{"action":"created","issue":{"url":"https://api.github.com/repos/rtCamp/easyengine/issues/463","labels_url":"https://api.github.com/repos/rtCamp/easyengine/issues/463/labels{/name}","comments_url":"https://api.github.com/repos/rtCamp/easyengine/issues/463/comments","events_url":"https://api.github.com/repos/rtCamp/easyengine/issues/463/events","html_url":"https://github.com/rtCamp/easyengine/issues/463","id":62785320,"number":463,"title":"VSFTPD - Virtual Users","user":{"login":"benzon","id":3528000,"avatar_url":"https://avatars.githubusercontent.com/u/3528000?v=3","gravatar_id":"","url":"https://api.github.com/users/benzon","html_url":"https://github.com/benzon","followers_url":"https://api.github.com/users/benzon/followers","following_url":"https://api.github.com/users/benzon/following{/other_user}","gists_url":"https://api.github.com/users/benzon/gists{/gist_id}","starred_url":"https://api.github.com/users/benzon/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/benzon/subscriptions","organizations_url":"https://api.github.com/users/benzon/orgs","repos_url":"https://api.github.com/users/benzon/repos","events_url":"https://api.github.com/users/benzon/events{/privacy}","received_events_url":"https://api.github.com/users/benzon/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":12,"created_at":"2015-03-18T19:58:06Z","updated_at":"2015-09-17T06:15:41Z","closed_at":"2015-03-19T05:21:51Z","body":"First of all thanks for bringing EasyEngine to us!\r\n\r\nFollowed and used the project for quite some time now, and love the way it's going and the direction the development has taken.\r\n\r\nThe only thing I hate, is that EasyEngine dos not give us a way to give a user FTP Access, we only got the www-data SFTP login, I got a couple of costumers that need FTP access, and I dont want to hand out the www-data user, since they can do to mutch harm.\r\n\r\nSo I started my journey how could I make a solution that worked with EasyEngine, and that allowed me to create FTP accounts for specific websites, with out giving them access to all other websites on the server.\r\n\r\nAfter some searching on Virtual Users FTP, I tried out a couple of tutorials and it worked! BUT! They used text files, and raw passwords, not very safe to be honest, so when I got a new server I played arround with VSFTPD/MySQL and PAM, to create a more secure container for the password, and to be honest it's just a better way then creating text files to get the same result.\r\n\r\nThe guides found for VSFTPD/MySQL/PAM and Virtual Users, did not work out that well, because they forgot to mention, that Ubuntu got meny problems with VSFTPD true apt-get, after a lot of searching I finally found a good forum thread on UbuntuForums.\r\n\r\nFirst we need to get a working version of VSFTPD! http://ehcpforce.tk/faq/index.php?sid=2579&lang=en&action=artikel&cat=1&id=3&artlang=en this link contains info for Ubuntu 12.04 and above, and is different for every Version of Ubuntu.\r\n\r\nAfter you installed VSFTPD follow the following guide.\r\napt-get install libpam-mysql libpam-ldap\r\n\r\nLDAP server Uniform Resource Identifier: <--  ENTER\r\nDistinguished name of the search base: <-- ENTER\r\nLDAP version to use: <-- 3\r\nMake local root Database admin: <-- Yes\r\nDoes the LDAP database require login?  <-- No\r\nLDAP account for root: <-- ENTER\r\nLDAP root account password: <-- ldaprootpw (change to your password)\r\n\r\nIf you get more questions select the option that it surgests\r\n\r\n==> Create The MySQL Database For vsftpd\r\nmysql -u root -p\r\n\r\n==> Create the Database, and user, remember to set your own password instead of fpdpass\r\nCREATE DATABASE vsftpd;\r\nGRANT SELECT, INSERT, UPDATE, DELETE, CREATE, DROP ON vsftpd.* TO 'vsftpd'@'localhost' IDENTIFIED BY 'ftpdpass';\r\nGRANT SELECT, INSERT, UPDATE, DELETE, CREATE, DROP ON vsftpd.