How to Restrict a FTP User to a Directory in Linux

1. Overview

In this tutorial, we’ll configure vsftpd to limit users from browsing parent directories when a connection is made through FTP. We’ll make this possible by creating an FTP user and modifying the default configurations in the vsftpd.conf file.

2. Setting up an FTP User

To begin, let’s create an FTP user with limited permissions:

$ sudo useradd ftpuser

Next, let’s set the user’s password:

$ sudo passwd ftpuser
New password: 
Retype new password: 
passwd: password updated successfully

Alternatively, we can use sudo useradd ftpuser -s /sbin/nologin to prevent SSH logins.

Next, let’s create a directory called ftp within the ftpuser’s home directory. We’ll use the -p flag to create the user’s default home directory:

$ sudo mkdir -p /home/ftpuser/ftp

Next, let’s set ownership and remove write permission:

$ sudo chown ftpuser:ftpuser /home/ftpuser/ftp
$ sudo chmod a-w /home/ftpuser/ftp

Removing the write permission from all users denies anyone from modifying the file contents. For example, we won’t be able to rename or remove files from this directory. However, the owner of the directory still has written permission.

Inside the ftp directory, let’s add two directories and change their ownership to ftpuser:

$ sudo mkdir /home/ftpuser/ftp/documents /home/ftpuser/ftp/Python
$ sudo chown ftpuser:ftpuser /home/ftpuser/ftp/documents /home/ftpuser/ftp/Python
$ sudo ls -l /home/ftpuser/ftp
total 8 
drwxr-xr-x 2 ftpuser ftpuser 4096 Aug  3 01:18 documents
drwxr-xr-x 2 ftpuser ftpuser 4096 Aug  3 01:39 Python

3. Configuring vsftpd

Now, we’ll edit the vsftpd configurations. We’ll make changes and add the required setting to limit our FTP user.

Firstly, let’s confirm if vsftpd is installed and is running:

$ sudo systemctl status vsftpd
● vsftpd.service - vsftpd FTP server
Loaded: loaded (/lib/systemd/system/vsftpd.service; enabled; vendor preset>
Active: active (running) since Thu 2023-08-03 01:32:16 CDT; 4h 6min ago
Process: 2896 ExecStartPre=/bin/mkdir -p /var/run/vsftpd/empty (code=exited>
Main PID: 2897 (vsftpd)
Tasks: 1 (limit: 2256)
Memory: 852.0K
CPU: 175ms
CGroup: /system.slice/vsftpd.service
└─2897 /usr/sbin/vsftpd /etc/vsftpd.conf

Otherwise, if it’s not available, we install it through:

$ sudo apt-get install vsftpd

Secondly, let’s edit the vsftpd configuration file to set up user-specific restrictions and directory access. Before making any adjustments, we must make a copy of the original file:

$ sudo cp /etc/vsftpd.conf /etc/vsftpd.conf.copy

We create a copy of the original file to make it easier to restore in case we need the original configuration later or if our modifications are not working.

Now, let’s edit the vsftpd.conf file:

$ sudo nano /etc/vsftpd.conf

After we’ve opened the file, let’s set the following directives:

anonymous_enable=NO
local_enable=YES

These directives are important because anonymous_enable prevents anonymous logins while local_enable allows local users to log in.

Next, let’s find and uncomment the following line:

write_enable=YES

This directive allows us to add, change, or remove files and directories on the filesystem.

To prevent users from accessing files and commands outside the directory tree, let’s uncomment:

chroot_local_user=YES

Lastly, let’s add the shared directory path:

local_root=/home/ftpuser/ftp

If we manage many users, we can use the $USER variable to set the shared directories and route users to their home directories. The user_sub_token directive logs in each user to their home directory while local_root sets the path to the shared directory:

user_sub_token=$USER
local_root=/home/$USER/ftp

For these changes to take effect, we need to restart the vsftpd service:

$ sudo service vsftpd restart

Let’s test our connection and confirm if the changes have taken effect:

$ ftp 192.168.0.105     
Connected to 192.168.0.105.
220 (vsFTPd 3.0.5)
Name (192.168.0.105:gt2): ftpuser
331 Please specify the password.
Password: 
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> pwd
Remote directory: /
ftp> ls
229 Entering Extended Passive Mode (|||24367|)
150 Here comes the directory listing.
drwxr-xr-x    2 0        0            4096 Aug 03 01:39 Python
drwxr-xr-x    2 1001     1001         4096 Aug 03 01:18 documents
226 Directory send OK.
ftp> cd documents
250 Directory successfully changed.
ftp> cd /etc
550 Failed to change directory.
ftp> cd /root
550 Failed to change directory.
ftp> cd /Python
250 Directory successfully changed.
ftp> 

The user is directed to the ftp directory (which is indicated as the remote directory or / ) upon login. The ftpuser can move to child directories but can’t move outside the ftp directory.

4. Conclusion

In this article, we’ve discussed creating an FTP user with limited capabilities and preventing the user from accessing parent directories. The FTP user we’ve created can only browse the directories within it. Further, we mentioned that we should turn off shell logins for this kind of user to prevent authorized access (especially through SSH).

Next, we must ensure that the vsftpd server is running. If it’s running and the status isn’t active, let’s reinstall it. Lastly, when modifying the vsftpd.conf file, we must ensure that the right directives are enabled to ensure that the proper permissions are given to the right users.