=============================
VSFTPD 1.1 - Very Secure FTP Daemon LDUP: 29-Aug-2k4
by Mischty
=============================
Other FTP servers : WU-FTPD, Pro-FTP etc etc
Config files : 1. /etc/vsftpd/[Link]
/etc/vsftpd.chroot_list
2. /etc/vsftpd_users
3. /etc/vsftpd.user_list
/etc/vsftpd.banned_emails
GUI Client: gftp
CLI Client: ftp
-----------------------
/etc/vsftpd/[Link]
-----------------------
* vsftpd is PARANIOD! By default it allows almost nothing.
* Note: DO not use a space before or after the '='. It is an error !
VSFTPD WILL REFUSE TO START !
* Note: All directives should start from column 1 or else error !
VSFTPD WILL REFUSE TO START !
* If there is an error in a directive [misspelling], the vsftpd
daemon will fail to start or die on you. So, watch out!
* vsftp has a wealth of config options.
Lets look at some 28 of them.
Three types of FTP users :
1. Real user - in which you see : /home/foo and can go anywhere
and can even DL your passwd file
2. Guest user - in which you see : / and can go nowhere
The user is chroot'd to his home and will always see /
Cannot go anywhere ! Called a FTP chroot jail
Both the above are VLUs
Both will see their homes
3. Anonymous FTP user - Not a VLU
Will be logged in as user : ftp/ftp 14:50
Home will be : /var/ftp/
List of Directives covered :
----------------------------------
A. Directives for anonymous logins
----------------------------------
1 anonymous_enable=YES
2 no_anon_password=NO
3 anon_root=(none)
4 ftp_username=ftp
-----------------------------------------
B. Directives for VLU [Real/Guest] logins
-----------------------------------------
5 local_enable=NO
6 write_enable=NO
7 chroot_local_user=NO
8 local_root=no default
9 chroot_list_enable=NO
10 chroot_list_file=/etc/vsftpd.chroot_list
---------------------------------
C. Ports / Connections / TimeOuts
---------------------------------
11 listen=no
12 listen_port=21
13 listen_address=default none
14 tcp_wrappers=NO
15 max_clients=0 [unlimited]
16 max_per_ip=0 [unlimited]
17 data_connection_timeout=300
18 idle_session_timeout=300
-----------------------
D. Banners and Messages
----------------------
19 ftpd_banner=(none - default vsftpd banner is displayed)
20 banner_file=(none) Set to some filename
-----------------------------
E. Fine-Tuning Access Control
-----------------------------
21 userlist_enable=NO
22 userlist_file=/etc/vsftp.user_list
23 userlist_deny=YES
24 user_config_dir=(none) or somedir/
----------
F. Logging
----------
25 xferlog_enable=NO
26 xferlog_file=/var/log/[Link]
27 xferlog_std_format=NO
----------------
G. Miscellaneous
----------------
28 pam_service_name=vsftpd
*******************************************************************************
Now lets examine them one by one !
By functionality !
************************
----------------------------------
A. Directives for anonymous logins
----------------------------------
1 anonymous_enable=YES
2 no_anon_password=NO
3 anon_root=(none)
4 ftp_username=ftp
1. anonymous_enable=YES
Allow anon logins or not.
ftp' and 'anonymous' are VLUs for anonymous.
All other anonymous-based directives [which follow] are obviously
rendered useless, if this is set to 'NO'
Def: Yes
2. no_anon_password=NO
If yes, anonymous users can log straight in without a password
3. anon_root=/win Def: none
On anonymous login, vsftpd will change over to this /win directory
instead of the def: /var/ftp/.
Note : If /win is world writeable or not owned by root, then failure!
Other failures are silently ignored.
4. ftp_username=ftp
This is the name of the user we use for handling anonymous FTP.
The home directory of this user is the root of the anonymous FTP area.
-----------------------------------------
B. Directives for VLU [Real/Guest] logins
-----------------------------------------
5 local_enable=NO
6 write_enable=NO
7 chroot_local_user=NO
8 local_root=no default
9 chroot_list_enable=NO
10 chroot_list_file=/etc/vsftpd.chroot_list
5. local_enable=NO If this is not YES, no VLU allowed in. Server is anon
Controls whether local logins are permitted or not. If enabled, normal user
accounts [Real] in /etc/passwd may be used to log in.
This means, by default, vsftpd only allows anon users in.
Wonderfully Paraniod!
VSFPTD is now an Anonymous FTP server, by default !
6. write_enable=NO
For any type of FTP write command, this should be YES
If enabled, allows file uploads. VLU's and anon ftp users [ftp 14:50]
must,then, have write permission on the upload dir. def: /var/ftp/
7. chroot_local_user=NO
If set to YES, VLUs will be placed in a chroot() jail in their home dir.
after login. BUT....
IMP:
====
If set to YES, and [#18] "chroot_list_enable=YES" which obviously implies
that [#12] "chroot_list_file=/etc/vsftpd.chroot_list" is searched.
Then the meaning is the opposite. Users on this file-list WILL NOT be put
in a chroot [their HOME] jail.
Warning: This option has security implications, especially if the users
have upload permission, or shell access. Only enable if you know what you
are doing.
Note that these security implications are not vsftpd specific. They
apply to all FTP daemons which offer to put local users in chroot() jails.
08 local_root=none
This option represents a directory which vsftpd will try to change to after
a local (i.e. non-anonymous) login. Not chroot'd
Failure is silently ignored.
Similar in function to anon_root [#3]
09 chroot_list_enable=NO
If activated, you may provide a list of local VLUs who are placed in a
chroot() jail in their home directory upon login.
