jueves, 29 de enero de 2015

jailing users with our FTP Server


I know FTP Server is still insecure for several reasons, I know there are better alternatives such as sftp, ssh or at least use ftp with SSL support, but we all know many users come from the dark side (win$$$... ) so maybe this post may be useful specially to them, in case you are running a FTP Server, it would be great restrict access just to the /home directory, in order to accomplish it these steps should be enough:

0. Create a directory for the "alienuser", it would be great in www directory in case you're at work and some consultant needs to upload something:
    sudo mkdir /var/www/alienuserdir

1. change owner group to that directory:
    sudo chown root.ftp /var/www/alienuserdir

2. addjust permission to the directory:
    sudo chmod 770 -R /var/www/alienuserdir

3. it would be great to do a ls -l to alienuserdir so you may check your changes
 
4. Create user's account from terminal:
   sudo adduser alienuser   //I like to user perl script adduser, save us a lot of time unlike useradd

5. Change the alienuser's home directory:
   sudo usermod --home /var/www/alienuserdir alienuser

6. Add alienuser to ftp group:
    sudo usermod -G ftp alienuser

7.  open the conf file of vsftpd:
     sudo nano /etc/vsftpd.conf

8. uncomment/add/change the next lines:
   anonymous_enable=NO
  local_enable=YES
  write_enable=YES
  chroot_local_user=YES
  local_root=/var/www/alienuserdir

9. save it and restart the service:
    sudo service vsftpd restart

10. that's all, now you may try using your favorite ftp client such as filezilla entering the host name, user(alienuser) and the password, it would be great whether you try to upload/download something as well

All the best



No hay comentarios:

Publicar un comentario