vsftpd chroot

[Thom Cornwell]

Has anyone else successfully made chroot work in vsftpd via the configuration file?

[Thom Cornwell]

Here is the supporting software that I have installed:

openssh-4.2p1
openssl-0.9.8a
HP-UX Secure Shell: sftp.c,v A.04.20.004
what /usr/local/sbin/vsftpd
/usr/local/sbin/vsftpd:
$Revision: 92453-07 linker linker crt0.o B.11.47 051005 $

[Thom Cornwell]

grep -v "^#" vsftpd.conf
anonymous_enable=YES
local_enable=YES
write_enable=YES
local_umask=022
dirmessage_enable=YES
connect_from_port_20=YES
xferlog_file=/var/log/vsftpd.log
ftpd_banner=VSFTPD Server 2.03
chroot_list_file=/etc/vsftpd.chroot_list
xferlog_std_format=NO
xferlog_enable=YES
log_ftp_protocol=YES
check_shell=NO
vsftpd_log_file=/var/log/vsftpd.log
userlist_enable=YES
userlist_file=/etc/vsftpd.user_list
userlist_deny=NO

[Ivan Ferreira]

I don't see these parameters in you configuration file:

chroot_local_user=YES
chroot_list_enable=YES

[Thom Cornwell]

chroot_list_file=/etc/vsftpd.chroot_list
The other two are disabled, as the documentation reads that having them enabled, then the list works in reverse.

[Thom Cornwell]

I have discovered that I am not getting to the vsftpd, but instead am getting to the ssh subsystem /opt/ssh/libexec/sftp-server when I sftp to the system. What I need to know at this point is how to tell sshd not to start /opt/ssh/libexex/sftp-server, but instead use the inetd.conf entry I have for the vsftpd for requests coming to port 20. During this process I have successfully compiled the version 2.04 of vsftpd, thinking the problem was in version 2.03.

[Mike Keighley]

A bit of a misunderstanding here, I think.

vsftpd is NOT a replacement sftp server (is it ?)

rather it is a conventional ftp server (ports 21 and 20) which implements the "AUTH TLS" and "PROT P" extensions to the ftp protocol, thus encrypting command or data or both.

so yes, a remote sftp client will connect to openssh/sftpd, not vsftpd.

a decent client for talking to vsftpd might be e.g. CoreFTP lite.

[Thom Cornwell]

Yes it was me the confused person who was the source of the problem ;-) I however am now trimming down what is needed versus what is not needed when you use the ssh_chroot_setup.sh. There just has to be an easier way to set up a chroot jail house for sftp users. Thank you for the information about a viable client.

[Mike Keighley]

you're welcome, of course.

... and I should have apologised for not actually answering the original question:
No, I haven't managed to get vsftpd to work chroot-ed

... and yes I agree that chroot-ing in general is harder than it should be.

I am leaning more in the direction of SELINUX, where you define a policy which severely restricts what a given executable can do. Not being able to read or write a file outside the homedir, seems as close to chroot as makes no difference.

p.s. should have mentioned that CoreFTP Lite *can* also be an sftp client, tho' that ain't what I use it for.

[Thom Cornwell]

User education helped clear up a misconception