Prevent FTP users from being able to navigate to directories above their home

Question

I created a user on Centos 7 via webmin and pointed /var/www/html/ page as their home directory so when they log in they start from there.

However, I logged in myself and realized that they can navigate from there to the upper directories which I don't want. How can I prevent this from happening?

Thank you.

Solution

You will need to find a feature specific to the ftp server you are using that could create a chroot-like environment. Some examples are:

• proftpd: DefaultRoot. This option will have to point what is the chroot dir of a server.
• pureftpd: -A option. Quoting the documentation

This feature is called "chroot". You can enable this by running pure-ftpd with the "-A" switch to do this with ALL your users (but root) .

• vsftpd: chroot_local_user=YES will chroot to default user home. There is already a good answer here.

Comments

[Cain Nuke]

its weird but I didnt install any ftp server so I dont even know how come I am able to FTP access.

[Admin]

As pointed out by @ivanivan, the default ftp server on webmin should be proftpd. It is just a matter of finding the configuration file and put a line like DefaultRoot=/var/www/html/ on it :)

[Cain Nuke]

But that one is stopped right now and Im still able to access. Is that normal?

[Admin]

netstat -tapn | grep 21, and see what is the process that is LISTENING on this port(21/tcp - ftp)

[Cain Nuke]

I see nothing on port 21, the user is on port 22.

[Admin]

22 is ssh so, sftp or scp are the protocols used to exchange files. Are you sure that is really an ftp server, and there is no custom port configured?

[Admin]

SFTP is and extension of FTP throuhg SSH. That's why you can access, because it is not related do proftpd. If you have a ssh daemon running on your server, you will mostly be able to use sftp... "chrooting" sftp is a hell of a quest, and should not be as trivial as it is with a ftp server...

[Cain Nuke]

So I need to enable chroot in SSH instead?

[Admin]

Yup. If you are using SFTP you started asking the wrong question, since they use totally different servers... and it is not a trivial question(you should follow a how-to) - wiki.archlinux.org/index.php/SFTP_chroot

[Cain Nuke]

Thank you for your help. Although it was actually easier than that.