Skip to content

Three steps to set up vsftpd

Configuring a read-only vsftpd service with virtual users on Debian.

Published
Reading time
5 min read

This guide explains how I configured a read-only FTP service with vsftpd and virtual users. The example covers chrooting, TLS settings, transfer logs, and PAM authentication.

Update: Step 2 now highlights the configuration values that must be adapted to each environment.

1. Install

Log in to the server, obtain the required administrative privileges, and install vsftpd. This example uses Debian Lenny; consult the operating system’s documentation for other installation methods. More information about the server is available at vsftpd.beasts.org.

$ aptitude install vsftpd

2. Configure

The default /etc/vsftpd.conf contains extensive explanatory comments. I created a shorter configuration based on that file and exposed several additional options.

The example implements the following scenario:

  • A standalone FTP server allows one or more users to access a single directory.
  • The server denies anonymous access and disables writes for every user.
  • Virtual users have separate passwords without exposing system accounts to FTP.
  • Every virtual user maps to one low-privilege system account with read-only access to the exposed directory.
  • An htpasswd file manages the virtual users through the modified /etc/pam.d/vsftpd configuration shown in step 3.

Some options are not required for this exact scenario. This is the general vsftpd.conf that I kept readable and adaptable.

The important values to adjust are:

  • local_root identifies the directory that the service exposes.
  • guest_username identifies the low-privilege account to which virtual users map; the example uses vsftp.
# Run the server in standalone mode
listen=YES

# Allow anonymous FTP? This will enable/disable all subsequent anonymous options
anonymous_enable=NO

# Allow anonymous users to upload files?
anon_upload_enable=NO

# Allow anonymous users to create directories?
anon_mkdir_write_enable=NO

# Allow local users to log in? (Is needed even in case of a virtual setup)
local_enable=YES

# Restrict local users to their home directories
chroot_local_user=YES

# Specify a user token
user_sub_token=$USER

# Treat all non-anonymous logins as 'guest' logins
guest_enable=YES

# Specify a system user to map 'guest' logins
guest_username=vsftp

# Enable if virtual users shall use the same privileges as locals (default: NO)
virtual_use_local_privs=NO

# Hide user/group information of files and directories
hide_ids=YES

# Specify a directory to where users get chroote'd
local_root=/var/ftp_data

# Enable SSL, this will affect all subsequent ssl options
ssl_enable=NO

# Allow SSL for anonymous users
allow_anon_ssl=NO

# Require SSL for all non-anonymous data transfers
force_local_data_ssl=YES

# Require SSL for all non-anonymous logins
force_local_logins_ssl=YES

# Enable TLS v1 protocol connections
ssl_tlsv1=YES

# Enable SSL v2 protocol connections
ssl_sslv2=YES

# Enable SSL v3 protocol connections
ssl_sslv3=YES

# Specify a RSA certificate file to use for encrypted connections
rsa_cert_file=/etc/vsftpd.d/vsftpd.pem

# Allow any form of write command?
write_enable=NO

# Enable directory messages
dirmessage_enable=NO

# Enable transfer logs, you can specify a log file and if the xferlog format shall be used
xferlog_enable=YES
#xferlog_file=/var/log/vsftpd.log
#xferlog_std_format=YES

# Allow PORT transfer connections only from the following port (default: 20)
connect_from_port_20=YES

# Chown all created files to a specific username
chown_uploads=NO
chown_username=whoever

# When to time out an idle session? (default: 600)
#idle_session_timeout=600

# When to time out a data connection? (default: 120)
#data_connection_timeout=120

# Define a totally isolated and unprivileged user
#nopriv_user=ftpsecure

# Enable asynchronous ABOR requests for backwards compability of older clients
#async_abor_enable=YES

# Enable ASCII mangling to really happen
# Not recommended
#ascii_upload_enable=YES
#ascii_download_enable=YES

# Customize your banner
#ftpd_banner=Welcome to blah FTP service.

# Enable a anonymous e-mail blacklist
#deny_email_enable=YES
#banned_email_file=/etc/vsftpd.banned_emails

# Specify a list of local users to chroot to their home directory.
# This options may become a list of users NOT to chroot if chroot_local_user is YES!
#chroot_list_enable=YES
#chroot_list_file=/etc/vsftpd.chroot_list

# Enable recursive ls, may cause excessive I/O on large sites
# Not recommended
#ls_recurse_enable=YES

## Debian customization

# Specify an empty directory to chroot vsftpd at times it doesn't require filesystem access
secure_chroot_dir=/var/run/vsftpd

# Specify a PAM service name to use, see /etc/pam.d/ for pam services
pam_service_name=vsftpd

# Specify a RSA certificate to use for SSL encrypted connections
rsa_cert_file=/etc/ssl/certs/vsftpd.pem

3. Manage

I manage virtual users in a file created with htpasswd. On Debian, that utility comes from the apache2-utils package and may need to be installed separately.

$ aptitude install apache2-utils

With the utility installed, create the FTP user file:

$ mkdir /etc/vsftpd.d
$ htpasswd -c /etc/vsftpd.d/users billythekid
# note: for other users to add you have to ommit the -c flag

vsftpd does not know about this file automatically. Configure /etc/pam.d/vsftpd to use it:

# Login using a htpasswd file
auth    required pam_pwdfile.so pwdfile /etc/vsftpd.d/users
account required pam_permit.so

On my machine, I also had to run $ aptitude install libpam-pwdfile. Restart vsftpd to load the new configuration. If the firewall permits the required FTP ports, the newly created virtual user should then be able to log in.

$ /etc/init.d/vsftpd restart

Credits

These resources helped me write the article: