0

I know this issue has been asked and answered numerous times, but I have followed every question and answer I can find with no luck, hence asking the question to the community again, hoping that someone can spot my issue.

Install and Setup Process

My operating system is Ubuntu 20.04.4 LTS.

I have installed vsftpd and updated the configuration file (/etc/vsftpd.conf) as follows:

# Run standalone
listen=NO
# Enables listening on IPv6 sockets
listen_ipv6=YES
# Allow anonymous FTP
anonymous_enable=NO
# Allow local users to log in
local_enable=YES
# Enable any form of FTP write command.
write_enable=YES
# Default umask for local users is 022 to give uploaded files and folders the correct permissions
local_umask=022
# Activate directory messages - messages given to remote users when they go into a certain directory.
dirmessage_enable=YES
# Display directory listings in local  time  zone
use_localtime=YES
# Activate logging of uploads/downloads.
xferlog_enable=YES
# Make sure PORT transfer connections originate from port 20 (ftp-data).
connect_from_port_20=YES
# Display login banner:
ftpd_banner=Welcome to the FTP service!
# Specify an explicit list of local users to chroot() to their homedirectory
chroot_local_user=YES
# Set a secure chroot() jail at times vsftpd does not require filesystem
secure_chroot_dir=/var/run/vsftpd/empty
# This string is the name of the PAM service vsftpd will use
pam_service_name=vsftpd
# Encrypted connections
ssl_enable=YES
rsa_cert_file=/etc/ssl/private/vsftpd.pem
rsa_private_key_file=/etc/ssl/private/vsftpd.pem
allow_anon_ssl=NO
force_local_data_ssl=YES
force_local_logins_ssl=YES
ssl_tlsv1=YES
ssl_sslv2=NO
ssl_sslv3=NO
require_ssl_reuse=NO
ssl_ciphers=HIGH
#
# Additional configuration
force_dot_files=YES
userlist_deny=NO
userlist_enable=YES
userlist_file=/etc/vsftpd.userlist
pasv_min_port=40000
pasv_max_port=50000

I've added the user to the /etc/vsftpd.userlist file and generated the certificate as follows:

sudo openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/ssl/private/vsftpd.pem -out /etc/ssl/private/vsftpd.pem

The vsftp service is enabled and running.

I have ufw running as a firewall with the following rules:

Status: active
To                         Action      From
--                         ------      ----
OpenSSH                    ALLOW       Anywhere                  
20/tcp                     ALLOW       Anywhere                  
21/tcp                     ALLOW       Anywhere                  
80/tcp                     ALLOW       Anywhere                  
8080:8099/tcp              ALLOW       Anywhere                  
40000:50000/tcp            ALLOW       Anywhere                  
5432/tcp                   ALLOW       Anywhere                  
OpenSSH (v6)               ALLOW       Anywhere (v6)             
20/tcp (v6)                ALLOW       Anywhere (v6)             
21/tcp (v6)                ALLOW       Anywhere (v6)             
80/tcp (v6)                ALLOW       Anywhere (v6)             
8080:8099/tcp (v6)         ALLOW       Anywhere (v6)             
40000:50000/tcp (v6)       ALLOW       Anywhere (v6)             
5432/tcp (v6)              ALLOW       Anywhere (v6) 

I created my FTP user as follows:

sudo /sbin/useradd --home /ftp/<user>/in --password <password> --shell /bin/bash <user>

I've added a line to the /etc/ssh/sshd_config file to disallow SSH for the FTP user as below, and then restarted the sshd service

DenyUsers <user>

I've updated the permissions of the FTP folder as follows:

sudo chown <user>:<user> /ftp/<user>/in/<folder-name>
sudo chmod 750 /ftp/<user>/in/<folder-name>

When I attempt to connect to the FTP using the FTP user, I get "530 Login incorrect".

