Web Hosting Talk : Web Hosting Main Forums : Hosting Security and Technology : wu-ftp user rights

[vanHelsing]

My users are now able to download some OS files and other users files, nothing critical to system tho. Is this security hole that i missed or an feature?

If its a feature, how can i set that users dont have any rights outside /home/myaccount. I know that chroot is an option, but i dont care if users can see files, i only want to prevent access those file.

Debian Stable
wu-ftp 2.6.2

[eth00]

Not sure what wu-ftp calls it but the feature you are looking for is a chroot. There should be something in the config where you can chroot the users to their home directory.

If you do not set the option wu-ftpd and proftpd both allow access to / if the chmod allows it.

[vanHelsing]

OK, ill try to dig something up.

[hiryuu]

Don't use wu-ftpd. Its security history is beyond redemption, and better packages (proftpd was mentioned, and I like vsftpd) are readily available.

[sonic10]

I agree with hiryuu that wu-ftpd is not good since it is open to many exploits. Proftpd will do what you want to do with ease.

[vanHelsing]

Nice, how do i do it with ProFTP