Hot answers tagged

44

To configure passive mode for vsftpd you need to set some parameters in vsftpd.conf. pasv_enable=Yes pasv_max_port=10100 pasv_min_port=10090 This enables passive mode and restricts it to using the eleven ports for data connections. This is useful as you need to open these ports on your firewall. iptables -I INPUT -p tcp --destination-port 10090:10100 -j ...


16

To enable passive mode, set the following configuration options in your vsftp.conf: pasv_enable=YES pasv_min_port=41361 pasv_max_port=65534 pasv_address=xxx.xxx.xxx.xxx You can of course change the start and end port, and should replace the xxx's with the public IP of your server. In addition, you should open the passive mode port range in your firewall. ...


15

In vsftpd.conf add: userlist_enable=YES userlist_file=/etc/vsftpd.userlist userlist_deny=NO Edit the file to contain a username per row.


14

Yes. Configure the vsftp server to listen only on 127.0.0.1: this can be done in the vsftp.conf file: listen_address=127.0.0.1 To use this parameter, the server needs to be in standalone mode: listen=yes If you want to use IPv6, use these entries instead: listen_ipv6=yes listen_address6=::1 This is the same as the first, but uses IPv6. You'll ...


12

What you need to use is a combo of user_config_dir and local_root. In the main config file /etc/vsftpd/vsftp.conf you have an entry like: chroot_local_user=YES user_config_dir=/etc/vsftpd/users Inside that directory (/etc/vsftpd/users) you have a config file with the same name as the user ($USER in your case), and inside that file you have: ...


12

Complete answer that solved my question for any others that are after a step by step walkthrough... Install vsftpd using this as a guide. Create user with useradd [user_name]. Create user's password with passwd [user_name]. (You'll be prompted to specify the password). Create FTP directory in /var/ftp and then bind to the 'home' directory you wish to ...


11

Check here for VSFTPD's FAQ for the answer your looking for. Below is the important excerpt that I think will answer your question. Q) Help! What are the security implications referred to in the "chroot_local_user" option? A) Firstly note that other ftp daemons have the same implications. It is a generic problem. The problem isn't too severe, but it is ...


8

I ended up using file_open_mode=0777 local_umask=022 on the vsftpd.conf. The problem was that both FTP user and www-data user needed permissions to write, so i had to join www-data and ftpuser to www-data usergroup, and CHMOD -R 775 all the files on /var/www - that way, with 775 CHMOD, the group would have permission to read, write and execute. Now its ...


8

vi /etc/pam.d/vsftp comment #auth required pam_shells.so and then service vsftpd restart pam_shells.so means that only users with shells access should be allowed so that's why needs to be commented.


6

ok, found it. Apparently there is some strange behavior between the latest filezilla 3.5 client and ftps. for vsftpd, the solution was simply to add: ssl_ciphers=HIGH in the vsftpd.conf file I'am not sure whether i am allowed to post this as well, but there is a threat about this in the filezilla forums. ...


5

The problem is that you can't both use local accounts and also disable those accounts from shell login. If you set their login shell to /bin/nologin, it won't let you login with vsftpd either. A better and more secure FTP daemon would be Pure-ftpd. Look it up, it's available from the EPEL repository, and it allows to create virtual users. The server uses a ...


4

Taken from here Q) Help! Local users cannot log in. A) There are various possible problems. A1) By default, vsftpd disables any logins other than anonymous logins. Put local_enable=YES in your /etc/vsftpd.conf to allow local users to log in. A2) vsftpd tries to link with PAM. (Run "ldd vsftpd" and look for libpam to find out whether this has happened ...


4

I search for it toooooooooo many, and i really mixed up, so i decided to change vsftpd to sftp or something else, till i found a link about this bugg. Then i found out this problem is solved in vsftpd version 3. So i search how to upgrade it and could found to add jessie repository my debian 7.3 and upgrade it so: echo "deb http://ftp.us.debian.org/debian ...


