Ryfujk

I'm trying to (re)configure my vsftpd server (linux/ubuntu machine) and a corresponding shared website folder in a way that ideally respect the following constraints:

• The virtual vsftpd user is called rootftp, and it belongs to a group called edev that also includes bob, the (sudo) sysadmin: he helps sometimes but it's not in charge of developing the site. Anyway, bob's wants to be able to modify any file without using superpowers (for instance, he doesn't want to be constantly checking if some file owner has change to root when playing around within the folder). Anyway, the edev group is designed to be a family that could grow in some point in the future, as implied by its name.


• No file/folder in the website folder is world accesible (others have no permissions).


• Apache (www-data) have the usual read-only permissions, except that it has write permissions for the usual "upload folder".


• The edev's members must have rw and rwx permissions for files/folders.


• Anonymous ftp login is forbidden.


• Virtual users actions must not affect any previous restriction in anyway (creating a file with incorrect user, group or permissions).

The last point is my main problem. The most obvious approach is to chown everything as www-data:edevs, setting setgid to every folder, and finally set per virtual user (to don't change vsftpd.conf):

virtual_use_local_privs=NO

chown_uploads=YES

chown_username=www-data

chown_open_mode=0450

anon_umask=007

# set other required anon_* directive.

but that has its own set of problems:

1. folders won't have execute permissions by default, because the open mode is the same for files and folders.


2. even if that can magically be solved, in case the upload folder changes for any reason (it is removed and then recreated for testing), the virtual user cannot apply the FTP CHMOD command to recover the apache write permissions because rootftp cannot change its permissions now, since the owner has changed.


3. another solution is to forbid the upload folder deletion, so its permissions are preserved after its original creation (bob can set them once and forever), but I haven't found the way to do it. The most closed thing I have found is to set chattr +i upload, but that will prevent every type of modification, not just "deletion". Setting the sticky bit to its parent directory will forbid the group (rootftp and bob) to add files, which is far from ideal. I don't know if a bind mount can help here either.

Another approach is to let the current configuration as it is, forget bob's comfort and a potential group of developers (every other edev's member will be forced to exclusively use ftp, even when ssh access could be granted), and chown everything as rootftp:www-data, although problem (1) will still be present (fact that annoys me).