2

I'm trying to enable logging for vsftpd so I can see uploads, downloads, and, more specifically, deletion of files; however, I haven't even been able to get normal logging working with a fresh install of centos 6.

Setup:

[root@sftp01 vsftpd]# cat /etc/centos-release 
CentOS release 6.9 (Final)

[root@sftp01 vsftpd]# netstat -naplt
    Active Internet connections (servers and established)
    Proto Recv-Q Send-Q Local Address               Foreign Address             State       PID/Program name   
    tcp        0      0 0.0.0.0:21                  0.0.0.0:*                   LISTEN      367/vsftpd          
    tcp        0      0 0.0.0.0:22                  0.0.0.0:*                   LISTEN      507/sshd            
    tcp        0      0 :::22                       :::*                        LISTEN      507/sshd   

[root@sftp01 ~]# yum repolist
Loaded plugins: fastestmirror
Determining fastest mirrors
epel/metalink                                                                                                          |  12 kB     00:00     
 * base: mirrors.usc.edu
 * epel: mirror.math.princeton.edu
 * extras: repos.lax.quadranet.com
 * updates: mirror.eboundhost.com
base                                                                                                                   | 3.7 kB     00:00     
base/primary_db                                                                                                        | 4.7 MB     00:01     
epel                                                                                                                   | 4.3 kB     00:00     
epel/primary_db                                                                                                        | 5.9 MB     00:00     
extras                                                                                                                 | 3.4 kB     00:00     
extras/primary_db                                                                                                      |  29 kB     00:00     
updates                                                                                                                | 3.4 kB     00:00     
updates/primary_db                                                                                                     | 3.1 MB     00:00     
repo id                                         repo name                                                                               status
base                                            CentOS-6 - Base                                                                          6,706
epel                                            Extra Packages for Enterprise Linux 6 - x86_64                                          12,380
extras                                          CentOS-6 - Extras                                                                           45
updates                                         CentOS-6 - Updates                                                                         565

Default config:

[root@sftp01 vsftpd]# grep -v ^# /etc/vsftpd/vsftpd.conf 
anonymous_enable=YES
local_enable=YES
write_enable=YES
local_umask=022
dirmessage_enable=YES
xferlog_enable=YES
connect_from_port_20=YES
xferlog_std_format=YES
listen=YES

pam_service_name=vsftpd
userlist_enable=YES
tcp_wrappers=YES

Connecting via sftp for a system user works fine. I've tried many different combinations for the logging options (dual_log_enable, vsftpd_log_file, xferlog_file and others listed in the man page) and creating the log files manually with various permissions.

How do I get vsftpd to log?


updated:

[root@sftp01 vsftpd]# cat /etc/vsftpd/vsftpd.conf
anonymous_enable=NO
local_enable=YES
write_enable=YES
local_umask=022
dirmessage_enable=YES
connect_from_port_20=YES
listen=YES
pam_service_name=vsftpd
userlist_enable=YES
tcp_wrappers=YES

xferlog_std_format=YES
xferlog_enable=YES
vsftpd_log_file=/var/log/vsftpd.log
log_ftp_protocol=YES

[root@sftp01 vsftpd]# /etc/init.d/vsftpd restart
Shutting down vsftpd:                                      [  OK  ]
Starting vsftpd for vsftpd:                                [  OK  ]

After logging in with sftp, uploading a file, deleting that file, and logging off (no ftp-related info):

[root@sftp01 vsftpd]# tail -f /var/log/*
==> /var/log/secure <==
Aug 29 13:48:22 sftp01 sshd[1253]: Accepted password for test from 192.168.10.10 port 35825 ssh2
Aug 29 13:48:22 sftp01 sshd[1253]: pam_unix(sshd:session): session opened for user test by (uid=0)
Aug 29 13:48:22 sftp01 sshd[1255]: subsystem request for sftp
Aug 29 13:48:31 sftp01 sshd[1253]: pam_unix(sshd:session): session closed for user test
3

You will need to add a location for log file

vsftpd_log_file=/var/log/vsftpd.log

For verbose logging you will need to add

log_ftp_protocol=YES

And comment

xferlog_std_format=YES
  • Got an error with "vsftpd_file=/var/log/vsftpd.log": [root@sftp01 vsftpd]# /etc/init.d/vsftpd restart Shutting down vsftpd: [ OK ] Starting vsftpd for vsftpd: 500 OOPS: unrecognised variable in config file: vsftpd_file – Zell Aug 29 '17 at 17:27
  • My mistake it should be vsftpd_log_file – Piyush Jain Aug 29 '17 at 17:29
  • You should also use service vsftpd restart not just vsftpd restart – Zoey Hewll Jun 22 '18 at 3:32
1

Connections from sFTP have nothing to do with VSFTPD but run over SSHD.
sFTP connections will be unaffected by these changes, only FTP connections.

I got it working with Centos 7.5 by changing the following:

log_ftp_protocol=YES
xferlog_enable=YES
xferlog_std_format=NO

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.