* TO 'vsftpd'@'localhost.localdomain' IDENTIFIED BY 'ftpdpass';\r\nFLUSH PRIVILEGES;\r\nUSE vsftpd;\r\n\r\n==> Create the Tables in vsftpd Database\r\nUSE vsftpd; \r\nCREATE TABLE `accounts` (\r\n`id` INT NOT NULL AUTO_INCREMENT PRIMARY KEY ,\r\n`username` VARCHAR( 30 ) NOT NULL ,\r\n`pass` VARCHAR( 50 ) NOT NULL ,\r\nUNIQUE (\r\n`username`\r\n)\r\n) ENGINE = MYISAM ; \r\nquit; \r\n\r\n==> Only use this line if you got issues with the setup, I only tested with this line, since I had some issues, that I later found out was Ubuntus version of VSFTPD\r\nuseradd --home /home/vsftpd --gid nogroup -m --shell /bin/false vsftpd \r\n\r\n==> Config file stuff\r\ncp /etc/vsftpd.conf /etc/vsftpd.conf_orig\r\ncat /dev/null > /etc/vsftpd.conf\r\nnano /etc/vsftpd.conf \r\n\r\n==> Insert following to the config file\r\nlisten=YES\r\nanonymous_enable=NO\r\nlocal_enable=YES\r\nvirtual_use_local_privs=YES\r\nwrite_enable=YES\r\nlocal_umask=022\r\nconnect_from_port_20=YES\r\nsecure_chroot_dir=/var/run/vsftpd\r\npam_service_name=vsftpd\r\nguest_enable=YES\r\nftp_username=www-data\r\nchown_username=www-data\r\nguest_username=www-data\r\nuser_sub_token=$USER\r\nlocal_root=/var/www/$USER\r\nchroot_local_user=YES\r\nhide_ids=YES\r\ncheck_shell=NO\r\nuser_config_dir=/var/www/users\r\nallow_writeable_chroot=YES\r\n\r\n==> Create user_config_dir\r\nmkdir /var/www/users \r\n\r\n==> Lets create the PAM config files for vsftpd\r\ncp /etc/pam.d/vsftpd /etc/pam.d/vsftpd_orig\r\ncat /dev/null > /etc/pam.d/vsftpd\r\nnano /etc/pam.d/vsftpd \r\n\r\n==> Insert the following, remember to change ftpdpass in to the password you set for the mysql vsftpd user earlyer\r\nauth required pam_mysql.so user=vsftpd passwd=ftpdpass host=localhost db=vsftpd table=accounts usercolumn=username passwdcolumn=pass crypt=2\r\naccount required pam_mysql.so user=vsftpd passwd=ftpdpass host=localhost db=vsftpd table=accounts usercolumn=username passwdcolumn=pass crypt=2\r\n\r\n==> Restart VSFTPD\r\n/etc/init.d/vsftpd restart \r\n\r\n==> Create the first virtual user, remember the username needs to match a folder in /var/www ex. Domain.com\r\nmysql -u root -p \r\nUSE vsftpd; \r\n\r\n==> Remember to change domain.com and password to what you want\r\nINSERT INTO accounts (username, pass) VALUES('testuser', PASSWORD('secret'));\r\nquit; \r\n\r\n–--------------------------------\r\n\r\nYou should now be good to go, and have a working ftp user that can only access /var/www/domain.com\r\n\r\nIf you want a user to have a different root, or create a “master” account, you can do this by creating a file in /var/www/users\r\n\r\nExample – the file you create inside /var/www/users needs to match the username, lets say I created a username thats masteruser in the mysql table\r\n\r\nnano /var/www/users/masteruser\r\n\r\n==>> Insert the following change the directory to /var/www or something inside /var/www\r\nExample 1\r\nlocal_root=/var/www\r\n\r\nExample 2\r\nlocal_root=/var/www/domain.com"},"comment":{"url":"https://api.github.com/repos/rtCamp/easyengine/issues/comments/140978559","html_url":"https://github.com/rtCamp/easyengine/issues/463#issuecomment-140978559","issue_url":"https://api.github.com/repos/rtCamp/easyengine/issues/463","id":140978559,"user":{"login":"jimtyrro","id":12877886,"avatar_url":"https://avatars.githubusercontent.com/u/12877886?v=3","gravatar_id":"","url":"https://api.github.com/users/jimtyrro","html_url":"https://github.com/jimtyrro","followers_url":"https://api.github.com/users/jimtyrro/followers","following_url":"https://api.github.com/users/jimtyrro/following{/other_user}","gists_url":"https://api.github.com/users/jimtyrro/gists{/gist_id}","starred_url":"https://api.github.com/users/jimtyrro/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jimtyrro/subscriptions","organizations_url":"https://api.github.com/users/jimtyrro/orgs","repos_url":"https://api.github.com/users/jimtyrro/repos","events_url":"https://api.github.com/users/jimtyrro/events{/privacy}","received_events_url":"https://api.github.com/users/jimtyrro/received_events","type":"User","site_admin":false},"created_at":"2015-09-17T06:15:41Z","updated_at":"2015-09-17T06:15:41Z","body":"In the tutorial you have these two commands:\r\n`chmod g+s /var/www/example.com/htdocs/`\r\n`chmod 775 /var/www/example.com/htdocs`\r\n\r\nfirst is ending with a slash and the second one doesn't , does it have any impact on permissions?"}}