Ubuntu – 500 OOPS: cannot change directory: /home/user/public_html, VSFTPD error

directorypermissionsservervsftpd

I setup VSFTPD on my Ubuntu server 12.04, it worked very good. Until I tried to change the permissions of the user so the user couldn't go in the / directory and only in the directories inside /home/user/public_html.

It could have to do something with the fact that I did this:

sudo chmod 700 -R /

I have a user, ftpUser and he is inside a group, ftpUsers. The permissions of /home/user/public_html are:

drwxrwxr-x 9 ftpUser ftpUsers 4096

My VSFTPD file looks like this:

listen=YES
anonymous_enable=NO
local_enable=YES
write_enable=YES
local_umask=022
connect_from_port_20=NO
chroot_local_user=YES
pam_service=vsftpd
userlist_file=/etc/vsftpd.userlist
userlist_enable=YES
userlist_deny=NO

And in /etc/vsftpd.userlist there is only one line: ftpUser

How do I solve this so I can login, it think it has to do something with permissions but I don't now what it is!?

Best Answer

You can check this link. It worked for me.

Make sure that the user and group permissions for the account and the home directory match. For example, if you are logging in as:

account:x:521:500::/some/directory:/sbin/nologin

then make sure that the home directory defined for “account” is at least readable and executable by user 521 and group 500.

Related Solutions

Ubuntu – Create FTP users with limited access only to home directory Ubuntu 12.04

(Not sure why a question from 2014 pops up again on the homepage, but anyway :D )

It's probably not a good idea to mess with the overall permissions of the rest of the file system, like it has been suggested in the other answer. A better way would be to use a feature called "chroot".

"chroot", short for "change root", just does that: It changes the root of the directory tree the (FTP) user can acccess to what the admin wants it to be. Sometimes the same feature is referred to as "jailing" the user in their home directory.

Most FTP servers support chroot (with the exception of some very small, bare-bone ones). I'm not really familiar with vsftpd, but according to this how-to on Cybercity you need to set the config directive chroot_local_user to 1.

Ubuntu – VSFTPD An unexpected TLS packet was received

Finally got it to work. Beside my debugging process which I outlined in the updates to the original question, here is what I did after.

For TLS to work, I recommend that you first make sure that passive mode is working without TLS. This is because from what I understand the encryption will prevent the server ip that is sent by the server to be received by the ftp client.

So first step, disable TLS by setting ssl_enable=YES in the conf file.

Passive mode requires additional ports. These are the lines that are related to that in the config file:

pasv_address=111.111.111.111
pasv_addr_resolve=NO
port_enable=YES
pasv_enable=YES
pasv_min_port=40000
pasv_max_port=50000

You have to make sure that the passive ports are open! I was using EC2, so you need to open the ports in the security groups. In addition check ufw:

$ sudo ufw status numbered
Status: active

     To                         Action      From
     --                         ------      ----
[ 1] 20/tcp                     ALLOW IN    Anywhere
[ 2] 21/tcp                     ALLOW IN    Anywhere
[ 3] 990/tcp                    ALLOW IN    Anywhere
[ 4] 40000:50000/tcp            ALLOW IN    Anywhere
[ 5] 22/tcp                     ALLOW IN    Anywhere
[ 6] 20/tcp (v6)                ALLOW IN    Anywhere (v6)
[ 7] 21/tcp (v6)                ALLOW IN    Anywhere (v6)
[ 8] 990/tcp (v6)               ALLOW IN    Anywhere (v6)
[ 9] 40000:50000/tcp (v6)       ALLOW IN    Anywhere (v6)
[10] 22/tcp (v6)                ALLOW IN    Anywhere (v6)

With this I was able to connect using passive mode, and then enabling ssl_enable=YES just worked.

This final /etc/vsftpd.conf:

listen=YES
listen_ipv6=NO

anonymous_enable=NO
local_enable=YES
write_enable=YES

local_umask=022
dirmessage_enable=YES
use_localtime=YES
xferlog_enable=YES
xferlog_file=/var/log/vsftpd.log
connect_from_port_20=YES
log_ftp_protocol=YES

nopriv_user=vsftpd
virtual_use_local_privs=YES
guest_enable=YES
user_sub_token=$USER
local_root=/home/ftpmain/ftp/$USER
hide_ids=YES
guest_username=vsftpd
allow_writeable_chroot=YES
chroot_local_user=YES
chroot_list_enable=NO

secure_chroot_dir=/var/run/vsftpd/empty
use_localtime=YES
ssl_enable=YES
allow_anon_ssl=NO
ssl_tlsv1=YES
ssl_sslv2=NO
ssl_sslv3=NO
require_ssl_reuse=NO
ssl_ciphers=HIGH
rsa_cert_file=/etc/ssl/private/vsftpd.pem
rsa_private_key_file=/etc/ssl/private/vsftpd.pem

pasv_address=111.111.111.111
pasv_addr_resolve=NO
port_enable=YES
pasv_enable=YES
pasv_min_port=40000
pasv_max_port=50000

Best Answer

Related Solutions

Ubuntu – Create FTP users with limited access only to home directory Ubuntu 12.04

Ubuntu – VSFTPD An unexpected TLS packet was received

Related Question