Ftp – VSFTPD allows root access despite being listed in ftpusers file

chrootftprootvsftpd

I've installed VSFTPD on a LEMP stack on Ubuntu 14.04. The only significant changes made to vsftpd.conf are:

anonymous_enable=no
local_enable=yes
write_enable=yes
chroot_local_user=yes
allow_writeable_chroot=yes

VSFTPD should block root access by default, I've checked the /etc/ftpusers file and root is listed within the file to deny access however I am able to ftp into the server using the root account. When I do I'm taken into, and jailed to, the /root folder.

How can I disable root login via ftp?

Contents of /etc/pam.d/vsftp:

# Standard behaviour for ftpd(8).
auth    required    pam_listfile.so item=user sense=deny file=/etc/ftpusers onerr=succeed

# Note: vsftpd handles anonymous logins on its own. Do not enable pam_ftp.so.

# Standard pam includes
@include common-account
@include common-session
@include common-auth
auth    required    pam_shells.so

adding

userlist_enable=yes
userlist_deny=yes
userlist_file=/etc/vsftp.user_list

did deny root access – but only if one there is only one line in the userlist file. If I add multiple users (one per line) then it breaks and allows root login.

If root is not being read from the /etc/ftpusers file then I'm assuming other users such as mail, daemon, man, nobody etc. aren't being read either? (Hence why I tried to add them to the userlist file)

Best Answer

make sure the following is in your vsftpd.conf

 userlist_deny=YES

Then make sure root is in

 /etc/vsftpd/user_list

Restart vsftp and it should deny root login

Related Solutions

Centos – FTP not showing files or directories

Per the comments, disabling SELinux seems to have solved the problem. I would suggest to now:

Turn it back on with setenforce 1.
Use ls -Z /path/to/ftp/home/folder to check the context of the directory you're trying to FTP into, and see if the context is "public_content_t"
If not, use restorecon(8) to fix incorrect context, e.g. restorecon -R /path/to/ftp/home/folder

Linux – Issues with VSFTPD / FTP on Linux Ubuntu server – Steps for Troubleshooting

So here's the INPUT portion of your iptables configuration.

Chain INPUT (policy DROP)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere            
REJECT     all  --  anywhere             127.0.0.0/8          reject-with icmp-port-unreachable
ACCEPT     all  --  anywhere             anywhere             state RELATED,ESTABLISHED
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:http
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:http-alt
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:https
ACCEPT     tcp  --  anywhere             anywhere             state NEW tcp dpt:ssh
ACCEPT     icmp --  anywhere             anywhere             icmp echo-request
LOG        all  --  anywhere             anywhere             limit: avg 5/min burst 5 LOG level debug prefix "iptables denied: "
REJECT     all  --  anywhere             anywhere             reject-with icmp-port-unreachable

HERE^

ufw-before-logging-input  all  --  anywhere             anywhere            
ufw-before-input  all  --  anywhere             anywhere            
ufw-after-input  all  --  anywhere             anywhere            
ufw-after-logging-input  all  --  anywhere             anywhere            
ufw-reject-input  all  --  anywhere             anywhere            
ufw-track-input  all  --  anywhere             anywhere            
ACCEPT     tcp  --  anywhere             anywhere             tcp spt:ftp state ESTABLISHED
ACCEPT     tcp  --  anywhere             anywhere             tcp spt:ftp-data state RELATED,ESTABLISHED
ACCEPT     tcp  --  anywhere             anywhere             tcp spts:1024:65535 dpts:1024:65535 state ESTABLISHED

The line that i highlighted with the REJECT is denying all inbound connections. The rules you put at the bottom to permit ftp & ftp-data are never firing. Nor are the ufw- rules.

I'm not an ubuntu person and I don't have a box handy to look at, but it's likely your init script that handles your firewall is hardcoding the first few rules, and then the place where you added your config is happening later in the boot sequence.

Related Topic