default behavior for vsftpd local user login

[elgolferisto]

I'm setting up vsftpd for my site, and I want both local and anonymous logins. The only difference between anonymous and local logins should be the permissions associated with files and directories. Specifically, local users should be able to upload files, while anonymous users should not. The problem I am having is that by default, when the local users log in, they are chrooted to their /home/local_user directory. I thought that this was the purpose of the chroot_local_user directive, but setting this to YES or NO doesn't seem to change anything. So, my question is: Is the default behavior for vsftpd to chroot local users to the directory specified in /etc/passwd? If so, is there any way to change it to another directory without changing /etc/passwd? Is this behavior shared across all ftp servers, or just vsftpd?

Oops, looks like that was actually 3 questions. Oh well. Thanks in advance for any help.

[StupidScript]

Whatcha got in your

/etc/vsftpd.conf

? Check the

local_umask

and

anon_upload_enable

settings. Regarding chroot, it pretty much depends on how your directory permissions are set up. Does a local user have permission to escape from their own directory?

[elgolferisto]

Here's my configuration:

anonymous_enable=YES
local_enable=YES
write_enable=YES
local_umask=000
anon_umask=022
anon_upload_enable=YES
dirmessage_enable=YES
xferlog_enable=YES
connect_from_port_20=YES
xferlog_file=/var/log/vsftpd.log
xferlog_std_format=YES
ascii_upload_enable=YES
ascii_download_enable=YES
chroot_list_enable=NO
chroot_local_user=NO
passwd_chroot_enable=NO
chroot_list_file=/etc/vsftpd.chroot_list
pam_service_name=vsftpd
userlist_enable=YES
listen=YES

After further investigation, I think I have narrowed the problem. Using "real" ftp clients, such as SmartFTP or whatever the command line client is that comes with RH9, I can escape my home directory, so vsftpd seems to be behaving properly. However, using IE's ftp client, I cannot. Why is that? Other users on the system do use IE for ftp, so is there anyway to escape the home directory?

[StupidScript]

Make sure you're editing /etc/vsftpd.conf and not the sample /etc/vsftpd/vsftpd.conf file ... ;)

anonymous_enable=YES
local_enable=YES
write_enable=YES
local_umask=000
anon_umask=022
#local users should be able to upload files, while anonymous users should not
anon_upload_enable=NO
dirmessage_enable=YES
xferlog_enable=YES
connect_from_port_20=YES
xferlog_file=/var/log/vsftpd.log
xferlog_std_format=YES
ascii_upload_enable=YES
ascii_download_enable=YES
chroot_list_enable=YES
chroot_local_user=NO
passwd_chroot_enable=NO
#add any local users you want to chroot to this list.
#Local users not on this list will not be chrooted.
#Anonymous users are chrooted by default.
chroot_list_file=/etc/vsftpd.chroot_list
pam_service_name=vsftpd
userlist_enable=YES
listen=YES

After restarting the daemon:

Local users can log in and upload etc. to any directory they have permissions for.

Anonymous users can log in and are chrooted to the default ftp directory (/var/ftp). They can only download.

Check the installation instructions at ftp://vsftpd.beasts.org/users/cevans/untar/vsftpd-1.1.3/INSTALL for more info.