Linux – Issues with VSFTPD / FTP on Linux Ubuntu server – Steps for Troubleshooting

ftplinuxUbuntuvsftpd

I am dealing with an issue I am unclear on how to resolve and have been pulling my hair out for some time. I have been trying to configure an FTP user using the following (we use this same documentation on all servers)

Install FTP Server

  • apt-get install vsftpd Enable local_enable and write_enable to YES
  • and anonymous user to NO in /etc/vsftpd.conf restart – service vsftpd
  • restart – to allow changes to take place

Add WordPress User for FTP access in WP Admin

Create a fake shell for the user add "usr/sbin/nologin" to the bottom of the /etc/shells file

Add a FTP user account

  • useradd username -d /var/www/ -s /usr/sbin/nologin
  • passwd username

add these lines to the bottom of /etc/vsftpd.conf
– userlist_file=/etc/vsftpd.userlist
– userlist_enable=YES
– userlist_deny=NO

Add username to the list at top of /etc/vsftpd.userlist

  • restart vsftpd "service vsftpd restart"
  • make sure firewall is open for ftp "ufw allow ftp" allow
  • modify the /var/www directory for username "chown -R
    /var/www

I have also went through everything listed on this post and no luck. I am getting connection refused.

Sorry for the poor text formatting above. I think you get the idea. This is something we do over and over and for some reason it is not cooperating here.

Setup is Ubuntu 12.04LTS and VSFTPD v2.3.5

Best Answer

So here's the INPUT portion of your iptables configuration.

Chain INPUT (policy DROP)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere            
REJECT     all  --  anywhere             127.0.0.0/8          reject-with icmp-port-unreachable
ACCEPT     all  --  anywhere             anywhere             state RELATED,ESTABLISHED
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:http
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:http-alt
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:https
ACCEPT     tcp  --  anywhere             anywhere             state NEW tcp dpt:ssh
ACCEPT     icmp --  anywhere             anywhere             icmp echo-request
LOG        all  --  anywhere             anywhere             limit: avg 5/min burst 5 LOG level debug prefix "iptables denied: "
REJECT     all  --  anywhere             anywhere             reject-with icmp-port-unreachable

HERE^

ufw-before-logging-input  all  --  anywhere             anywhere            
ufw-before-input  all  --  anywhere             anywhere            
ufw-after-input  all  --  anywhere             anywhere            
ufw-after-logging-input  all  --  anywhere             anywhere            
ufw-reject-input  all  --  anywhere             anywhere            
ufw-track-input  all  --  anywhere             anywhere            
ACCEPT     tcp  --  anywhere             anywhere             tcp spt:ftp state ESTABLISHED
ACCEPT     tcp  --  anywhere             anywhere             tcp spt:ftp-data state RELATED,ESTABLISHED
ACCEPT     tcp  --  anywhere             anywhere             tcp spts:1024:65535 dpts:1024:65535 state ESTABLISHED

The line that i highlighted with the REJECT is denying all inbound connections. The rules you put at the bottom to permit ftp & ftp-data are never firing. Nor are the ufw- rules.

I'm not an ubuntu person and I don't have a box handy to look at, but it's likely your init script that handles your firewall is hardcoding the first few rules, and then the place where you added your config is happening later in the boot sequence.

Related Topic