Folder security

[stevefromdodge]

I'm looking to change from WS_FTP server to Filezilla Server. So far, I've only found one snag.

Some of the user home directories were specified forever ago (in a more innocent age) as the root of the FTP folder tree. Some file senders have scripts that change to the directory where they should be before they upload. It's not a huge security problem since WS_FTP server has builtin folder security and each folder is locked to the specific user. Does Filezilla server have any kind of folder security? (I realize that I can redefine the home folders and lock users in, but that means having people change their scripts, which I would like to avoid.)

[botg]

You can apply permissions on a per-user basis.

What you could do is make a read-only and empty root common to all users with the user's directory mapped as alias into the root. So all the user sees and can access is the root which just has his own directory in it.

[stevefromdodge]

You can apply permissions on a per-user basis.

How is this done?

[boco]

In the settings of the user account, Shared folders.

[stevefromdodge]

I'm still in the dark.

Working in a test environment, I've set up a user with a home directory at the root of the FTP tree, which is required if an unaltered FTP script will work.

When I test this, the user has access to his own folder, as well as every other folder in the tree. How do I lock him out of the other user's folders?

[boco]

Basically, you don't use the physical root of the user tree, but another, empty home directory. It'll stay empty, so it may be the same for every account (you could even make a group). The permissions for that directory should be List only. Now, for each individual account you only add the corresponding user directory (Alias) with the desired permissions. The result is that each account will see the (empty) root and only its user directory. This opt-in strategy is less complicated than your current opt-out one. And, let me add, in case you need to add more accounts, the opt-out strategy would require you to exclude the new directories for each and every old account!

[stevefromdodge]

Thank you.

With your help (and a little searching on aliases) I found my answer.