1

I know that it has been asked before (for example here), but I am completely stuck and have no idea how to make it work.

I am trying to setup several ftp users, each with its own subfolder (so the user can see only he his root folder, and nothing else).

current issue is that on filezilla I am getting

Command:    open "user1@123.123.123.123" 22
Command:    Trust new Hostkey: Once
Command:    Pass: ******
Error:  Authentication failed.
Error:  Critical error: Could not connect to server

/etc/vsftpd.conf

listen=YES
listen_ipv6=YES
anonymous_enable=NO
local_enable=YES
write_enable=YES
local_umask=022
dirmessage_enable=YES
use_localtime=YES
xferlog_enable=YES
xferlog_file=/var/log/vsftpd.log
connect_from_port_20=YES
nopriv_user=vsftpd
virtual_use_local_privs=YES
guest_enable=YES
user_sub_token=$USER
local_root=/home/ftpmain/ftp/$USER
hide_ids=YES
guest_username=vsftpd
secure_chroot_dir=/var/run/vsftpd/empty
ssl_enable=YES
allow_anon_ssl=NO
ssl_tlsv1=YES
ssl_sslv2=NO
ssl_sslv3=NO
require_ssl_reuse=NO
ssl_ciphers=HIGH
pasv_address=123.123.123.123
pasv_enable=Yes
pasv_min_port=40000
pasv_max_port=50000
chroot_local_user=YES
chroot_list_enable=NO

/etc/pam.d/vsftpd

auth required pam_pwdfile.so pwdfile /etc/vsftpd/ftpd.passwd
account required pam_permit.so

the user1 folder looks like this (after chmod+chown):

/home/ftpmain/ftp/user1$ ll
total 12
dr-xr-xr-x 3 root   root    4096 Mar 18 19:17 ./
dr-xr-xr-x 4 nobody nogroup 4096 Mar 18 19:09 ../
drwxr-xr-x 2 vsftpd nogroup 4096 Mar 18 19:17 folder1/

netstat

$ netstat -tlpn
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 127.0.0.53:53           0.0.0.0:*               LISTEN      -
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      -
tcp6       0      0 :::22                   :::*                    LISTEN      -

Any idea about what I am missing and how to make it work? Is there any way to debug it? some log files that I can check why login fails?

Any help would be appreciated, let me know if you need further info

P.S: running on ubuntu 18.04

UPDATE

I found this error in the /var/log/auth file:

$ tail -f /var/log/*

Apr 30 15:05:49 ip-172-31-40-232 sshd[25641]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.111.111.111
Apr 30 15:05:51 ip-172-31-40-232 sshd[25641]: Failed password for invalid user user1 from 111.111.111.111 port 53251 ssh2
Apr 30 15:05:51 ip-172-31-40-232 sshd[25641]: error: Received disconnect from 111.111.111.111 port 53251:13: Unable to authenticate [preauth]
Apr 30 15:05:51 ip-172-31-40-232 sshd[25641]: Disconnected from invalid user user1 111.111.111.111 port 53251 [preauth]

I discovered that vsftpd isn't running at all! The reason that I didn't see it before, is because I had SFTP working (using port 22). the vsftpd status was 'Failed'.

$ sudo /etc/init.d/vsftpd status
● vsftpd.service - vsftpd FTP server
   Loaded: loaded (/lib/systemd/system/vsftpd.service; enabled; vendor preset: enabled)
   Active: failed (Result: exit-code) since Tue 2019-04-30 15:45:56 UTC; 2s ago
  Process: 25980 ExecStart=/usr/sbin/vsftpd /etc/vsftpd.conf (code=exited, status=2)
  Process: 25972 ExecStartPre=/bin/mkdir -p /var/run/vsftpd/empty (code=exited, status=0/SUCCESS)
 Main PID: 25980 (code=exited, status=2)

I run the vsftpd manually from command line and discovered there is a certificate error

$ sudo /usr/sbin/vsftpd /etc/vsftpd.conf
500 OOPS: SSL: cannot load RSA certificate
  • Port 22 is usually reserved for SSH - did you really configure vsftpd to listen on that port? By convention, ftp/ftps services use port 21 – steeldriver Apr 30 '19 at 11:29
  • It is using SFTP, and it is port 22 by default I guess. It worked for me in the past. I am not such an expert in setting vsftpd. I tried now with port 21, and got ECONNREFUSED error – justadev Apr 30 '19 at 13:04
  • AFAIK vsftpd uses FTPS not SFTP – steeldriver Apr 30 '19 at 13:11
  • I did netstat and server is only listening to port 22. I updated the info in the question, you can see there. My configuration is exactly like in the question. Something that I am missing? – justadev Apr 30 '19 at 14:43
  • you are right about something. I completely stopped vsfptd, and I was still able to 'SFTP' to the server. But why doesn't vsftpd work? – justadev Apr 30 '19 at 15:45
2

I fixed this issue by adding the certificate to the conf file

rsa_cert_file=/etc/ssl/private/vsftpd.pem
rsa_private_key_file=/etc/ssl/private/vsftpd.pem

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.