The meaning is slightly different if "chroot_local_user" is set to YES.
IMP: [See #9] above
====
In this case, the list becomes a list of users which are NOT to be placed
in a chroot() jail.
By default, the file containing this list is /etc/vsftpd.chroot_list,
but you may override this with the chroot_list_file setting.
10 chroot_list_file=/etc/vsftpd.chroot_list
The option is the name of a file containing a list of local users which
will be placed in a chroot() jail in their home directory.
This option is only relevant if the option [#17] chroot_list_enable
is enabled, and the option [#9] chroot_local_user is disabled.
---------------------------------
C. Ports / Connections / TimeOuts
---------------------------------
11 listen=no
12 listen_port=21
13 listen_address=default none
14 tcp_wrappers=NO
15 max_clients=0 [unlimited]
16 max_per_ip=0 [unlimited]
17 data_connection_timeout=300
18 idle_session_timeout=300
11 listen=no
If enabled, vsftpd will run in standalone mode.
vsftpd will then take care of listening for and handling incoming
connections on 20/21 ports
12 listen_port=21
If vsftpd is in standalone mode, which is always the case, this is the port
it will listen on for incoming FTP connections.
13 listen_address=default none
To make vsftpd non-promiscuous and listen on only one IP address.
If vsftpd is in standalone mode, the default listen address (of all local
interfaces) may be overridden by this setting.
Provide a numeric IP address.
14 tcp_wrappers=NO
If enabled, and vsftpd was compiled with tcp_wrappers support, incoming
connections will be fed through tcp_wrappers access control. Furthermore,
there is a mechanism for per-IP based configuration. If tcp_wrappers sets
the VSFTPD_LOAD_CONF environment variable, then the vsftpd session will try
and load the vsftpd configuration file specified in this variable.
15 max_clients=0 [unlimited]
If vsftpd is in standalone mode, this is the maximum number of clients which
may be connected. Any additional clients connecting will get an error message.
16 max_per_ip=0 [unlimited]
If vsftpd is in standalone mode, this is the maximum number of clients which
may be connected from the same source internet address. A client will get an
error message if they go over this limit. To prevent DOS.
17 data_connection_timeout=300
The timeout, in seconds, which is roughly the maximum time we permit data
transfers to stall for with no progress. If the timeout triggers, the remote
client is disconnected.
18 idle_session_timeout=300
The timeout, in seconds, which is the maximum time a remote client may
spend between FTP commands. If the timeout triggers, the remote client is
disconnected.
-----------------------
D. Banners and Messages
-----------------------
19 ftpd_banner=(none - default vsftpd banner is displayed)
20 banner_file=(none) Set to some filename
19 ftpd_banner=(none - default vsftpd banner is displayed)
This string option allows you to override the greeting banner
displayed by vsftpd when a connection first comes in.
20 banner_file=(none) Set to some filename
This option is the name of a file containing text to display
when someone connects to the server. If set, it overrides the
banner string provided by the 'ftpd_banner' option.
-----------------------------
E. Fine-Tuning Access Control
-----------------------------
21 userlist_enable=NO
22 userlist_file=/etc/vsftp.user_list
23 userlist_deny=YES
24 user_config_dir=(none) or somedir/
21 userlist_enable=NO
If YES, all users listed in the file pointed to by the 'userlist_file='
directive will be DENIED ACCESS even before they are asked for a
password.
22 userlist_file=/etc/vsftpd.user_list
Filename examined only when 'userlist_enable=YES'.
23 userlist_deny=YES
If set to NO, then exactly the reverse of the above takes place.
All users listed in the above file will ONLY be allowed access.
ALL OTHERS WILL BE DENIED ACCESS.
This option is examined only if 'userlist_enable' is YES.
24 user_config_dir=(none)
An example will make this very powerful directive clear. It
basically allows a user to have his/her very own
/etc/vsftpd/[Link] file.
That is, a per-user basis special config file.
[Reminds one of the 'config file=[Link].%m' directive in Samba]
Let do this :
1. Create a subdir :
# mkdir /etc/vadapav/
2. Create your very own config file with your per-foo directives
for foo :
# vi /etc/vadapav/swarup
3. Put the following directive in /etc/vsftpd/[Link]
user_config_dir=/etc/vadapav/
4. Restart vsftpd.
5. Now log in as user 'swarup'.
vsftpd will load and use the settings in
/etc/vadapav/foo
for the duration of the session.
The format of this 'foo' file is in line with the normal
/etc/vsftpd/[Link] file.
Similar to 'config file' directive in Samba
----------
F. Logging
----------
25 xferlog_enable=NO
26 xferlog_file=/var/log/[Link]
27 xferlog_std_format=NO
25 xferlog_enable=NO <---- No logging done if this is NO --->
If you leave this as NO - the default - then NO logging will take place.
If Yes, all uploads/downloads will be placed in /var/log/[Link].
You can override this using 'xferlog_file=filename"
Note : Default: NO (but the sample config file by RedHat enables it)
26 xferlog_file=/var/log/[Link]
This option is the name of the file to which we write the transfer log.
The transfer log is only written if the above option 'xferlog_enable=Yes'.
27 xferlog_std_format=NO
Def: No Generates logs in vsftpd's own format
If Yes, generates logs in xferlog log format. You can use Apache/SQUID
log analyzers then
----------------
G. Miscellaneous
----------------
28 pam_service_name=vsftpd
28 pam_service_name=vsftpd
This string is the name of the PAM service vsftpd will use.
Note : The manual specifies 'ftp' which is wrong - It is 'vsftpd'
****************************
