Tag Info

Hot answers tagged

6

SFTP is not FTP. It's the sftp subsystem of ssh, it's handled by the sshd daemon, not vsftpd or any FTP server. It's on the ssh TCP port (22), not the FTP port 21 (well FTP commands are on 21 while data connections are on arbitrary ports, and those multiple connections in FTP are one of the many reasons why SFTP is so much better than FTP). ss -lp sport = ...


5

In addition to Stephane's answer I'd like to point out that there is FTPS, too. FTPS is the classic FTP protocol over an SSL-secured connection. If you meant this you'd have to adjust your question of course, but it would be a completely different question then. There are two variations of FTPS, one were the control channel is secured (credentials etc) and ...


4

To achieve this need following things : Method 1# By changing User's Home directory Make sure following line exists chroot_local_user=YES Set User HOME Directory to /var/www/ , if you want to change for existing user then you can use : usermod --home /var/www/ username then set required permission on /var/www/ Method 2# If you don't want to ...


4

Your ftp server needs a channel to transfer data. Port 21 is used to establish the connection. So to make data transfer possible you'd need to enable port 20 as well. See the following configuraton First load the following module to make sure passive ftp connections are not rejceted modprobe ip_conntrack_ftp Allow FTP connections on port 21 incoming and ...


3

Interestingly enough, my vsftpd writes the versino string to stdin. So you probably need to do a rather unusual redirection of stdin to stdout: i=`/usr/sbin/vsftpd -version 0>&1` How to find this out: run it in strace (you'll need to do it as root) and check for the string. In my case the log ends like this: $ strace /usr/sbin/vsftpd -version ... ...


2

You have few options: Set local_umask in vsftpd.conf to 022 instead of default 077 Set chmod_enable to YES and do CHMOD via ftp client (if it does not do so already) By the way, better to use scp, because it does not transmits your credentials in plaintext, and you can configure public key authentication, so you will not have to enter password each time, ...


2

It's quite simple. You have to add the following option on the vsftpd.conf file chroot_local_user=YES The documentation inside the configuration file is self-explanatory: # You may specify an explicit list of local users to chroot() to their home # directory. If chroot_local_user is YES, then this list becomes a list of # users to NOT chroot(). This ...


2

Please make sure the following setting is configured in your /etc/vsftpd.conf file anon_root=/example/directory/ # Directory to be used for an anonymous login if you are trying to create a soft link to redirect to certain directory then note that a soft links cannot resolve unless where they link to is inside the chroot area.


2

The simple solution is to switch Filezilla to use passive mode when connecting to that FTP server. When you connect to FTP you use port 21 which is known as the control channel. This is the connection used to send commands and receive notifications on the results of the commands issued. Note that for file listings (the output to LIST), file transfer ...


2

You have 2 options: chroot_local_user=YES chroot_list_enable=YES chroot_list_file=/etc/vsftpd/nonchroot.list Where file /etc/vsftpd/nonchroot.list should contail the users you don’t want to chroot. OR chroot_list_enable=YES chroot_list_file=/etc/vsftpd/chroot.list Where the file /etc/vsftpd/chroot.list should contain the users you want to be chrooted ...


2

When using rsyslogd you can create a filter rule that matches some vsftp log messages of interest and emails them to you. Rsyslog has an email output module. Other syslog daemons may provide similar features. Perhaps you also need to adjust some vsftpd options to get all events of interest reported. In general, the question is, if you really want to get ...


2

FTP is an ancient protocol. It relies on two TCP connections: a control connection over which commands are exchanged, and data connections for the content of files and also for the output of commands such as ls. What's happening here is that the control connection is established, but the data connections aren't going through. By default (active mode), data ...


2

Adding NEW fixed it, I believe. Now, my iptables file look like this.. # Generated by iptables-save v1.3.5 on Thu Oct 3 22:25:54 2013 *filter :INPUT ACCEPT [0:0] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [824:72492] -A INPUT -p tcp -m tcp --dport 21 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT -A INPUT -p tcp -m tcp --dport 20 -m conntrack --ctstate ...


2

you can try playing with : cmds_allowed This options specifies a comma separated list of allowed FTP commands (post login. USER, PASS and QUIT and others are always allowed pre-login). Other commands are rejected. This is a powerful method of really locking down an FTP server. Example: cmds_allowed=PASV,RETR,QUIT Default: (none) cmds_denied ...