4

Change the home directory of the user to the WEBROOT folder and... Open vsftpd configuration file - /etc/vsftpd/vsftpd.conf # vi /etc/vsftpd/vsftpd.conf Make sure following line exists (and uncommented): chroot_local_user=YES Save and close the file. Restart vsftpd. # /etc/init.d/vsftpd restart Hope this Helps :D


4

As @cyberx86 said, vsftpd is sending the instance's internal IP address as the address the client must connect to in response to the PASV command, which the client can't connect to since it isn't running inside EC2. You need to use the pasv_address configuration option to tell vsftpd what the public IP of the instance is.


4

ftp_home_dir --> off setsebool ftp_home_dir on and try again.


3

I know of no FTP server that, by default, imposes download speed restrictions. This is likely due to a congested (or slow) path somewhere between your client and the server. As such, there's likely very little you can do about it.


3

I ended up getting rid of vsftpd and switching to proftd which is working fine in active and passive mode without any changes to the server's firewall settings. I'm still not sure what was causing the issue but if it's happening to you, a change in FTP server software might be the answer.


3

I'd suggest you want to set anon_other_write_enable to YES. As per the vsftpd documentation: If set to YES, anonymous users will be permitted to perform write operations other than upload and create directory, such as deletion and renaming. This is generally not recommended but included for completeness. Default: NO The problem though, is that ...


3

You should use virtual users and be careful with logins match between them [vsftpd.conf]/etc/vsftpd.conf listen=YES anonymous_enable=NO local_enable=YES virtual_use_local_privs=YES write_enable=YES connect_from_port_20=YES secure_chroot_dir=/var/run/vsftpd pam_service_name=vsftpd #look here guest_enable=YES guest_username=ftp #carefull user_sub_token=$USER ...


3

You have created a dir called pub/upload: # mkdir /var/ftp/pub/upload But then you configured uploads to go to pub/incoming: anon_root=/var/ftp/pub/incoming So it's a simple path mismatch, all the rest seems OK.


3

You're semi-aware of the security implications but I need to emphasise - a local network is still not a secure network, unless the only person who will ever access it is you yourself. Can you use SFTP instead maybe? Dreamweaver etc supports this (you mention its a web dev environment). To answer your question: Some FTP servers - possibly including vsftpd - ...


3

It's selinux for 99 % ;-) # getenforce Enforcing Turn it off by: # setenforce 0 # vim /etc/sysconfig/selinux And set it to "disabled" in that file or "permissive" if you plan to turn it on sometime in future or you want to track selinux errors. For FTP I highly recommend NOT to turn it off. Follow the RHEL 6 guides how to set it up properly for a FTP ...


3

As the FTP protocol does not specifically include the server hostname in requests, this is probably not possible.


2

Windows command-line FTP client does not support the passive mode. You cannot fix it by any server-side configuration. If you need a scriptable Windows FTP client with a passive mode support, you have to use a different one. For example my WinSCP FTP client supports scripting and defaults to a passive mode. There's a guide available for converting ...


2

The main concern is that it makes dotfiles writable. Depending on your shell, the way login is set up, whether $HOME/.ssh is used, what other services are running and a few other things, this provides a lot more attack surface to abuse, mostly through manipulation of user environment variables. There isn't a comprehensive guide on what and why because that ...


2

From the vsftpd.conf documentation write_enable This controls whether any FTP commands which change the filesystem are allowed or not. These commands are: STOR, DELE, RNFR, RNTO, MKD, RMD, APPE and SITE. Default: NO You need to configure write_enable=YES and restart vsftpd.


2

Beside the pasv_enable=YES, specify a port range in which VSFTP will run PASV mode: pasv_min_port=50000 pasv_max_port=50999 port_enable=YES Don't forget to configure iptables allows packet transmission on these ports: iptables -I INPUT -p tcp --dport 50000:50999 -j ACCEPT


2

Got my answer: As the www-data is the user responsible for the webserver and your normal user is responsible for the ftp server, you need first to make them both members of the same group: the group www-data. creating custom user: useradd –d /var/www/asasd.com -g www-data -m yourusername this way the home directory will be the /var/www/asasd.com and your ...



Only top voted, non community-wiki answers of a minimum length are eligible