[vsftp] User logins, need help.

Hyakutake · 06-16-2007, 06:41 PM

Hello all.

I've been messing around with vsftp and wanted to make it more secure.

My goal is:
No anonymous logins
Only 1 or 2 users allowed to log.

I've been following this README on virtual users.

1st question:

I have generated the pam file but I don't know where to put it (README points to /etc/pam.d/ftp which does not exist)

Code:

db_load -T -t hash -f logins.txt /etc/vsftpd_users.db

2nd question:

Is any other I can do this (virtual users) in some other way (without PAM)?

Here is my vsftpd.conf:

Code:

anonymous_enable=NO
local_enable=YES
write_enable=NO
local_umask=022
anon_upload_enable=NO
anon_mkdir_write_enable=NO
anon_other_write_enable=NO
dirmessage_enable=YES
xferlog_enable=YES
connect_from_port_20=YES
xferlog_file=/var/log/vsftpd.log
xferlog_std_format=YES
idle_session_timeout=600
data_connection_timeout=120
nopriv_user=ftp
ftpd_banner=YES
banner_file=/etc/vsftpd.banner
ls_recurse_enable=YES
listen=YES
chroot_local_user=YES
guest_enable=YES
guest_username=ftp
download_enable=YES

I've also have vsftpd_users.db and vsftpd.pam in /etc

Please help me out on this.

Thanks,
Hyakuake

erklaerbaer · 06-17-2007, 06:10 AM

slackware does not use pam anywhere, so that path is closed for you.
i don't even see how only allowing two users at once would make your site more secure. however, have you seen this?

Quote:

max_clients
If vsftpd is in standalone mode, this is the maximum number of
clients which may be connected. Any additional clients connecting
will get an error message.

Default: 0 (unlimited)

Hyakutake · 06-17-2007, 07:41 AM

Hi, erklaerbaer, thanks for your reply.

The security is password protected users.

Code:

from manpage (vsftpd.conf)

local_enable
    Controls whether local logins are permitted or not. If enabled, normal user accounts in /etc/passwd may be used to log in.

    Default: NO

I don't want to user normal user accounts, I wanted "virtual users".

Code:

from README

A virtual user is a user login which does not exist as a real login on the
system. Virtual users can therefore be more secure than real users, beacuse
a compromised account can only use the FTP server.

How can I accomplish this?