Choosing A Webhost:
A web hosting service is a type of Internet hosting service that allows individuals and organizations to provide their own website accessible via the World Wide Web. Web hosts are companies that provide space on a server they own for use by their clients as well as providing Internet connectivity, typically in a data center. Web hosts can also provide data center space and connectivity to the Internet for servers they do not own to be located in their data center, called colocation. more...
|
vsftpd non-anonymous chrooting: msg#00044
|
Subject: |
vsftpd non-anonymous chrooting |
Whilst using vsftpd in chroot'ed mode for non-anonymous usage, I've
found that I appear to have to add this to my SELinux strict policy:
allow ftpd_t self:capability { dac_override dac_read_search };
or possibly just this:
allow ftpd_t self:capability { dac_read_search };
Without at least the dac_read_search, an ftp login always seems to fail.
The description of these "dac" permissions on Tresys' site suggests to
me that vsftpd is being too "greedy" in requiring these permissions to
chroot successfully. Since anonymous ftp with SELinux surely works Ok
without this capability, (or too many other people would have
complained ), does this mean that the correct fix for this is a minor
rewrite to vsftpd, rather than a change in SELinux policy?
My current ftpd/SELinux/chroot related configuration:
$ sudo grep ftp /etc/selinux/strict/booleans
ftpd_is_daemon=1
ftp_home_dir=1
$
$ sudo grep chroot /etc/vsftpd/vsftpd.conf | grep -v "^#"
chroot_list_enable=YES
passwd_chroot_enable=YES
chroot_list_file=/etc/vsftpd/vsftpd.chroot_user_list
userlist_file=/etc/vsftpd/vsftpd.chroot_user_list
$
--
Ted Rule
Director, Layer3 Systems Ltd
W: http://www.layer3.co.uk/
|
| |
