View source for Vsftpd/Shared chroot directory for all users

{{DISPLAYTITLE: Shared chrooted directory for all users in vsftpd}}
The goal is to only allow a certain group of users to login to the server. After login they land in the same shared directory. Under the hood they all operate as a single user dedicated user.
    
This is a setup that drove me nearly mad. I was off to a bad start. <tt>PAM</tt> refused to work due to SELinux preventing IPC communication to confirm the AD credentials. Once I got that working I was still fiddling for a while to get everything right. 

== Prerequisites ==
* Linux / Unix server (Tested on Ubuntu 14.04)
* vsftpd (Version 3.x)


== Howto ==
=== PAM configuration ===
The <tt>/etc/pam.d/vsftpd</tt> file needs to have the highlighted line added. 
 # Standard behaviour for ftpd(8).
 <span class="highlight">auth    required    pam_listfile.so item=group sense=allow file=/etc/vsftpd.d/group_list onerr=fail</span>
 
 # Note: vsftpd handles anonymous logins on its own. Do not enable pam_ftp.so.
 
 # Standard pam includes
 @include common-account
 @include common-session
 @include common-auth
 auth    required    pam_shells.so

Create the <tt>group_list</tt> file defined in the <tt>pam</tt> file. The <tt>ftpgroup</tt> contains every users allowed to login via ftp. 
 sudo mkdir /etc/vsftpd.d
 echo ftpgroup | sudo tee /etc/vsftpd.d/group_list

=== Create the shared FTP directory === 
This directory is where the users land after login. They will be landing in a chroot so they don't see any thing other than the uploaded files. 
 sudo mkdir -p /var/share/ftp/upload 
 sudo chown -R ftp:ftp /var/share/ftp
 sudo chmod 550 /var/share/ftp
 sudo chmod 750 /var/share/ftp/upload

=== vsftpd.conf ===
Finally the <tt>/etc/vsftpd.conf</tt> needs to look similar to the one below. 
 anonymous_enable=NO
 local_enable=YES
 dirmessage_enable=YES
 use_localtime=YES
 xferlog_enable=YES
 connect_from_port_20=YES
 secure_chroot_dir=/var/run/vsftpd/empty
 pam_service_name=vsftpd
 
 <span class="highlight">write_enable=YES</span>
 <span class="highlight">guest_enable=YES</span>
 <span class="highlight">guest_username=ftp</span>
 <span class="highlight">chroot_local_user=YES</span>
 <span class="highlight">local_root=/var/share/ftp</span>
 <span class="highlight">virtual_use_local_privs=YES</span>

The highlighted portion is the customized part. Restart <tt>vsftpd</tt> after the configuration change.

=== Summary === 
With this configuration every member of the group <tt>ftpgroup</tt> is able to log in with her credentials. After login the user lands in the local directory <tt>/var/share/ftp</tt>, as the user  is chrooted the ftp will only show it as "/" tho. Users can then upload files to the <tt>/upload</tt> directory.

=== See also ===
* [https://www.benscobie.com/fixing-500-oops-vsftpd-refusing-to-run-with-writable-root-inside-chroot/ Making the top directory writable]