0

I'm using a Digital Ocean droplet (Ubuntu 14.04.3) to create a temporary ftp server to get some data (it doesn't need security). I've set up vsftpd so that access is given to regular chrooted users on the system. I also created just one regular user (ftpuser) using the adduser command.

The problem is that I can ftp using the ftpuser without issue but within 24 hours something happens to the user password and then I can no longer login. If ssh into the system as root and do a passwd ftpuser and change the password to what I was using before - then it works fine for the next 24 hours and once again - it doesn't work anymore.

This is driving me completely crazy because it doesn't make any sense.

Here are details of configuration:

vsftpd.conf:
listen=YES
local_enable=YES
write_enable=YES
dirmessage_enable=YES
use_localtime=YES
xferlog_enable=YES
connect_from_port_20=YES
chroot_local_user=YES
#pam_service_name=vsftpd
pam_service_name=ftp

I've also updated Ubuntu with the latest security patches fwiw.

Improve this question

1 Answer 1

Reset to default
0

The simple answer, is you need to reinitialize that ubuntu instance. Assuming it's a base build that you pick from a list, this should go quickly. It may be a pain to re-configure, but recovery from a security breach is even more troublesome. Passwords do not change themselves. Thelinux distros I've used do not change passwords autonomously. It takes interaction with the passwd program, or a scripted process to alter a password. Ubuntu has no out of the box functionality that would change a users password.

The more complicated answer lies down two possible approaches. 1. Your hosting provider almost always has a user with sudo, or access to root. It is possible to run a routine that checks hashes against a rainbow table (defined dictionary of insecure password hashes) and if a weak one is found, set it to a randomly generated password. I don't currently recall, but I think this functionality is present in cpanel, as an option.

  1. An agent, either a user or a third party is resetting it and not communicating that with you. Passwords generally can't be changed using a file transfer protocol, unless they can write to the password file and that's not default behavior.

If you re-initialize the instance/droplet - find out if you can install some intrusion detection. https://www.sans.org/security-resources/idfaq/what_is_hips.php This will tell you if there is some malfeasance going on.

Generally, FTP is not secure, even though it is SFTP you're running. scp/ssh is a better solution, but more complicated to setup. A huge swath of the results I've examined from various HIDS show FTP (21) as a probed target.

Best Regards, Vincent

Improve this answer
1
  • Hi Vincent - thanks for the comprehensive answer. I was using 'ftpuser' as the password too assuming that an IP based host would not be found. That was complete stupidity on my part. When I put a decent password for the ftpuser - the password was not changed, so your suspicion that something was logging in and changing it is quite likely to be the correct issue. I'll start from scratch per your suggestion. Once again - thank you.
    – Eli
    Commented Nov 3, 2015 at 2:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .