4

What's the difference between anonymous and guest logins in vsftpd?

Both can be enabled/disabled:

anonymous_enable=
guest_enable=

Both are mapped to a different username:

ftp_username=
guest_username=

Pretty much everything what I know is true for anonymous can be applied to guest.

Then why guest exists if anonymous seems good enough?

EDIT

Please consider the following vsftpd config. On the left hand side I have anonymous config, on the right guest. Apart those 3 lines the rest of the config is coherent.

# Standalone mode               # Standalone mode
listen=YES                      listen=YES

# Access rights                 # Access rights
anon_root=/var/ftp              anon_root=/var/ftp
download_enable=YES             download_enable=YES
anonymous_enable=YES         |  guest_enable=YES
local_enable=NO                 local_enable=NO
ftp_username=ftp             |  guest_username=ftp2

# Upload Access rights          # Upload Access rights
write_enable=YES                write_enable=YES
anon_mkdir_write_enable=YES     anon_mkdir_write_enable=YES
anon_other_write_enable=NO      anon_other_write_enable=NO
anon_upload_enable=YES          anon_upload_enable=YES
delete_failed_uploads=YES       delete_failed_uploads=YES

# Security                      # Security
anon_world_readable_only=YES    anon_world_readable_only=YES
connect_from_port_20=YES        connect_from_port_20=YES
hide_ids=YES                    hide_ids=YES
ls_recurse_enable=NO            ls_recurse_enable=NO
tilde_user_enable=NO            tilde_user_enable=NO
pasv_min_port=50000             pasv_min_port=50000
pasv_max_port=60000             pasv_max_port=60000

# Features                      # Features
ftpd_banner=Welcome Anonymou |  ftpd_banner=Welcome Guest !!
no_anon_password=YES            no_anon_password=YES
xferlog_enable=YES              xferlog_enable=YES

User experience with anonymous enabled:

$ lftp -d 127.0.0.1
---- Resolving host address...
---- 1 address found: 127.0.0.1
lftp 127.0.0.1:~> ls
---- Connecting to 127.0.0.1 (127.0.0.1) port 21
<--- 220 Welcome Anonymous !!
---> FEAT
<--- 211-Features:
<---  EPRT
<---  EPSV
<---  MDTM
<---  PASV
<---  REST STREAM
<---  SIZE
<---  TVFS
<--- 211 End
---> USER anonymous
<--- 230 Login successful. 
---> PWD
<--- 257 "/" is the current directory
---> EPSV
<--- 229 Entering Extended Passive Mode (|||52743|)
---- Connecting data socket to (127.0.0.1) port 52743
---- Data connection established
---> LIST
<--- 150 Here comes the directory listing.
---- Got EOF on data connection
---- Closing data socket
drwxrwxr-x    2 ftp      ftp          4096 Mar 16 13:21 upload
drwxr-xr-x    2 ftp      ftp          4096 Mar 16 13:30 vagrant
<--- 226 Directory send OK.
lftp 127.0.0.1:/> exit
---> QUIT
<--- 221 Goodbye.
---- Closing control socket

User experience with guest enabled:

$ lftp -d 127.0.0.1
---- Resolving host address...
---- 1 address found: 127.0.0.1
lftp 127.0.0.1:~> ls
---- Connecting to 127.0.0.1 (127.0.0.1) port 21
<--- 220 Welcome Guest !!
---> FEAT
<--- 211-Features:
<---  EPRT
<---  EPSV
<---  MDTM
<---  PASV
<---  REST STREAM
<---  SIZE
<---  TVFS
<--- 211 End
---> USER anonymous
<--- 230 Login successful. 
---> PWD
<--- 257 "/" is the current directory
---> EPSV
<--- 229 Entering Extended Passive Mode (|||51032|)
---- Connecting data socket to (127.0.0.1) port 51032
---- Data connection established
---> LIST
<--- 150 Here comes the directory listing.
---- Got EOF on data connection
---- Closing data socket
drwxrwxr-x    2 ftp      ftp          4096 Mar 16 13:21 upload
drwxr-xr-x    2 ftp      ftp          4096 Mar 16 13:30 vagrant
<--- 226 Directory send OK.
lftp 127.0.0.1:/> exit
---> QUIT
<--- 221 Goodbye.
---- Closing control socket

As far as I can tell my user experience is not different regardless the configuration.

1
  • Regarding the added "EDIT" section: anonymous_enable is enabled by default. You are using it in both cases, that's why there is no difference.
    – VPfB
    Mar 17, 2017 at 15:16

1 Answer 1

4

This quote describes it:

guest_enable If enabled, all non-anonymous logins are classed as "guest" logins. A guest login is remapped to the user specified in the guest_username setting.

Anonymous access is intended mainly for providing access to public files to everybody.

Guests need a login/password. Guest feature limits the access only to a group of people (e.g. company employees, or registered customers).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .