Run mkdir -p /myftp/pub
as the root user to create a new top-level directory.
Set Linux permissions on the /myftp/pub/
directory to allow a Linux user write access. This example changes the owner and group from root to owner user1 and group root. Replace user1 with the user you want to give write access to:
# chown user1:root /myftp/pub
# chmod 775 /myftp/pub
The chown
command changes the owner and group permissions. The chmod
command changes the mode, allowing the user1 user read, write, and execute permissions, and members of the root group read, write, and execute permissions. Everyone else has read and execute permissions: this is required to allow the Apache HTTP Server to read files from this directory.
When running SELinux, files and directories must be labeled correctly to allow access. Setting Linux permissions is not enough. Files labeled with the public_content_t
type allow them to be read by FTP, Apache HTTP Server, Samba, and rsync. Files labeled with the public_content_rw_t
type can be written to by FTP. Other services, such as Samba, require Booleans to be set before they can write to files labeled with the public_content_rw_t
type. Label the top-level directory (/myftp/
) with the public_content_t
type, to prevent copied or newly-created files under /myftp/
from being written to or modified by services. Run the following command as the root user to add the label change to file-context configuration:
semanage fcontext -a -t public_content_t /myftp
Run restorecon -R -v /myftp/
to apply the label change:
# restorecon -R -v /myftp/
restorecon reset /myftp context unconfined_u:object_r:default_t:s0->system_u:object_r:public_content_t:s0
Confirm /myftp
is labeled with the public_content_t
type, and /myftp/pub/
is labeled with the default_t
type:
$ ls -dZ /myftp/
drwxr-xr-x. root root system_u:object_r:public_content_t:s0 /myftp/
$ ls -dZ /myftp/pub/
drwxrwxr-x. user1 root unconfined_u:object_r:default_t:s0 /myftp/pub/
FTP must be allowed to write to a directory before users can upload files via FTP. SELinux allows FTP to write to directories labeled with the public_content_rw_t
type. This example uses /myftp/pub/
as the directory FTP can write to. Run the following command as the root user to add the label change to file-context configuration:
semanage fcontext -a -t public_content_rw_t "/myftp/pub(/.*)?"
Run restorecon -R -v /myftp/pub
as the root user to apply the label change:
# restorecon -R -v /myftp/pub
restorecon reset /myftp/pub context system_u:object_r:default_t:s0->system_u:object_r:public_content_rw_t:s0
The allow_ftpd_anon_write
Boolean must be on to allow vsftpd
to write to files that are labeled with the public_content_rw_t
type. Run the following command as the root user to turn this Boolean on:
setsebool -P allow_ftpd_anon_write on
Do not use the -P
option if you do not want changes to persist across reboots.