66
Method 1: Changing the user's home directory
Make sure the following line exists
chroot_local_user=YES
Set user HOME Directory to /var/www/ , if you want to change for existing user then you can use:
usermod --home /var/www/ username
then set required permission on /var/www/
Method 2: Use user_sub_token
If you don't want to change user's Home ...
45
Could you try this
chown -R ftpusername /var/www/html
29
Your ftp server needs a channel to transfer data. Port 21 is used to establish the connection. So to make data transfer possible you'd need to enable port 20 as well. See the following configuraton
First load the following module to make sure passive ftp connections are not rejected
modprobe ip_conntrack_ftp
Allow FTP connections on port 21 incoming and ...
28
FTP is an ancient protocol. It relies on two TCP connections: a control connection over which commands are exchanged, and data connections for the content of files and also for the output of commands such as ls. What's happening here is that the control connection is established, but the data connections aren't going through.
By default (active mode), data ...
answered Oct 5 '13 at 2:44
Gilles 'SO- stop being evil'
669k163 gold badges1396 silver badges1900 bronze badges
18
I saw such extensive rules already in several Blogs etc. and wondered why not simply use
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 21 -j ACCEPT
together with the nf_conntrack_ftp module. This is more concise and readable, which is generally a good thing, especially with firewalls...
FWIW,...
13
The command ftp put /path/to/local_file doesn't work with vsftpd. Try the following:
ftp put /path/to/local_file remote_file_name
You may choose any name you wish for the remote_file_name, but you must specify one.
12
A restart job has to kill an old instance first. What is happening here is that there isn't an old copy to kill.
I advise you to try this command instead:
/etc/init.d/vsftpd restart
10
Run this one command, no need to restart any service & server:
# setenforce 0
To check SELinux status :
# getenforce
or
edit the file /etc/sysconfig/selinux to include
SELINUX=disabled
Doing so will require a reboot.
10
I had same error after PASS command in CENTOS 7. (GnuTLS error -15: An unexpected TLS packet was received.)
My solution is following:
I had to add following to vsftpd.conf:
allow_writeable_chroot=YES
chroot_local_user=YES
local_root=/ftphome/$USER
user_sub_token=$USER
9
In addition to Stephane's answer I'd like to point out that there is FTPS, too. FTPS is the classic FTP protocol over an SSL-secured connection. If you meant this you'd have to adjust your question of course, but it would be a completely different question then.
There are two variations of FTPS, one were the control channel is secured (credentials etc) and ...
9
vsftpd is a FTP server implementing the FTP protocol. Some extensions for encryption are available for FTP, but they are completely different from SFTP which is a subsystem of SSH.
If you want to use sftp, you need to configure a ssh server and enable the sftp subsystem (see the sshd_config man page for details). It's also possible to configure sftp with ...
answered Feb 12 '13 at 14:44
Stéphane Chazelas
405k71 gold badges795 silver badges1210 bronze badges
9
There is a post here that describes the problem. The new kernel module seccomp is used automatically by vsftpd since version 3.0.0. vsftpd is a bit buggy when using seccomp.
Add this line to the end of /etc/vsftpd.conf
seccomp_sandbox=NO
and restart the Server:
sudo service vsftpd restart
8
FTP Client:
lsmod | grep ftp
modprobe nf_conntrack_ftp
lsmod | grep ftp
iptables -A INPUT -s 192.168.1.0/24 -d 192.168.1.0/24 -p tcp -m tcp --sport 21 -m conntrack --ctstate ESTABLISHED -j ACCEPT
iptables -A INPUT -s 192.168.1.0/24 -d 192.168.1.0/24 -p tcp -m tcp --sport 20 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -s 192.168.1....
7
Although disabling SELinux by SELINUX=disabled will solve the problem this would not be advisable. You can enable ftp user to access his home directory by configuring SELinux boolean value ftp_home_dir by running the following command:
setsebool -P ftp_home_dir=1
7
You could try the following in vsftp.conf:-
anon_other_write_enable=YES
The man page says:-
If set to YES, anonymous users will be permitted to perform write operations
other than upload and create directory, such as deletion and renaming. This
is generally not recommended but included for completeness.
