local_user=NO

VSFTPD Conf file

local_enable=YES
write_enable=YES
local_umask=022
allow_ftpd_full_access
dirmessage_enable=YES                                                 
xferlog_enable=YES              
xferlog_std_format=YES                  
connect_from_port_20=YES                                                                
userlist_enable=YES     

chroot_local_user=YES

listen=NO                                    
listen_ipv6=YES                                                                                     
pam_service_name=vsftpd
tcp_wrappers=YES

ssl_enable=YES
rsa_cert_file=/etc/path_to_my_cert.pem
rsa_private_key_file=/etc/path_to_my_keyv.pem

Did you restart VSFTP after making your changes? – davidgo Nov 19 '19 at 00:58 — davidgo, Nov 19 '19 at 00:58
yes, I used `sudo systemctl restart vsftpd` – S.McDonald Nov 19 '19 at 00:59 — S.McDonald, Nov 19 '19 at 00:59

score 0 · Answer 1 · answered Nov 19 '19 at 04:51

0

If you can show all directories then try by following:-

allow_writable_chroot=YES

then restart ftp service

answered Nov 19 '19 at 04:51

Sukhjinder Singh

1,944
2
8
17

Is this not a bad idea based on this thread: https://serverfault.com/questions/743949/vsftp-why-is-allow-writeable-chroot-yes-a-bad-idea – S.McDonald Nov 19 '19 at 14:26
ensure that you would allow particular directory access to particular user (not a root user) – Sukhjinder Singh Nov 20 '19 at 05:49
so chmod 755 on the /var/www/USER/ – S.McDonald Nov 20 '19 at 05:53