vsftpd + Ubuntu: Fix "500 OOPS" writeable chroot

[^rooker]

[PROBLEM]
More recent versions of vsftpd have enabled a new security feature by default:
A user may not login to a chroot'ed environment, if the (ch)root folder is writable.

It's explained in vsftpd's FAQs:

vsftpd is protecting against dangerous configurations.

The cause of this message is usually dodgy ownership of the ftp home directory. The home directory should NOT be owned by the ftp user itself. Neither should it be writable by the ftp user.

I must admit, that I have to read up a bit more, why it's not good to have the user own the chroot'ed folder. Especially if the most typical use case for this is to limit users to their home directories (which are, of course, owned by them).

However.

[SOLUTION]
In order to restore a setup to the same security and functionality state as with previous versions, you can override this by adding the following rule to your /etc/vsftpd.conf:

Code: Select all

allow_writeable_chroot=YES

Unfortunately, this feature is added in vsftpd v3.x, so when running the recent Debian Stable (v7 Squeeze) or Ubuntu LTS (12.04 "precise pangolin"), you will get the following error:

500 OOPS: unrecognised variable in config file: allow_writeable_chroot

For Ubuntu you can do the following:

• Add "The Frontier Group"'s PPA
• Update the vsftpd package (to the PPA version)

This means:
1) Install "The Frontier Group"'s PPA:

Code: Select all

$ sudo add-apt-repository ppa:thefrontiergroup/vsftpd

2) Update apt-cache:

Code: Select all

$ sudo apt-get update

3) Install the PPA version of vsftpd:

Code: Select all

$ sudo apt-get install vsftpd

4) Add the config line to /etc/vsftpd.conf to allow writeable chroot:

Code: Select all

allow_writeable_chroot=YES

5) Restart vsftpd:

Code: Select all

$ sudo service vsftpd restart

Voila. That's it.

[^rooker]

Optional Remarks:

There are some things which should be mentioned about this:

1) There's also the option to revoke write-permissions to the user's root.
2) Installing a "very secure" FTP package from a user's PPA is a bit questionable from a security point of view...

A few related links:

• http://askubuntu.com/questions/128180/v ... ter-update
• http://blog.thefrontiergroup.com.au/201 ... ork-again/
• http://maltris.org/500-oops-vsftpd-refu ... -2443.html