Restrict FTP Users To Their Home Directory Without Using OpenSSH – Oracle Linux
Sometimes, we want to grant access to some users for uploading and downloading (Transferring files) file via FTP server on your Linux machine.
By default, any user has access to view his home directory and other directories on remote machine but we want to restrict all FTP users to their home directory and prevent uploading files from other users home directory. Also we want to disallow the user to make SSH connection and use SFTP.
As the first step, you need to install “VSFTPD” as FTP server on your Linux machine and then configure some configuration files.
Also we want to create a group and grant FTP permissions to the group.
Here is the instructions and configurations:
Step 1: Create group, users and change the users home directories:
mkdir /FTP/ftpuser1 mkdir /FTP/ftpuser1/incoming mkdir /FTP/ftpuser1/outgoing groupadd ftpusers useradd -d /FTP/ftpuser1 -g ftpusers ftpuser1 passwd ftpuser1 chown root:root /FTP/ftpuser1 chmod 750 /FTP/ftpuser1 setfacl -m u:ftpuser1:rwx /FTP/ftpuser1/incoming setfacl -m u:ftpuser1:rwx /FTP/ftpuser1/outgoing
Step 2: Deny the group access to SSH by editing ‘/etc/ssh/sshd_config”:
Find and comment the below line: Subsystem sftp /usr/libexec/openssh/sftp-server Add the below line: Denygroup ftpusers
Save and exit. Then restart “sshd” service.
Step 3: Add the below lines to “/etc/vsftpd/vsftpd.conf”
anonymous_enable=NO chroot_local_user=YES userlist_enable=YES userlist_file=/etc/vsftpd/user_list_access userlist_deny=NO
Step 4: Create a file (“/etc/vsftpd/user_list_access”) and add the usernames to the file and then restart “vsftpd” service.
Step 5: Test FTP connection by run “ftp x.x.x.x” command and logon to FTP server by the ftpuser.
Hope, this post help you to keep safe your FTP server.
Update: If you want to disable the user logon, you should change the below line in “/etc/passwd”:
ftpuser:x:500:500::/FTP:/bin/bash Change to: ftpuser:x:500:500::/FTP:/sbin/nologin