0

I've been trying to set up VSFTPD on Centos 6.6 to allow virtual users. Below is my vsftpd.conf, which is configured to allow only virtual users in /etc/vsftpd/vsftpd-virtual-user.db.

listen=YES
local_umask=002
anonymous_enable=NO
local_enable=YES
virtual_use_local_privs=YES
write_enable=YES
pam_service_name=vsftpd_virtual
guest_enable=YES
local_root=/var/sites
chroot_local_user=YES
hide_ids=YES
connect_from_port_20=YES
pasv_enable=YES
pasv_addr_resolve=YES
pasv_address=10.175.9.23
pasv_min_port=1024
pasv_max_port=65535

I have also set up the vsftpd_virtual module in /etc/pam.d/vsftpd_virtual which contains the following:

#%PAM-1.0
auth    required        pam_userdb.so   db=/etc/vsftpd/vsftpd-virtual-user
account required        pam_userdb.so   db=/etc/vsftpd/vsftpd-virtual-user
session required        pam_loginuid.so

When trying to log in to FTP on localhost, I'm getting a 530 error from FTP and the following line in /var/log/secure:

vsftpd: pam_userdb(vsftpd_virtual:auth): user_lookup: could not open database `/etc/vsftpd/vsftpd-virtual-user': Permission denied

The file permissions for the database file seem fine, but I may be wrong:

Access: (0777/-rwxrwxrwx)  Uid: (    0/    root)   Gid: (    0/    root)
  • Your file permissions look too open. You need them to be more restricted. Try chmod 600 /etc/vsftpd/vsftpd-virtual-user. Also look this over if you haven't already. – devnull Mar 20 '15 at 12:24
  • Everething looks fine in your configs. Do you have selinux enabled, if yes you can paste the result of: ls -Z vsftpd-virtual-user.db (also you can check permissions of vsftpd dir) or you can try: restorecon -v vsftpd-virtual-user.db. If the problem is from selinux this should fix it. Hope it helps. Cheers. – taliezin Mar 20 '15 at 21:25
  • @taliezin you were right, it was an selinux issue, fixing the context solved the problem nicely. Good catch! If you put it in an answer I'll award the points, thanks! – tombazza Mar 27 '15 at 8:52
  • It was a guess about selinux, because I did not see any other reason for this behaviour since your configs are ok. I am glad that it is fixed. Points are not a problem. :) – taliezin Mar 27 '15 at 8:55
0

From your indication, the config is not pointed to the db file: /etc/vsftpd/vsftpd-virtual-user.db (You are using "/etc/vsftpd/vsftpd-virtual-user"

0

It looks like your problem is in the mapping of virtual users to real user. In vsftp, virtual users are treated somewhat like guest users - that's why you need guest_enable=YES in your configuration.

One suggestion is to create a user for this mapping. Something like:

useradd -d /home/ftp virtual

echo guest_username=virtual >> /etc/vsftpd/vsftpd.conf

This will map the virtual users to the real user called virtual, and they'll be chrooted to the /home/ftp directory.

As a side-note, the /etc/vsftpd/vsftpd-virtual-user needs to be readable by the root user ( chmod 600 ).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.