LinuxQuestions.org
Register a domain and help support LQ
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices


Reply
  Search this Thread
Old 08-16-2011, 12:29 PM   #1
Carnix
LQ Newbie
 
Registered: Aug 2011
Posts: 10

Rep: Reputation: Disabled
Question VSFTPD for Dummies


I've searched Google and trawled threads for a couple days now and followed probably 10 different tutorials, none of which seem to work... I haven't been able to find anything that seems to fit my use case anyway.

Here's the issue.

I am trying to set up an in-house development environment for Drupal 7. I have to use Redhat 5. I was able to get MySQL working and Drupal 7 installed and all that (in /var/www/html --> might change that, would love recommendations).

Now, I'm trying to get an FTP server working so the other members of my team can access the site. VSFTPD seems the logical choice but I've not been able to get it to work right.

Here's the requirements:
1. Single FTP user - don't need each user to use a separate login.
2. User must have full control over the files, be able to create directories, upload/download files, change files, etc.
3. User should see their home directory as / -- so not /home/user or whatever.
4. Anon user should be disabled.

At this point, I have a fresh vanilla install of vsftpd.

I'm not a total linux noob, but for some reason I'm completely unable to make this work so I feel like one about now...

Thanks!
 
Old 08-17-2011, 06:04 AM   #2
lithos
Senior Member
 
Registered: Jan 2010
Location: SI : 45.9531, 15.4894
Distribution: CentOS, OpenNA/Trustix, testing desktop openSuse 12.1 /Cinnamon/KDE4.8
Posts: 1,144

Rep: Reputation: 217Reputation: 217Reputation: 217
If you want, you could use my guide

good luck.
 
Old 08-17-2011, 09:13 AM   #3
Carnix
LQ Newbie
 
Registered: Aug 2011
Posts: 10

Original Poster
Rep: Reputation: Disabled
Unhappy MySQL

Interestingly, that was one of the pages I found and tried to follow without any luck... I followed the steps exactly, but in the end I was unable to authenticate any of the users I created. I *think* vsftpd started though. I figured there must have been some small difference with CentOS that caused it to fail.

I'd love to try again though if you'd be willing to help me troubleshoot since frankly managing with MySQL would be vastly preferable to local users anyway for a number of administrative and security reasons.
 
Old 08-17-2011, 11:29 AM   #4
Carnix
LQ Newbie
 
Registered: Aug 2011
Posts: 10

Original Poster
Rep: Reputation: Disabled
I tried again after removing the database and reinstalling vsftpd fresh. I went through the whole process and the only thing that seemed to be wrong was the following. I downloaded a RH5 build of pam_mysql from pbone, no problem. I installed it, seemingly no problem. But when I checked the ls, it's not there (bold and red below).


[mlangford@us-pghwwwstg1 ~]$ wget ftp://ftp.pbone.net/mirror/download....5.2.x86_64.rpm
--2011-08-17 11:15:24-- ftp://ftp.pbone.net/mirror/download....5.2.x86_64.rpm
=> `pam_mysql-0.7-0.4.rc1.el5.2.x86_64.rpm'
Resolving ftp.pbone.net... 85.14.85.4
Connecting to ftp.pbone.net|85.14.85.4|:21... connected.
Logging in as anonymous ... Logged in!
==> SYST ... done. ==> PWD ... done.
==> TYPE I ... done. ==> CWD /mirror/download.fedora.redhat.com/pub/fedora/epel/5/x86_64 ... done.
==> SIZE pam_mysql-0.7-0.4.rc1.el5.2.x86_64.rpm ... 39533
==> PASV ... done. ==> RETR pam_mysql-0.7-0.4.rc1.el5.2.x86_64.rpm ... done.
Length: 39533 (39K)

100%[==================================================================================================== =========================>] 39,533 68.3K/s in 0.6s

2011-08-17 11:15:27 (68.3 KB/s) - `pam_mysql-0.7-0.4.rc1.el5.2.x86_64.rpm' saved [39533]

