Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am setting up fail2ban for various services. Ssh went smoothly, but I have had no success with vsftpd so far. The problem is, that I can't find a way to get failed login attempts to appear in the logs. I see nothing in auth.log nor in vsftpd.log.

In the example here: http://www.fail2ban.org/wiki/index.php/Vsftpd there are several lines which should appear in the various logs but they don't.

Here is what I have in the conf now:

listen=YES
anonymous_enable=NO
local_enable=YES
write_enable=YES
dirmessage_enable=YES
use_localtime=YES
xferlog_enable=YES
dual_log_enable=YES
xferlog_std_format=NO
xferlog_file=/var/log/vsftpd.log
session_support=YES
connect_from_port_20=YES
chroot_local_user=YES
userlist_deny=NO
userlist_enable=YES
userlist_file=/etc/vsftpd.allowed_users
secure_chroot_dir=/var/run/vsftpd/empty
pam_service_name=vsftpd
rsa_cert_file=/etc/ssl/private/vsftpd.pem
ssl_enable=YES
allow_anon_ssl=NO
force_local_data_ssl=YES
force_local_logins_ssl=YES
ssl_tlsv1=YES
ssl_sslv2=YES
ssl_sslv3=YES

In the logs I only see successful logins, but when the client gets a 530 permission denied, nothing is logged.

I would prefer not to log the entire FTP chat.

Using Ubuntu 10.04.

share|improve this question
add comment

1 Answer

up vote 1 down vote accepted

It looks like vsftpd first checks username in userlist_file and do PAM only if user is allowed (with above configuration). I would suggest to disable userlist_* options and implement deny list in PAM configuration.

# put this line into /etc/pam.d/vsftpd as first "auth" check
auth    required    pam_listfile.so item=user sense=allow file=/etc/vsftpd.allowed_users onerr=fail

Then you should see denied log attempts in auth.log.

More info - pam_listfile.so

share|improve this answer
    
Great answer! Thanks! –  Palantir Feb 19 '12 at 12:48
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.