7
Working from the vsftpd version 2.2.2, there are two options for keeping users in a chroot jail:
chroot_list_enable
Just add users to the chroot list e.g. (/etc/vsftpd/chroot_list) that you want placing in a chroot jail.
chroot_local_user
This will place all local users in a chroot jail, however, if this is set then the chroot_list becomes a list of ...
7
Remember to comment out
listen=YES
in your vsftpd.conf file so that you don't run your vsftpd in standalone mode
It fixed the problem in my case.
7
There is (obviously) manual page for vsftpd.conf, which is always a good place to start.
TLDR version: They should be needed only for passive mode of FTP.
pasv_enable
Set to NO if you want to disallow the PASV method of obtaining a data connection.
Default: YES
pasv_address
Use this option to override the IP address that vsftpd will advertise in response ...
6
After you've changed your config to include chroot_local_user=YES
You could change the user's shell to /usr/sbin/nologin so that if the password leaks you will have mitigated some risk (set the home directory too). The shell needs to be listed in /etc/shells as well or authentication will fail.
usermod -d /var/www/my.domain.example -s /usr/sbin/nologin ...
6
The solution is to limit the ports that vsftpd allocates for PASV style data connections in the configuration file. In the vsftpd.conf, add those two lines:
pasv_min_port=12000
pasv_max_port=12100
Then you will need to open those ports in the Google Developers Console, under Networking, Firewall rules (see image).
You also might want to add the following ...
6
Look at your /etc/passwd file
Find your user and look shell (example ttr:x:501:501::/home/username/ttr:/sbin/nologin)
Add this shell (/bin/false or /sbin/nologin) to your /etc/shell or /etc/shells
After that, check your connection
Try again...If it still does not work
Back up the config file before making a change;
sudo cp /etc/vsftpd.conf /etc/vsftpd....
6
You can check the installed package version with dpkg -l | grep -i openssl. The actual TLS/SSL version used depends on what the server offers or what is negotiated between server and client in any given session.
5
Thanks to user81029 for pointing out
sudo setsebool -P allow_ftpd_full_access 1
solves the issue with empty ftp directory after mount --bind a folder into /var/ftp/ on SELinux
5
Interestingly enough, my vsftpd writes the versino string to stdin. So you probably need to do a rather unusual redirection of stdin to stdout:
i=`/usr/sbin/vsftpd -version 0>&1`
How to find this out: run it in strace (you'll need to do it as root) and check for the string. In my case the log ends like this:
$ strace /usr/sbin/vsftpd -version
...
...
5
Adding NEW fixed it, I believe.
Now, my iptables file look like this..
# Generated by iptables-save v1.3.5 on Thu Oct 3 22:25:54 2013
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [824:72492]
-A INPUT -p tcp -m tcp --dport 21 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp --dport 20 -m conntrack --ctstate NEW,...
5
I had a similar problem and discovered that it's caused by an environment variable. When you use su, it leaves the UPSTART_SESSION environment variable set (from the original user's environment), which breaks things. Using sudo or su - unsets it, so any of these will work:
$ sudo service vsftpd restart
$ sudo su
# service vsftpd restart
$ su -
# service ...
4
That group should have rwx permissions on that folder. If not run
chmod 775 <directory>
4
you can always allow the FTP daemon full access to all files by running
setsebool -P allow_ftpd_full_access 1
4
Here are steps to setup a user and allow the user access only via FTP (i.e. no SSH) and also limit access to a specific (user home) directory on proftpd:
Add new user: adduser newusername
Set password: passwd newusername
Modify user home directory from default to a new folder:
usermod -d /target/directory username
Edit shells file: vi /etc/shells and add /...
Only top voted, non community-wiki answers of a minimum length are eligible
