Member Avatar for cdawley4

Can someone tell me how to configure my vsftpd.conf file? I am getting a cannot change directory failure. What would cause this?

thanks,

Chris

  • 3 Contributors
  • 4 Replies
  • 248 Views
  • 8 Months Discussion Span
  • Latest Post Latest Post by vartotojas

Dani AI

Generated

Short, practical diagnosis and fixes for the “cannot change directory” FTP error (context: wants FTP access to the webroot; already suggested permissions and a symlink; located the config).

The error usually means one of three things: the FTP account is confined to a different root than your webroot (a jail/chroot), the account lacks the required filesystem traversal/ownership bits on the path you want, or a host security layer (AppArmor/SELinux) is preventing access. Start by confirming the system account’s actual home directory and whether it lies inside the FTP root. If you want that account to land in the webserver directory, set a per-user FTP root or update the account’s home to the webroot and ensure all parent directories have the execute (traverse) bit for that account.

Per-user vsftpd configuration is the cleanest way to change where a given username is rooted. Example pattern:

# in your vsftpd config
user_config_dir=/etc/vsftpd_user_conf

# then create a file named for the user inside that dir:
# local_root=/path/to/desired/root

(Place the per-user file with the username and set local_root there so only that account is affected.)

Permission and security checklist

  • Confirm ownership and that every parent directory on the path has the 'x' bit so the FTP user can traverse it.
  • If running Ubuntu/Debian, check AppArmor; on RHEL/CentOS check SELinux — both can log denial events that look like permission problems even when UNIX perms are correct. Inspect kernel/audit/syslog messages for access-denied entries. Temporarily switching the profile to complain/permissive lets you confirm whether the security layer is the cause.

Testing and restart

  • Test with an FTP-capable client (not SFTP — SFTP is SSH-based and won’t exercise vsftpd). A verbose curl or an FTP client can show directory errors and server replies.
  • After config changes, restart the FTP service with the system’s service manager (systemctl on modern systems) and re-check logs for clues.

These steps explain why a jail, permissions, or a security profile would cause the failure and give a safe path to map an FTP user to your webroot without exposing other system areas.

Recommended Answers

All 4 Replies

Member Avatar for Cain

where to start.. lets see if Im a bit rusty its been ages since my last post.

first check the permissions for /var/ftp/ and ensure that all can gain access drwxr-xr-x minimum

enable vsftpd with the following command:
chkconfig vsftpd on

verify the service is enabled in the appropriate runlevels (3,5 @ a minimum):
chkconfig --list | grep vsftpd

for more info on vsftpd & vsftpd.conf these commands will do:
man vsftp
man vsftpd.conf

next, ask yourself the following questions and use vi (vim) to edit vsftpd.conf:

do I want to allow anonymous users or not? [unless you want to loose major bandwith I wouldnt do this] default is no {anonymous_enable=NO}
do I want them to upload data? [this can suck up space] default is no {anon_upload_enable=NO}
do I want them to create thier own directory structures? [things can get messy quick]
do I want them to download only? [this one is good for rpm servers and ftp servers in general, you dont
want someone using you as an illicit node] default

anyway, follow through the file and pick what you would/wouldnt like users
to do by removing the comments in front of the disabled variables and
setting them to =YES or NO to suit your needs.

next, restart or start vsftpd with one of the following methods:
service vsftpd start
/etc/init.d/vsftpd start

test it out via sftp:
sftp localhost

enter (user) anonymous [or whatever]
(password) [leave blank, hit return]

tell us if it worked..

also if it dosent pan please include a condenced version of your vsftpd.conf file variables only

Enjoy

Member Avatar for cdawley4

Hi,

Sorry it took so long for me to reply. I can log in successfully, however, I can't access my /var/www directory with my username. How would I go about getting to that particular directory? I guess if I can't get there, I would have to change my httpd.conf file to use personal directories instead of /var/www for hosting webpages.

anonymous_enable=NO
local_enable=YES
write_enable=YES
#local_umask=022
anon_upload_enable=NO
anon_mkdir_write_enable=YES
dirmessage_enable=YES
xferlog_enable=YES
connect_from_port_20=YES
chown_uploads=YES
chown_username=cdawley
xferlog_file=/var/log/vsftpd.log
#xferlog_std_format=YES
#idle_session_timeout=600
data_connection_timeout=120
nopriv_user=cdawley
#async_abor_enable=YES
#ascii_upload_enable=NO
#ascii_download_enable=NO
#ftpd_banner=Welcome to blah FTP service.
#deny_email_enable=YES
#banned_email_file=/etc/vsftpd/banned_emails
#chroot_list_enable=NO
#chroot_list_file=/etc/vsftpd/chroot_list
#ls_recurse_enable=NO
pam_service_name=vsftpd
userlist_enable=YES
#enable for standalone mode
listen=YES
tcp_wrappers=YES

Member Avatar for Cain

the default "root" jail location for vsftpd is /var/ftp
you cannot traverse the directory structure above that point for security purposes

link /var/www to /var/ftp/www like so:

ln -s /var/www /var/ftp/www
(you might want to double check my syntax)

ensure cdawdley has access rights to read and write files below /var/www

this method retains the default and creates a directory within..
----------

else you could mv /var/ftp/pub /var/www/pub
then remove the /var/ftp/ directory

then link /var/www directory to /var/ftp and viola youre done.
www & ftp are the same

you may have to restart vsftpd to test this out.
this shouldnt have an effect on apache.

Member Avatar for vartotojas

can someone tell me where the heck I can find this "vsftpd.conf" file? If it does not exist, then where shall I place it?

thx

update: nevermind I found it, but for those who want to know:

/etc/vsftpd/

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.