1

I know that it has been asked before (for example here), but I am completely stuck and have no idea how to make it work.

I am trying to setup several ftp users, each with its own subfolder (so the user can see only he his root folder, and nothing else).

current issue is that on filezilla I am getting

Command:    open "[email protected]" 22
Command:    Trust new Hostkey: Once
Command:    Pass: ******
Error:  Authentication failed.
Error:  Critical error: Could not connect to server

/etc/vsftpd.conf

listen=YES
listen_ipv6=YES
anonymous_enable=NO
local_enable=YES
write_enable=YES
local_umask=022
dirmessage_enable=YES
use_localtime=YES
xferlog_enable=YES
xferlog_file=/var/log/vsftpd.log
connect_from_port_20=YES
nopriv_user=vsftpd
virtual_use_local_privs=YES
guest_enable=YES
user_sub_token=$USER
local_root=/home/ftpmain/ftp/$USER
hide_ids=YES
guest_username=vsftpd
secure_chroot_dir=/var/run/vsftpd/empty
ssl_enable=YES
allow_anon_ssl=NO
ssl_tlsv1=YES
ssl_sslv2=NO
ssl_sslv3=NO
require_ssl_reuse=NO
ssl_ciphers=HIGH
pasv_address=123.123.123.123
pasv_enable=Yes
pasv_min_port=40000
pasv_max_port=50000
chroot_local_user=YES
chroot_list_enable=NO

/etc/pam.d/vsftpd

auth required pam_pwdfile.so pwdfile /etc/vsftpd/ftpd.passwd
account required pam_permit.so

the user1 folder looks like this (after chmod+chown):

/home/ftpmain/ftp/user1$ ll
total 12
dr-xr-xr-x 3 root   root    4096 Mar 18 19:17 ./
dr-xr-xr-x 4 nobody nogroup 4096 Mar 18 19:09 ../
drwxr-xr-x 2 vsftpd nogroup 4096 Mar 18 19:17 folder1/

netstat

$ netstat -tlpn
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 127.0.0.53:53           0.0.0.0:*               LISTEN      -
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      -
tcp6       0      0 :::22                   :::*                    LISTEN      -

Any idea about what I am missing and how to make it work? Is there any way to debug it? some log files that I can check why login fails?

Any help would be appreciated, let me know if you need further info

P.S: running on ubuntu 18.04

UPDATE

I found this error in the /var/log/auth file:

$ tail -f /var/log/*

Apr 30 15:05:49 ip-172-31-40-232 sshd[25641]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.111.111.111
Apr 30 15:05:51 ip-172-31-40-232 sshd[25641]: Failed password for invalid user user1 from 111.111.111.111 port 53251 ssh2
Apr 30 15:05:51 ip-172-31-40-232 sshd[25641]: error: Received disconnect from 111.111.111.111 port 53251:13: Unable to authenticate [preauth]
Apr 30 15:05:51 ip-172-31-40-232 sshd[25641]: Disconnected from invalid user user1 111.111.111.111 port 53251 [preauth]

I discovered that vsftpd isn't running at all! The reason that I didn't see it before, is because I had SFTP working (using port 22). the vsftpd status was 'Failed'.

$ sudo /etc/init.d/vsftpd status
● vsftpd.service - vsftpd FTP server
   Loaded: loaded (/lib/systemd/system/vsftpd.service; enabled; vendor preset: enabled)
   Active: failed (Result: exit-code) since Tue 2019-04-30 15:45:56 UTC; 2s ago
  Process: 25980 ExecStart=/usr/sbin/vsftpd /etc/vsftpd.conf (code=exited, status=2)
  Process: 25972 ExecStartPre=/bin/mkdir -p /var/run/vsftpd/empty (code=exited, status=0/SUCCESS)
 Main PID: 25980 (code=exited, status=2)

I run the vsftpd manually from command line and discovered there is a certificate error

$ sudo /usr/sbin/vsftpd /etc/vsftpd.conf
500 OOPS: SSL: cannot load RSA certificate
7
  • Port 22 is usually reserved for SSH - did you really configure vsftpd to listen on that port? By convention, ftp/ftps services use port 21 Apr 30, 2019 at 11:29
  • It is using SFTP, and it is port 22 by default I guess. It worked for me in the past. I am not such an expert in setting vsftpd. I tried now with port 21, and got ECONNREFUSED error
    – justadev
    Apr 30, 2019 at 13:04
  • AFAIK vsftpd uses FTPS not SFTP Apr 30, 2019 at 13:11
  • I did netstat and server is only listening to port 22. I updated the info in the question, you can see there. My configuration is exactly like in the question. Something that I am missing?
    – justadev
    Apr 30, 2019 at 14:43
  • you are right about something. I completely stopped vsfptd, and I was still able to 'SFTP' to the server. But why doesn't vsftpd work?
    – justadev
    Apr 30, 2019 at 15:45

1 Answer 1

2

I fixed this issue by adding the certificate to the conf file

rsa_cert_file=/etc/ssl/private/vsftpd.pem
rsa_private_key_file=/etc/ssl/private/vsftpd.pem

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .