Can I make FTP root writable?

Discussion in 'Server Operation' started by schwim, Feb 25, 2019.

  1. schwim

    schwim Member

    Hi there everyone!
    /var/www/clients/client1/web1/web
    Is it possible for me to make web4 writable to the FTP login for this domain? I use MyRepono for cloud based backup and the system is finding it impossible to backup home and web in this directory because web4 does not have sufficient permissions.
    Any help would be greatly appreciated!
     
    Last edited: Feb 25, 2019
  2. Taleman

    Taleman Well-Known Member HowtoForge Supporter

    The FTP user for that website does have permission to write to that web/ directory. If not, something is wrong. Check ls -lh for that dir.
     
  3. schwim

    schwim Member

    I need to be able to work in web1, not web, sorry for the confusion. I don't need to delete content there but I need to be able to write to that directory.
     
    Last edited: Feb 25, 2019
  4. Taleman

    Taleman Well-Known Member HowtoForge Supporter

    It is made read only on purpose. I would think again if I thougth I need to write there.
    It can be made writable with chattr.
     
  5. till

    till Super Moderator Staff Member ISPConfig Developer

    The directory is not writable for the web user, if it would be writable, then the web user would be able to remove files and folders and if he would do that, apache would fail for all sites on your server. But if you don't host any customers on that system, then you can use chattr as @Taleman suggested to remove the protection.
     
  6. schwim

    schwim Member

    Thank you guys very much for the help!

    If I were to use chattr to make this directory workable for the FTP user, what would be I do? I'm reading the man pages and how-to examples on the web but I'm not sure how I would use it in my case.
     
  7. till

    till Super Moderator Staff Member ISPConfig Developer

    chattr -i /var/www/clients/client1/web4
     
  8. schwim

    schwim Member

    I did try that:
    [email protected]:~# chattr -i /var/www/clients/client1/web1
    [email protected]:~#


    But on logging in with the FTP user and trying to create a directory in web4, permission is denied:
    Status: Directory listing successful
    Status: Creating directory '/new'...
    Command: MKD new
    Response: 550 Can't create directory: Permission denied
    Command: MKD /new
    Response: 550 Can't create directory: Permission denied

    Is there something else I need to do or have I performed the necessary steps incorrectly?
     
    Last edited: Feb 25, 2019
  9. schwim

    schwim Member

    I did check it with lsattr and it shows the immutable flag as being removed but I'm unable to create a directory or file there:

    [email protected]:/var/www/clients# lsattr client1
    lsattr: Operation not supported While reading flags on client1/tightwadish.com
    ----i---------e---- client1/web2
    lsattr: Operation not supported While reading flags on client1/schwimserver.com
    ----i---------e---- client1/web3
    ----i---------e---- client1/web5
    lsattr: Operation not supported While reading flags on client1/chloestudley.com
    --------------e---- client1/web1
    lsattr: Operation not supported While reading flags on client1/scotchandiron.org
    lsattr: Operation not supported While reading flags on client1/s-esx.com
    ----i---------e---- client1/web6
    ----i---------e---- client1/web4
    lsattr: Operation not supported While reading flags on client1/server1.schwimserver.com
     
  10. Taleman

    Taleman Well-Known Member HowtoForge Supporter

    What about the usual permissions changed with chmod and chown?
     
  11. schwim

    schwim Member

    I noticed that for some reason, the folders are owned by the user/group root while the others are owned by the client. I went to change the owner group of a folder as root that it says I(root) own but it won't let me:

    It did let me change the grp and own of web1 but not of web2. Can someone tell me why?
     
  12. Taleman

    Taleman Well-Known Member HowtoForge Supporter

    Did you forget chattr web2?
     
  13. schwim

    schwim Member

    I did and that solved the own/grp issue. For some reason, myrepono's php script still thinks it's unable to work in that directory. I've submitted a ticket to see if they can shed light on it but in case you might have an idea on my issue, here's the issue:

    I change the owner and group of the parent folder to that of the same as the web directory. I've also made sure to remove the immutable flag with chattr. Currently, the ownership and permissions are as such:

    drwxr-xr-x 10 web1 client1 4096 Feb 25 16:48 web1
    drwx--x--x 5 web1 client1 4096 Feb 25 16:04 web

    [email protected]:/var/www/clients# lsattr client1
    --------------e---- client1/web1

    Where web1 is the parent directory and web is the directory housing repono. I need Repono to be able to work in web1 so I can choose the entire web directory for backup.

    I tried changing the directory to /var/www/clients/client1/web1/ after making these ownership changes but it still states that it can't operate in that directory. I can make directories in web1 using the FTP login credentials supplied to repono. What else do I need to do to be able to use repono to work in the web1 directory?
     
  14. till

    till Super Moderator Staff Member ISPConfig Developer

    You use the right php mode (php-fpm or php-fcgi) and the suexec checkbox is enabled?
     
  15. schwim

    schwim Member

    I believe I've got it set up correctly:
    [​IMG]
     
  16. till

    till Super Moderator Staff Member ISPConfig Developer

    Yes, that's ok. Just as hint, you should enable only the functions that you need. So unless its a ruby, python or cgi application, do not enable the ruby, python and CGI checkboxes. Enabling more options can cause problems and for security reasons, you should not enable unnneeded things anyway :)
     
  17. schwim

    schwim Member

    Ok, I'll shut them down as they're not needed. Thanks very much for the insight on it.

    Can you think of anything else that would cause the PHP script to deem the user's home directory to be unusable?

    Just in case it's relevant:
    [​IMG]
     
    Last edited: Feb 25, 2019
  18. till

    till Super Moderator Staff Member ISPConfig Developer

    It might be that you have to adjust the open_basedir setting on the options tab of the site to allow access to that folder.

    But why do you want to write to that folder at all? If you are seeking for a web writable folder that is not accessible by http for a backup script, then this folder is the 'private' folder of the site.
     
  19. schwim

    schwim Member

    That was indeed it, I changed it to the following and it worked:
    Primarily because I wanted to backup all files relating to that user, regardless of whether it was web-related or not. This particular backup solution needed to be able to "see" the parent directory of any other directories it was to backup.
     

Share This Page