Hot answers tagged

55

To configure passive mode for vsftpd you need to set some parameters in vsftpd.conf. pasv_enable=Yes pasv_max_port=10100 pasv_min_port=10090 This enables passive mode and restricts it to using the eleven ports for data connections. This is useful as you need to open these ports on your firewall. iptables -I INPUT -p tcp --destination-port 10090:10100 -j ...


18

Complete answer that solved my question for any others that are after a step by step walkthrough... Install vsftpd using this as a guide. Create user with useradd [user_name]. Create user's password with passwd [user_name]. (You'll be prompted to specify the password). Create FTP directory in /var/ftp and then bind to the 'home' directory you wish to ...


16

To enable passive mode, set the following configuration options in your vsftp.conf: pasv_enable=YES pasv_min_port=41361 pasv_max_port=65534 pasv_address=xxx.xxx.xxx.xxx You can of course change the start and end port, and should replace the xxx's with the public IP of your server. In addition, you should open the passive mode port range in your firewall. ...


15

In vsftpd.conf add: userlist_enable=YES userlist_file=/etc/vsftpd.userlist userlist_deny=NO Edit the file to contain a username per row.


15

Yes. Configure the vsftp server to listen only on 127.0.0.1: this can be done in the vsftp.conf file: listen_address=127.0.0.1 To use this parameter, the server needs to be in standalone mode: listen=yes If you want to use IPv6, use these entries instead: listen_ipv6=yes listen_address6=::1 This is the same as the first, but uses IPv6. You'll ...


13

What you need to use is a combo of user_config_dir and local_root. In the main config file /etc/vsftpd/vsftp.conf you have an entry like: chroot_local_user=YES user_config_dir=/etc/vsftpd/users Inside that directory (/etc/vsftpd/users) you have a config file with the same name as the user ($USER in your case), and inside that file you have: local_root=/...


12

Check here for VSFTPD's FAQ for the answer your looking for. Below is the important excerpt that I think will answer your question. Q) Help! What are the security implications referred to in the "chroot_local_user" option? A) Firstly note that other ftp daemons have the same implications. It is a generic problem. The problem isn't too severe, but it is this:...


9

vi /etc/pam.d/vsftp comment #auth required pam_shells.so and then service vsftpd restart pam_shells.so means that only users with shells access should be allowed so that's why needs to be commented.


8

You want to use the usermod command. You're going to want to use the -m and -d directives to modify their home directory and move its contents: -d, --home HOME_DIR The users new login directory. If the -m option is given, the contents of the current home directory will be moved to the new home directory, which is created if ...


8

htpasswd generates MD5 hashes in the Apache format, which you can verify by seeing that they start with $apr1$, but PAM only supports formats that your platform's implementation of crypt(3) implements. For Glibc, the equivalent (MD5-based) would be $1$. You just need to generate the passwords with a different tool. Here's an example: sh$ openssl passwd -1 ...


8

I ended up using file_open_mode=0777 local_umask=022 on the vsftpd.conf. The problem was that both FTP user and www-data user needed permissions to write, so i had to join www-data and ftpuser to www-data usergroup, and CHMOD -R 775 all the files on /var/www - that way, with 775 CHMOD, the group would have permission to read, write and execute. Now its ...


7

Here are the steps you should take to set this up: VSFTPd Create the /etc/vsftd.conf file #nano /etc/vsftpd.conf listen=YES anonymous_enable=NO local_enable=YES dirmessage_enable=YES xferlog_enable=YES connect_from_port_20=YES chroot_local_user=YES secure_chroot_dir=/var/run/vsftpd pam_service_name=vsftpd rsa_cert_file=/etc/ssl/certs/vsftpd.pem ...


7

Umask and final permissions that you need should add up to 777. Since you need 775 permissions, you need 777 - 775 = 002 as umask.


7

Easiest way to do it would be to set the directory's group to the group you want, and then set the sticky group bit on the directory with chmod g+s.


6

ok, found it. Apparently there is some strange behavior between the latest filezilla 3.5 client and ftps. for vsftpd, the solution was simply to add: ssl_ciphers=HIGH in the vsftpd.conf file I'am not sure whether i am allowed to post this as well, but there is a threat about this in the filezilla forums. http://forum.filezilla-project.org/viewtopic.php?f=...