[mlangford@us-pghwwwstg1 ~]$ rpm -Uvh pam_mysql-0.7-0.5.rc1.el5.kb.2.i386.rpm
[mlangford@us-pghwwwstg1 ~]$ pam_mysql-0.7-0.4.rc1.el5.2.x86_64.rpm
[mlangford@us-pghwwwstg1 ~]$ rpm -Uvh pam_mysql-0.7-0.4.rc1.el5.2.x86_64.rpm
error: can't create transaction lock on /var/lib/rpm/__db.000
[mlangford@us-pghwwwstg1 ~]$ sudo rpm -Uvh /home/mlangford/pam_mysql-0.7-0.4.rc1.el5.2.x86_64.rpm
Preparing... ########################################### [100%]
1:pam_mysql ########################################### [100%]
[mlangford@us-pghwwwstg1 ~]$ sudo ls -al /lib/security/pam_m*
-rwxr-xr-x 1 root root 10240 Oct 21 2010 /lib/security/pam_mail.so
-rwxr-xr-x 1 root root 15880 Oct 21 2010 /lib/security/pam_mkhomedir.so
-rwxr-xr-x 1 root root 3892 Oct 21 2010 /lib/security/pam_motd.so



As a result, when I try to connect via FTP (using FileZilla):
Response: 220 (vsFTPd 2.0.5)
Command: USER drupal
Response: 331 Please specify the password.
Command: PASS *******
Response: 530 Login incorrect.
Error: Critical error
Error: Could not connect to server

Last edited by Carnix; 08-17-2011 at 11:30 AM. Reason: (removed silly emoticons from text)
 
Old 08-17-2011, 11:46 AM   #5
Carnix
LQ Newbie
 
Registered: Aug 2011
Posts: 10

Original Poster
Rep: Reputation: Disabled
Found it - this is a 64-bit machine, so.. duh.

[mlangford@us-pghwwwstg1 /]$ sudo ls -al /lib64/security/pam_m*
-rwxr-xr-x 1 root root 11120 Oct 21 2010 /lib64/security/pam_mail.so
-rwxr-xr-x 1 root root 17208 Oct 21 2010 /lib64/security/pam_mkhomedir.so
-rwxr-xr-x 1 root root 5024 Oct 21 2010 /lib64/security/pam_motd.so
-rwxr-xr-x 1 root root 41600 Jan 23 2008 /lib64/security/pam_mysql.so

So, it's installed and not working... any ideas?
 
Old 08-17-2011, 11:53 AM   #6
travisdh1
Member
 
Registered: Sep 2008
Distribution: Fedora
Posts: 129

Rep: Reputation: 21
Is there a reason you can't customize the one available in the yum repository?

Code:
sudo yum -y install drupal7
Do any customization from that point, could be a lot easier.
 
Old 08-17-2011, 12:11 PM   #7
Carnix
LQ Newbie
 
Registered: Aug 2011
Posts: 10

Original Poster
Rep: Reputation: Disabled
Didn't realize there was a yum-able drupal version (what version is it anyway? it just says drupal.noarch without indication of the drupal version itself) but anyway we're using the Acquia Drupal 7 distribution. This issue isn't Drupal, I have that up and running fine, the issue is FTP. I need them to have FTP access to the site so they can upload and download files, pretty straight forward I think.

Once I get FTP going correctly, I'll reinstall Drupal in this home directory instead of /var/www/html -- Apache isn't my problem, MySQL isn't the issue and Drupal isn't the issue: it's vsftpd that giving me problems.

thanks!

EDIT: ignore the version question -- I listed drupal not drupal7. duh me. Still, that won't suffice since as I said, it's FTP I'm having a problem with not Drupal.

Last edited by Carnix; 08-17-2011 at 12:18 PM.
 
Old 08-17-2011, 12:24 PM   #8
Carnix
LQ Newbie
 
Registered: Aug 2011
Posts: 10

Original Poster
Rep: Reputation: Disabled
Another clarification: I can log into mysql as vsftpd and select the users table, so that's not the issue.

I think the issue must be in the PAM stuff... should I try installing the i386 version too?
 
Old 08-17-2011, 12:32 PM   #9
Carnix
LQ Newbie
 
Registered: Aug 2011
Posts: 10

Original Poster
Rep: Reputation: Disabled
ok. I installed the i386 version too -- had to also install libmysqlclient.so.15 as a dependency but that's simple enough:


$ sudo ls -al /lib/security/pam_m*
-rwxr-xr-x 1 root root 10240 Oct 21 2010 /lib/security/pam_mail.so
-rwxr-xr-x 1 root root 15880 Oct 21 2010 /lib/security/pam_mkhomedir.so
-rwxr-xr-x 1 root root 3892 Oct 21 2010 /lib/security/pam_motd.so
-rwxr-xr-x 1 root root 36920 Jan 23 2008 /lib/security/pam_mysql.so

$ sudo ls -al /lib64/security/pam_m*
-rwxr-xr-x 1 root root 11120 Oct 21 2010 /lib64/security/pam_mail.so
-rwxr-xr-x 1 root root 17208 Oct 21 2010 /lib64/security/pam_mkhomedir.so
-rwxr-xr-x 1 root root 5024 Oct 21 2010 /lib64/security/pam_motd.so
-rwxr-xr-x 1 root root 41600 Jan 23 2008 /lib64/security/pam_mysql.so


So. at this point, I've followed the guide to a T... Any suggestions?
 
