Unix Tip: Creating a chrooted FTP account

Often referred to as a "chroot jail" or a "padded cell" because users cannot escape from the directories into which they are put when they log in, the basic concept of a "chroot" (change root) configuration is that a user's working view of the system's file system is dramatically modified so that only some particular directory and its contents is visible, making it appear to be the entire system. In fact, the chroot process involves setting up a mini-OS environment that looks and acts as if it were largely independent of the rest of the system (though, of course, it is not). This allows jailed users to issue an essential set of commands -- whatever commands are required for them to do the work that their jail cell was meant to accomplish. For example, jailed users might need to change directories. If so, the cd command needs to be added to their limited file system. They might need to list files. If so, they need a copy of the ls command.

Providing only the basic commands that jailed users need is not quite enough, however. While it might not be obvious, most basic Unix commands are incomplete in themselves. To function, they make use of a number of shared library files. If your jailed users don't have access to these shared library files, they will not be able to make use of commands like cd and ls, even if you provide these binaries in their a /usr/bin directory. The commands will issue errors attesting to the missing library files and fail.

Each chrooted environment, therefore, needs to contain many of the same directories you would expect to find in the root file system on a typical Unix system -- /usr/bin, /usr/lib, /etc and so on. The commands and libraries you need for any chrooted environment depend on the nature of the application that it will be supporting.

In particular, creating a chrooted ftp site involves both creating a working chrooted environment and then ensuring that your ftp server enforces the restrictions.

FTP-Only Setup

When you are setting up an account that is only to be used for uploading and downloading files, you want to be sure that the account cannot be accessed in any other way. To make an account ftp-only, you need to do two things. First, you assign the account a shell that doesn't permit normal login. You can do this by setting the jailed user's shell to /bin/false or you can create an executable to serve as the user's shell. I prefer to create my own shell by compiling code like this:

Sign up for ITworld's Daily newsletter
Follow ITworld on Twitter @IT_world

• Email
• Print
• Share
  • Slashdot
  • Digg
  • Stumble
  • Reddit
  • Newsvine