chroot not working for ftp guest users? RH 7.2

[aixmurderer]

Hi guys

Created the ftp user similar as follows in /etc/passwd:
userxxx:x:513:510::/home/ftp/userxxx/./:/bin/true

Added the user to group 510 (defined as guest)in /etc/group

Added /bin/true to the /etc/shells file

Added guestgroup=guest to /etc/ftpaccess

Created /bin,/etc,... etc in /home/ftp/userxxx dir, all permissions and ownerships seems fine.

The problem is that chroot does not seem to jail me to the users directory, I initially get to the user's directory but can roam around from there. Why?
IBM Certified Specialist - MQSeries

 

[ifincham]

Hi,

I can't see anything obviously wrong there yet from what you say the chroot part is not actually happening. Try going through the procedure listed in the securing & optimising linux book -->

http://www.linuxdoc.org/LDP/solrhe/Securing-Optimizing-Linux-RH-Edition-v1.3/chap29sec296.html

Also, see the wu-ftpd doc -->

http://www.wuftpd.org/HOWTO/guest.HOWTO

Regards

 

[bgarlock]

You may want to give Proftpd a try. Proftp has many more options than wu-ftpd, and is more secure. Click on the following link for some of the features:

http://proftpd.linux.co.uk/features.html

I have setup a few proftpd servers, and have never had a problem with chroot jail. I know my answer to your problem may involve switching software, but I find proftpd much easier to configure (apache like configuration) than wu-ftpd. Bruce Garlock
bruceg@tiac.net

http://bruceg.dyndns.org

 

[aixmurderer]

No I have tried changing:
userxxx:x:513:510::/home/ftp/userxxx/./:/bin/true
to

userxxx:x:513:510::/home/ftp/userxxx/./:/dev/null as per the

http://www.linuxdoc.org/LDP/solrhe/Securing-Optimizing-Linux-RH-Edition-v1.3/chap29sec296.html

link, this time it won't let me log in at all.

Darn...either all or nothing. IBM Certified Specialist - MQSeries

 

[aixmurderer]

Problem solved, a simple ftpaccess entry I missed:

restricted-uid *

See this site for good advice:

http://www.wu-ftpd.org/HOWTO/addendum.guest.HOWTO.htm

IBM Certified Specialist - MQSeries