# VSFTPD chroot configuration
>> Create a no-shell user
useradd -d $HOME_PATH -s /sbin/nologin $FTPUSER && passwd $FTPUSER
!!!MAKE SURE TO CHMOD 755 the parent directory!!!
yum -y install vsftpd
chkconfig vsftpd on
sed -i -e 's/IPTABLES_MODULES=""/IPTABLES_MODULES="ip_conntrack_ftp"/g' /etc/sysconfig/iptables-config
modprobe ip_conntrack_ftp
echo "rack" >> /etc/vsftpd/vsftpd.chroot_list
mv /etc/vsftpd/vsftpd.conf /etc/vsftpd/vsftpd.conf.ORIG
cat >/etc/vsftpd/vsftpd.conf <<EOF
# vsftpd.conf - PASSIVE
anonymous_enable=NO
local_enable=YES
write_enable=YES
local_umask=022
dirmessage_enable=YES
xferlog_enable=YES
listen_port=21
connect_from_port_20=YES
xferlog_std_format=YES
listen=YES
pam_service_name=vsftpd
userlist_enable=YES
tcp_wrappers=YES
pasv_min_port=60000
pasv_max_port=65000
# Add in /etc/vsftpd/vsftpd.chroot_list who you do *NOT* want to be chrooted
chroot_local_user=YES
chroot_list_enable=YES
chroot_list_file=/etc/vsftpd/vsftpd.chroot_list
# RackConnect
# pasv_enable=YES
# pasv_min_port=60000
# pasv_max_port=60100
# pasv_address=<publicRCip> (might not be required)
# Logging
xferlog_enable=YES
log_ftp_protocol=NO
syslog_enable=NO
vsftpd_log_file=/var/log/vsftpd.log
EOF
>> Make sure to comment out "auth required pam_shells.so" in /etc/pam.d/vsftpd (errors in authenticate users with /bin/false shell):
sed -i 's/^\(auth.*required.*pam_shells\.so.*$\)/#\1/' /etc/pam.d/vsftpd
>> Enable firewall ports (in Rackconnect, open the same on the physical firewall):
iptables -I INPUT -p tcp --dport 21 -m comment --comment "FTP" -j ACCEPT
iptables -I INPUT -p tcp -m multiport --dports 60000:65000 -m comment --comment "FTP passive mode ports" -j ACCEPT
/etc/init.d/iptables save
>> Restart the service
service vsfptd restart
If -> vsftpd: refusing to run with writable root inside chroot ()
=> allow_writable_chroot=YES
=======================================================
SFTP Jailed:
!!!! remember that the users home directory must be owned by root
groupadd sftponly
>> 1 domain managed by 1 or more users:
useradd -d /var/www/vhosts -s /bin/false -G sftponly bob
>> 1 user managing multiple domains:
useradd -d /var/www/vhosts -s /bin/false -G sftponly bob
SFTPUSER=bob
SFTPUSERPASS=$(tr -cd '[:alnum:]' < /dev/urandom | fold -w12 | head -n1)
echo "$SFTPUSERPASS" | passwd --stdin $SFTPUSER && echo -e "\nsfptuser: $SFTPUSER\npassword: $SFTPUSERPASS"
>> /etc/ssh/sshd_config
#Subsystem sftp /usr/libexec/openssh/sftp-server
Subsystem sftp internal-sftp
>> 1 domain managed by 1 or more users:
Match Group sftponly
ChrootDirectory %h
X11Forwarding no
AllowTCPForwarding no
ForceCommand internal-sftp
>> 1 user managing multiple domains:
Match Group sftponly
ChrootDirectory /var/www/vhosts/%u
X11Forwarding no
AllowTCPForwarding no
ForceCommand internal-sftp
sshd -t
service sshd restart
>> Set correct permissions!!!
chmod 755 /var/www/
chown root:root /var/www
chown -R root:sftponly /var/www/*
find /var/www/ -type d | xargs chmod 2775
find /var/www/ -type f | xargs chmod 644