Status: Disconnected from server
Status: Connecting to <ip>:21...
Status: Connection established, waiting for welcome message...
Status: Initializing TLS...
Status: TLS connection established.
Command:    USER affinity
Response:   331 Please specify the password.
Command:    PASS ****************
Response:   530 Login incorrect.
Error:  Critical error: Could not connect to server

And the /var/log/vsftpd.log file:

Mon Jun  6 19:10:51 2022 [pid 8417] CONNECT: Client "::ffff:172.24.8.13"
Mon Jun  6 19:10:52 2022 [pid 8409] [<user>] FAIL LOGIN: Client "::ffff:172.24.8.13"
Mon Jun  6 19:10:54 2022 [pid 8417] DEBUG: Client "::ffff:172.24.8.13", "Control connection terminated without SSL shutdown."

What is extremely interesting and definitely noteworthy is that I've followed the EXACT same process as listed above on a Debian 10 Linux server, which is working perfectly. However, I've replicated this process on TWO different Ubuntu servers, and both five the same error.

Debugging

I've tried updating the vsftpd.conf to set "ssl_enable=NO" and commenting out the related configuration lines below that, then restarting vsftpd, but with no luck.

I've tried to connect with the FTP user with the ufw firewall enabled and with it disabled, but I get the same 530 error both times.

I've checked that the FTP user is NOT in /etc/ftpusers.

I've checked that the FTP user IS in /etc/passwd

Image: /etc/passwd file contents show FTP user with the /bin/bash shell

I've tried updating the vsftpd.conf file to change the following line from vsftpd to ftp according to this post, but with no luck. I've since reverted this to vsftpd.

pam_service_name=ftp

I've checked that the FTP user's login shell (/bin/bash) IS in /etc/shells.

I've tried commenting out each line individually, and all of the lines in the in the PAM file (/etc/pam.d/vsftpd), and removing the PAM file altogether, and restarting vsftpd each time, but with no luck. This is what the PAM file currently contains:

# Standard behaviour for ftpd(8).
auth    required        pam_listfile.so item=user sense=deny file=/etc/ftpusers onerr=succeed

# Note: vsftpd handles anonymous logins on its own. Do not enable pam_ftp.so.

# Standard pam includes
@include common-account
@include common-session
@include common-auth
auth    required        pam_shells.so

I've also tried to replace the PAM file with the suggestion given by the accepted answer in this article, but with no luck. I have since reverted the PAM file back to what the above configuration.

According to the same post, I've tried to add "seccomp_sandbox=NO" to vsftpd.conf, but with no luck.

I've tried removing the denyUsers line from /etc/ssh/sshd_config just in case, but that didn't make a difference.

As a last resort I uninstalled and then re-installed vsftpd according to this article, but that did not help.

sudo apt-get remove vsftpd
sudo rm /etc/pam.d/vsftpd
sudo apt-get install vsftpd

After every configuration change I try, I am certain that I restart the services to ensure that change takes effect!

Here's a list of a few posts I've gone through, but this is by no means and exhaustive list (i've been at this for a few days now)

I am out of ideas now having gone through as many questions and answers as possible. If anyone can help me, that would be much appreciated!

4
  • How are you generating the encrypted password required by useradd? Jun 6, 2022 at 19:40
  • @steeldriver it's a 16 character password with symbols, letters and numbers, generated from my head. On this noted, I tried changing the password to "test" using usermod, but that didn't work either. Jun 6, 2022 at 19:48
  • OK but you'd need to pass the encrypted version of that to useradd --password. See for example password does not work with useradd -p Jun 6, 2022 at 19:51
  • Wow - you nailed it @steeldriver, thanks so much! I used sudo passwd <user> as the link suggested. It now works! Jun 6, 2022 at 20:01

2 Answers 2

0

As pointed out by @steeldriver, I needed to set the encrypted version of my password, instead of setting it in free text.

In other words, all I needed to do was run sudo passwd <user> and then paste my password into the shell when prompted.

0

For me the solution was that some of the includes in /etc/pam.d/vsftpd contained a requirement for fingerprint... so this could not work as my ftp user cannot enter or register a fingerprint

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .