Linux – Using an allowed user list with VSFTPD

ftplinuxvsftpd

According to the Wiki here, you can only allow certain users to log in over FTP using the following configuration in your /etc/vsftp.conf file:

userlist_enable=YES
userlist_file=/etc/vsftp.user_list
userlist_deny=NO

I've configured my system to use this configuration, and I only have one user which I'd like to expose over FTP named streams, so my /etc/vsftp.user_list looks like this:

streams

Interestingly enough, I cannot log in once I enable to user list. If I change userlist_enable to NO, then things work properly, but if I enable it, I can't log in all, it just keeps trying to reconnect. I don't get a login failed message, it just keeps trying to reconnect when using lftp.

My /etc/vsftp.conf file is available on Pastebin here and my /etc/vsftp.user_list is available here.

What am I doing wrong here? I'd just like to only make the streams user able to log in.

Best Answer

A cursory glance doesn't show anything wrong with your config file... the problem may lie elsewhere.

You've probably already tried this but it might be worth checking the following:

Make sure that that whatever user vsftpd is running as has the appropriate privileges on /etc/vsftp.user_list. You don't have your own non-privileged user configured with the nopriv_user directive, but the default is nobody.
Try commenting out the chroot_local_users directive to see if there is an issue with chroot-ing.
Have you restarted the vsftpd process after making changes? A common Doh! sysadmin moment for me is I make the config changes but forget to HUP to the process... (embarrassing, yes I know).
Try running vsftpd directly from the command line so any errors go to STDERR.
Have you configured your user streams to have /bin/false as a login shell? Try using /bin/nologin instead. /bin/false will prevent that user from logging in at all.
As a last resort consider using PAM and virtual users.

Related Solutions

Linux – Allow anonymous upload for Vsftpd

You have created a dir called pub/upload:

# mkdir /var/ftp/pub/upload

But then you configured uploads to go to pub/incoming:

anon_root=/var/ftp/pub/incoming

So it's a simple path mismatch, all the rest seems OK.

Linux – FTP using VSFTPD “Access Denied”

For permissions, you need to have the folder and files in it owned by myuser so that they can be accessed from the myuser account.

If apache (or your scripts) needs to write to the folder, then the best thing to do is use chgrp to assign the specific locations that should be written to to the www-data group, then chmod g+w that location or file. If you are giving write access to a folder, chmod g+sw will give write access to the folder and ensure that files created there will also belong to the www-data group.

The files and directories in this case would look something like:

drwxrwxr-x 2 myuser   www-data    4096 2011-04-18 03:04 webroot
-rw-rw-r-- 1 myuser   www-data    1000 2011-04-18 03:04 index.html
drwxrwsr-x 2 myuser   www-data    4096 2011-04-18 03:04 folderwithg+ws

You would want to be very careful giving write access to files and folders to apache though, otherwise an attacker might figure out a way to make your scripts overwrite themselves or replace index.html, or whatever.

Otherwise, if apache does not need to write to your document directory, the permissions should be fine as it is long as all of the subdirectories and files are world readable (and directories are world accessible).

For SSL/TLS, you're missing

ssl_enable=YES

You can force users to use encryption:

force_local_logins_ssl=YES
force_local_data_ssl=YES

And there is a ssl_ciphers= option as well, if you want to limit it to HIGH or a specific list of ciphers. If you want "implicit SSL" (instead of AUTH SSL or AUTH TLS commands to start encryption, the encryption is negotiated at the beginning of the connection) then that is implicit_ssl=YES

Best Answer

Related Solutions

Linux – Allow anonymous upload for Vsftpd

Linux – FTP using VSFTPD “Access Denied”

Related Topic