6

For me it didn't work even after the above. There was a local_root already set to a directory, and whatever I do, user's directory hasn't jailed. Finally it is worked after only changed chroot_local_user=YES And following procedure vi /etc/vsftpd.conf Add the line 'user_config_dir=/etc/vsftpd_user_conf' (no quotes) mkdir /etc/...


6

Seems you can use TCP Wrappers (just tested it on my Ubuntu) and use hosts.allow and hosts.deny to filter vsftpd access. Add the following to your vsftpd.conf file : tcp_wrappers=YES Restart vsftpd. In /etc/hosts.deny deny everyone for vsftpd : vsftpd: ALL Then, in /etc/hosts.allow add the authorized IPs : vsftpd:192.168.0.39 192.168.0.50


6

I search for it toooooooooo many, and i really mixed up, so i decided to change vsftpd to sftp or something else, till i found a link about this bugg. Then i found out this problem is solved in vsftpd version 3. So i search how to upgrade it and could found to add jessie repository my debian 7.3 and upgrade it so: echo "deb http://ftp.us.debian.org/debian ...


6

There is a difference between default labelling that occurs at runtime and the regular expression based post-labelling policy that applies on the server. What you are noting here: /var/www/html(/.*)?/uploads(/.*)? all files system_u:object_r:httpd_sys_rw_content_t:s0 /var/www/html(/.*)?/wp-content(/.*)? all files ...


5

In case you are wondering where to set your umask, it can be set in the vsftpd config file (/etc/vsftpd.conf) as anon_umask for anonymous access and local_umask for users. For the mask to work properly (even without anonymous access) it seems necessary to set anon_upload_enable=YES and anon_mkdir_write_enable=YES. If these are not set, writing, reading and ...


5

Implicit - Assumes that the server is expecting everything encrypted using SSL. This means that when the client first connects to the server it will immediately negotiate the SSL connection on the command connection. Normally Implicit connections are also on a different port such as port 990. So to run vsftpd in implicit mode, you need to set options ...


5

CentOS 5.5 should have filesystem ACLs on by default, just use setfacl to give 'ftpuser' the rights: setfacl -R -m u:ftpuser:rwx /var/www/myWebApp See the man page for setfacl/getfacl if you've never used them before.


5

I have run in to this issue. It looks like you need to open up the ftp data transfer range of ports when using FTP with explicit TLS/SSL. Try the following: iptables -A INPUT -p tcp --sport 1024: --dport 64000:65535 -m state --state ESTABLISHED -j ACCEPT iptables -A OUTPUT -p tcp --sport 64000:65535 --dport 1024: -m state --state ESTABLISHED,RELATED -j ...


5

The problem is that you can't both use local accounts and also disable those accounts from shell login. If you set their login shell to /bin/nologin, it won't let you login with vsftpd either. A better and more secure FTP daemon would be Pure-ftpd. Look it up, it's available from the EPEL repository, and it allows to create virtual users. The server uses a ...


5

This can be caused by having trailing space at the end of the line. Check that there is no whitespace after "YES". If that isn't the case check that you don't have Windows CRLF line endings. The following sed command will remove any trailing space and CR characters from the specified file: sed -i 's,\r,,;s, *$,,' /etc/vsftpd.conf


5

Make sure that you also have the "ip_conntrack_ftp" kernel module loaded, that will track related connections needed for actual data transfer. As root (or using sudo), run this: modprobe ip_conntrack_ftp Also make sure that SELinux (if enabled) isn't blocking your requests, make sure to use public contexts, e.g. user_home_dir_t (the default context of ...


4

If you would bother to open a man page for vsftpd.conf, you would find the following option: hide_file This option can be used to set a pattern for filenames (and directory names etc.) which should be hidden from directory listings. Despite being hidden, the files / directories etc. are fully accessible to clients who know what names to actually use....


4

Edit /etc/sysconfig/iptables-config and add this line: IPTABLES_MODULES="ip_conntrack_ftp" Save it and restart iptables. That's because passive mode use non standard ports to communicate, so you need to keep trak of the ftp connections and iptables will allow them when necessary.


4

Change the home directory of the user to the WEBROOT folder and... Open vsftpd configuration file - /etc/vsftpd/vsftpd.conf # vi /etc/vsftpd/vsftpd.conf Make sure following line exists (and uncommented): chroot_local_user=YES Save and close the file. Restart vsftpd. # /etc/init.d/vsftpd restart Hope this Helps :D



Only top voted, non community-wiki answers of a minimum length are eligible