2

This tutorial would seem to be what you're looking for, titled: Setup Virtual Users and Directories in VSFTPD. excerpt In /etc/vsftpd.conf. listen=YES anonymous_enable=NO local_enable=YES virtual_use_local_privs=YES write_enable=YES connect_from_port_20=YES secure_chroot_dir=/var/run/vsftpd pam_service_name=vsftpd guest_enable=YES user_sub_token=$USER ...


1

You can usually find selinux denials in /var/log/messages. Try this (as root): grep avc /var/log/messages | grep ftp Review the output and decide whether the denials are erroneous, given your desired configuration. Tune the grep statements as necessary to whiddle the information down to only the statements you want to fix. It's often useful to ...


1

SELinux won't let vsftpd serve files from places other than /var/ftp or write logs outside /var/log on purpose. SELinux is all about disaster mitigation. FTP is fundamentally insecure. Running vsftpd under SELinux is a good idea, because it minimizes the damage an attacker can do if he decides to attack your FTP service. Running a fundamentally insecure ...


1

You also need to add this configuration option: userlist_enable=YES Details userlist_deny — When used in conjunction with the userlist_enable directive and set to NO, all local users are denied access unless the username is listed in the file specified by the userlist_file directive. Because access is denied before the client is asked for a password, ...


1

If you suspect SELinux as the culprit (ie, if any violations show up in /var/log/audit/audit.log when you attempt the upload or if the upload completes successfully after setting SELinux to permissive mode), then look into audit2allow to turn your failure audit messages into SELinux rules that will allow the actions you're attempting to perform.


1

This is fine. I had to do the same on my setup as well so that files could be uploaded. The biggest risk is that if there is a vulnerability in Wordpress, then this is a directory that a would be attacker could put payloads. But arguably they've already gained access to your Wordpress installation so you're already in trouble. Part of the price of ...


1

Normally on StackExchange sites, answers are supposed to be comprehensive and not merely link to other resources. However, you're asking two pretty basic, but very broad, questions here. How do I configure the CentOS firewall? How do I configure vsftpd on CentOS? I can't write an answer which gives you everything you need to know about those, but I ...


1

As http://en.wikipedia.org/wiki/List_of_FTP_server_return_codes states, 550 Requested action not taken. File unavailable (e.g., file not found, no access). You either don't have file system permissions to access these directories or the server is set up such that it treats /home as the file system root. You could of course have googled a bit and ...


1

Here's how I created a jailed sftpuser for clients to sftp files to my server: Create the sftpgroup # groupadd sftpusers Create the sftpuser: # useradd -g sftpusers -d /incoming/client1 -s /sbin/nologin \ client1srs passwd client1srs Modify user and make the user sftp onluy and put in sftp jail # usermod -g sftpusers -d /incoming -s ...


1

This question is all over the internet with no clear cut solution that I've found. So here is where I stand on this now (I will update as I find out more). Seems the fundamental problem is that FTP has users logging in and manipulating the file system, as opposed to an http client simply sending requests to an http service process. So, it's very ...


1

Try to "mount --bind" the shared directory into the user's directory. mount --bind /home/actual_share/ /home/someguy/shared/ I assume you'll need to add group write to the "actual_share". Got the idea from this forum post.


1

To install using YUM Your RHEL should Register with RHN or You can setup Local Yum repository for the same. If you are installing from the CD-ROM: mount the CD-ROM: mount /dev/cdrom /mnt/ change to the RPMS directory in the CD-ROM: cd /mnt/RedHat/RPMS if you know the name of the package type ls packagename* (e.g. ls *vsftp*) to find the full package ...


1

vsftpd is a FTP server implementing the FTP protocol. Some extensions for encryption are available for FTP, but they are completely different from SFTP which is a subsystem of SSH. If you want to use sftp, you need to configure a ssh server and enable the sftp subsystem (see the sshd_config man page for details). It's also possible to configure sftp with ...


1

Use netcat (I'm using traditional netcat syntax - package netcat-traditional package from Ubuntu) dest_machine$ nc -l -p 2222 > copied_dir_tree.tgz src_machine$ tar czf - dir_tree_to_copy/ | nc dest_machine_ip 2222 Probably the fastest way (without encryption, with on-fly compression)


1

From your other comments, it doesn't sound like you do have a FTP server running. One possibility is that there is a firewall, either on your machine or elsewhere, that is redirecting the FTP port to another host, or that it's being intercepted by the virtualization software. Or, you're mistaken and you're simply not connecting to the machine you think ...



Only top voted, non community-wiki answers of a minimum length are eligible