Hot answers tagged

66

Method 1: Changing the user's home directory Make sure the following line exists chroot_local_user=YES Set user HOME Directory to /var/www/ , if you want to change for existing user then you can use: usermod --home /var/www/ username then set required permission on /var/www/ Method 2: Use user_sub_token If you don't want to change user's Home ...


45

Could you try this chown -R ftpusername /var/www/html


29

Your ftp server needs a channel to transfer data. Port 21 is used to establish the connection. So to make data transfer possible you'd need to enable port 20 as well. See the following configuraton First load the following module to make sure passive ftp connections are not rejected modprobe ip_conntrack_ftp Allow FTP connections on port 21 incoming and ...


28

FTP is an ancient protocol. It relies on two TCP connections: a control connection over which commands are exchanged, and data connections for the content of files and also for the output of commands such as ls. What's happening here is that the control connection is established, but the data connections aren't going through. By default (active mode), data ...


18

I saw such extensive rules already in several Blogs etc. and wondered why not simply use iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT iptables -A INPUT -p tcp -m tcp --dport 21 -j ACCEPT together with the nf_conntrack_ftp module. This is more concise and readable, which is generally a good thing, especially with firewalls... FWIW,...


13

The command ftp put /path/to/local_file doesn't work with vsftpd. Try the following: ftp put /path/to/local_file remote_file_name You may choose any name you wish for the remote_file_name, but you must specify one.


12

A restart job has to kill an old instance first. What is happening here is that there isn't an old copy to kill. I advise you to try this command instead: /etc/init.d/vsftpd restart


10

Run this one command, no need to restart any service & server: # setenforce 0 To check SELinux status : # getenforce or edit the file /etc/sysconfig/selinux to include SELINUX=disabled Doing so will require a reboot.


10

I had same error after PASS command in CENTOS 7. (GnuTLS error -15: An unexpected TLS packet was received.) My solution is following: I had to add following to vsftpd.conf: allow_writeable_chroot=YES chroot_local_user=YES local_root=/ftphome/$USER user_sub_token=$USER


9

In addition to Stephane's answer I'd like to point out that there is FTPS, too. FTPS is the classic FTP protocol over an SSL-secured connection. If you meant this you'd have to adjust your question of course, but it would be a completely different question then. There are two variations of FTPS, one were the control channel is secured (credentials etc) and ...


9

vsftpd is a FTP server implementing the FTP protocol. Some extensions for encryption are available for FTP, but they are completely different from SFTP which is a subsystem of SSH. If you want to use sftp, you need to configure a ssh server and enable the sftp subsystem (see the sshd_config man page for details). It's also possible to configure sftp with ...


9

There is a post here that describes the problem. The new kernel module seccomp is used automatically by vsftpd since version 3.0.0. vsftpd is a bit buggy when using seccomp. Add this line to the end of /etc/vsftpd.conf seccomp_sandbox=NO and restart the Server: sudo service vsftpd restart


8

FTP Client: lsmod | grep ftp modprobe nf_conntrack_ftp lsmod | grep ftp iptables -A INPUT -s 192.168.1.0/24 -d 192.168.1.0/24 -p tcp -m tcp --sport 21 -m conntrack --ctstate ESTABLISHED -j ACCEPT iptables -A INPUT -s 192.168.1.0/24 -d 192.168.1.0/24 -p tcp -m tcp --sport 20 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT iptables -A INPUT -s 192.168.1....


7

Although disabling SELinux by SELINUX=disabled will solve the problem this would not be advisable. You can enable ftp user to access his home directory by configuring SELinux boolean value ftp_home_dir by running the following command: setsebool -P ftp_home_dir=1


7

You could try the following in vsftp.conf:- anon_other_write_enable=YES The man page says:- If set to YES, anonymous users will be permitted to perform write operations other than upload and create directory, such as deletion and renaming. This is generally not recommended but included for completeness.


7

Working from the vsftpd version 2.2.2, there are two options for keeping users in a chroot jail: chroot_list_enable Just add users to the chroot list e.g. (/etc/vsftpd/chroot_list) that you want placing in a chroot jail. chroot_local_user This will place all local users in a chroot jail, however, if this is set then the chroot_list becomes a list of ...


7

Remember to comment out listen=YES in your vsftpd.conf file so that you don't run your vsftpd in standalone mode It fixed the problem in my case.


7

There is (obviously) manual page for vsftpd.conf, which is always a good place to start. TLDR version: They should be needed only for passive mode of FTP. pasv_enable Set to NO if you want to disallow the PASV method of obtaining a data connection. Default: YES pasv_address Use this option to override the IP address that vsftpd will advertise in response ...


6

After you've changed your config to include chroot_local_user=YES You could change the user's shell to /usr/sbin/nologin so that if the password leaks you will have mitigated some risk (set the home directory too). The shell needs to be listed in /etc/shells as well or authentication will fail. usermod -d /var/www/my.domain.example -s /usr/sbin/nologin ...


6

The solution is to limit the ports that vsftpd allocates for PASV style data connections in the configuration file. In the vsftpd.conf, add those two lines: pasv_min_port=12000 pasv_max_port=12100 Then you will need to open those ports in the Google Developers Console, under Networking, Firewall rules (see image). You also might want to add the following ...


6

Look at your /etc/passwd file Find your user and look shell (example ttr:x:501:501::/home/username/ttr:/sbin/nologin) Add this shell (/bin/false or /sbin/nologin) to your /etc/shell or /etc/shells After that, check your connection Try again...If it still does not work Back up the config file before making a change; sudo cp /etc/vsftpd.conf /etc/vsftpd....


6

You can check the installed package version with dpkg -l | grep -i openssl. The actual TLS/SSL version used depends on what the server offers or what is negotiated between server and client in any given session.


5

Thanks to user81029 for pointing out sudo setsebool -P allow_ftpd_full_access 1 solves the issue with empty ftp directory after mount --bind a folder into /var/ftp/ on SELinux


5

Interestingly enough, my vsftpd writes the versino string to stdin. So you probably need to do a rather unusual redirection of stdin to stdout: i=`/usr/sbin/vsftpd -version 0>&1` How to find this out: run it in strace (you'll need to do it as root) and check for the string. In my case the log ends like this: $ strace /usr/sbin/vsftpd -version ... ...


5

Adding NEW fixed it, I believe. Now, my iptables file look like this.. # Generated by iptables-save v1.3.5 on Thu Oct 3 22:25:54 2013 *filter :INPUT ACCEPT [0:0] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [824:72492] -A INPUT -p tcp -m tcp --dport 21 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT -A INPUT -p tcp -m tcp --dport 20 -m conntrack --ctstate NEW,...


5

I had a similar problem and discovered that it's caused by an environment variable. When you use su, it leaves the UPSTART_SESSION environment variable set (from the original user's environment), which breaks things. Using sudo or su - unsets it, so any of these will work: $ sudo service vsftpd restart $ sudo su # service vsftpd restart $ su - # service ...


4

That group should have rwx permissions on that folder. If not run chmod 775 <directory>


4

you can always allow the FTP daemon full access to all files by running setsebool -P allow_ftpd_full_access 1


4

Here are steps to setup a user and allow the user access only via FTP (i.e. no SSH) and also limit access to a specific (user home) directory on proftpd: Add new user: adduser newusername Set password: passwd newusername Modify user home directory from default to a new folder: usermod -d /target/directory username Edit shells file: vi /etc/shells and add /...


Only top voted, non community-wiki answers of a minimum length are eligible