I know this issue has been asked and answered numerous times, but I have followed every question and answer I can find with no luck, hence asking the question to the community again, hoping that someone can spot my issue.
Install and Setup Process
My operating system is Ubuntu 20.04.4 LTS.
I have installed vsftpd and updated the configuration file (/etc/vsftpd.conf) as follows:
# Run standalone
listen=NO
# Enables listening on IPv6 sockets
listen_ipv6=YES
# Allow anonymous FTP
anonymous_enable=NO
# Allow local users to log in
local_enable=YES
# Enable any form of FTP write command.
write_enable=YES
# Default umask for local users is 022 to give uploaded files and folders the correct permissions
local_umask=022
# Activate directory messages - messages given to remote users when they go into a certain directory.
dirmessage_enable=YES
# Display directory listings in local time zone
use_localtime=YES
# Activate logging of uploads/downloads.
xferlog_enable=YES
# Make sure PORT transfer connections originate from port 20 (ftp-data).
connect_from_port_20=YES
# Display login banner:
ftpd_banner=Welcome to the FTP service!
# Specify an explicit list of local users to chroot() to their homedirectory
chroot_local_user=YES
# Set a secure chroot() jail at times vsftpd does not require filesystem
secure_chroot_dir=/var/run/vsftpd/empty
# This string is the name of the PAM service vsftpd will use
pam_service_name=vsftpd
# Encrypted connections
ssl_enable=YES
rsa_cert_file=/etc/ssl/private/vsftpd.pem
rsa_private_key_file=/etc/ssl/private/vsftpd.pem
allow_anon_ssl=NO
force_local_data_ssl=YES
force_local_logins_ssl=YES
ssl_tlsv1=YES
ssl_sslv2=NO
ssl_sslv3=NO
require_ssl_reuse=NO
ssl_ciphers=HIGH
#
# Additional configuration
force_dot_files=YES
userlist_deny=NO
userlist_enable=YES
userlist_file=/etc/vsftpd.userlist
pasv_min_port=40000
pasv_max_port=50000
I've added the user to the /etc/vsftpd.userlist file and generated the certificate as follows:
sudo openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/ssl/private/vsftpd.pem -out /etc/ssl/private/vsftpd.pem
The vsftp service is enabled and running.
I have ufw running as a firewall with the following rules:
Status: active
To Action From
-- ------ ----
OpenSSH ALLOW Anywhere
20/tcp ALLOW Anywhere
21/tcp ALLOW Anywhere
80/tcp ALLOW Anywhere
8080:8099/tcp ALLOW Anywhere
40000:50000/tcp ALLOW Anywhere
5432/tcp ALLOW Anywhere
OpenSSH (v6) ALLOW Anywhere (v6)
20/tcp (v6) ALLOW Anywhere (v6)
21/tcp (v6) ALLOW Anywhere (v6)
80/tcp (v6) ALLOW Anywhere (v6)
8080:8099/tcp (v6) ALLOW Anywhere (v6)
40000:50000/tcp (v6) ALLOW Anywhere (v6)
5432/tcp (v6) ALLOW Anywhere (v6)
I created my FTP user as follows:
sudo /sbin/useradd --home /ftp/<user>/in --password <password> --shell /bin/bash <user>
I've added a line to the /etc/ssh/sshd_config file to disallow SSH for the FTP user as below, and then restarted the sshd service
DenyUsers <user>
I've updated the permissions of the FTP folder as follows:
sudo chown <user>:<user> /ftp/<user>/in/<folder-name>
sudo chmod 750 /ftp/<user>/in/<folder-name>
When I attempt to connect to the FTP using the FTP user, I get "530 Login incorrect".
Status: Disconnected from server
Status: Connecting to <ip>:21...
Status: Connection established, waiting for welcome message...
Status: Initializing TLS...
Status: TLS connection established.
Command: USER affinity
Response: 331 Please specify the password.
Command: PASS ****************
Response: 530 Login incorrect.
Error: Critical error: Could not connect to server
And the /var/log/vsftpd.log file:
Mon Jun 6 19:10:51 2022 [pid 8417] CONNECT: Client "::ffff:172.24.8.13"
Mon Jun 6 19:10:52 2022 [pid 8409] [<user>] FAIL LOGIN: Client "::ffff:172.24.8.13"
Mon Jun 6 19:10:54 2022 [pid 8417] DEBUG: Client "::ffff:172.24.8.13", "Control connection terminated without SSL shutdown."
What is extremely interesting and definitely noteworthy is that I've followed the EXACT same process as listed above on a Debian 10 Linux server, which is working perfectly. However, I've replicated this process on TWO different Ubuntu servers, and both five the same error.
Debugging
I've tried updating the vsftpd.conf to set "ssl_enable=NO" and commenting out the related configuration lines below that, then restarting vsftpd, but with no luck.
I've tried to connect with the FTP user with the ufw firewall enabled and with it disabled, but I get the same 530 error both times.
I've checked that the FTP user is NOT in /etc/ftpusers.
I've checked that the FTP user IS in /etc/passwd
Image: /etc/passwd file contents show FTP user with the /bin/bash shell
I've tried updating the vsftpd.conf file to change the following line from vsftpd to ftp according to this post, but with no luck. I've since reverted this to vsftpd.
pam_service_name=ftp
I've checked that the FTP user's login shell (/bin/bash) IS in /etc/shells.
I've tried commenting out each line individually, and all of the lines in the in the PAM file (/etc/pam.d/vsftpd), and removing the PAM file altogether, and restarting vsftpd each time, but with no luck. This is what the PAM file currently contains:
# Standard behaviour for ftpd(8).
auth required pam_listfile.so item=user sense=deny file=/etc/ftpusers onerr=succeed
# Note: vsftpd handles anonymous logins on its own. Do not enable pam_ftp.so.
# Standard pam includes
@include common-account
@include common-session
@include common-auth
auth required pam_shells.so
I've also tried to replace the PAM file with the suggestion given by the accepted answer in this article, but with no luck. I have since reverted the PAM file back to what the above configuration.
According to the same post, I've tried to add "seccomp_sandbox=NO" to vsftpd.conf, but with no luck.
I've tried removing the denyUsers line from /etc/ssh/sshd_config just in case, but that didn't make a difference.
As a last resort I uninstalled and then re-installed vsftpd according to this article, but that did not help.
sudo apt-get remove vsftpd
sudo rm /etc/pam.d/vsftpd
sudo apt-get install vsftpd
After every configuration change I try, I am certain that I restart the services to ensure that change takes effect!
Here's a list of a few posts I've gone through, but this is by no means and exhaustive list (i've been at this for a few days now)
- https://serverfault.com/questions/964773/vsftpd-error-530-login-incorrect-and-various-others-when-trying-other-solution
- vsftpd: 530 Login incorrect
- https://serverfault.com/questions/364935/vsftp-login-errors-530-login-incorrect
- vsftpd login incorrect issue
- 530 Login incorrect vsftpd
I am out of ideas now having gone through as many questions and answers as possible. If anyone can help me, that would be much appreciated!
useradd?usermod, but that didn't work either.useradd --password. See for example password does not work with useradd -psudo passwd <user>as the link suggested. It now works!