Old 08-18-2011, 03:19 AM   #10
lithos
Senior Member
 
Registered: Jan 2010
Location: SI : 45.9531, 15.4894
Distribution: CentOS, OpenNA/Trustix, testing desktop openSuse 12.1 /Cinnamon/KDE4.8
Posts: 1,144

Rep: Reputation: 217Reputation: 217Reputation: 217
just a step to check - the file /etc/pam.d/vsftpd contents:
Code:
    #%PAM-1.0
    session     optional     pam_keyinit.so     force revoke
    auth required pam_mysql.so user=vsftpd passwd=vsftpdpassword host=localhost db=vsftpd table=accounts usercolumn=username passwdcolumn=pass crypt=3
    account required pam_mysql.so user=vsftpd passwd=vsftpdpassword host=localhost db=vsftpd table=accounts usercolumn=username passwdcolumn=pass crypt=3
were giving me a whole lot of trouble until properly configured.

There could be other things in this pam.d/vsftpd, like:
host=localhost could be 127.0.0.1 at your server (maybe MySQL doesn't allow localhost connections)
db=vsftpd <- the name of your database with usernames/pw stored in mysql - you could have "vsftpdusers" or something else


And with "user's" homedirs:
For example if the user name is "user1" then the homedir is '/home/vsftpd/user1' ,
but unfortunately vsftpd doesn't create that directory automatically if it doesn't exist.
Therefore create it manually now and make it owned by the vsftpd user and group 'users'


in your case I see:
Code:
Command: USER drupal
and I assume you have made appropriate steps:
- create user's homedir ? (like "/var/www/drupalsite" which I assume you want to have access, because of the website for users to access it ) and give the right permissions (chmod 755, chown vsftpd.users )
- make vsftpd PER USER configuration file for user 'drupal' with it's homedir:
Code:
local_root=/var/www/drupalsite
I hope it will get you successfully to login.

Last edited by lithos; 08-18-2011 at 03:33 AM.
 
Old 08-18-2011, 09:27 AM   #11
Carnix
LQ Newbie
 
Registered: Aug 2011
Posts: 10

Original Poster
Rep: Reputation: Disabled
Code:
#%PAM-1.0
session     optional     pam_keyinit.so     force revoke
auth required pam_mysql.so user=vsftpd passwd=********** host=localhost db=vsftpd table=accounts usercolumn=username passwdcolumn=pass crypt=3
account required pam_mysql.so user=vsftpd passwd=********** host=localhost db=vsftpd table=accounts usercolumn=username passwdcolumn=pass crypt=3
The mysql server is on the same machine and is configured to allow only vsftpd@localhost the database and table names are set as outlined in the guide.

I did use the per user configuration, but I set the homedir to /home/users/drupal rather than /var/www/drupal. I did NOT create a local user called drupal though, it's my understanding that with this setup, local users are not necessary, but rather FTP user logins are virutal only and therefore only present in the mySQL database.


Code:
$ sudo nano /etc/vsftpd/vsftpd_user_conf/drupal

dirlist_enable=YES
download_enable=YES
# full path to the directory where 'user1' will have access, change to your needs
local_root=/home/users/drupal
write_enable=YES
From the vsftpd.conf:
Code:
guest_enable=YES
guest_username=vsftpd
local_root=/home/vsftpd/$USER
user_sub_token=$USER
virtual_use_local_privs=YES
user_config_dir=/etc/vsftpd/vsftpd_user_conf


Ok, I changed localhost to 127.0.0.1 in the pam file:

Code:
Response:	220 (vsFTPd 2.0.5)
Command:	USER drupal
Response:	331 Please specify the password.
Command:	PASS ********
Response:	500 OOPS: cannot change directory:/home/users/drupal
Error:	Critical error
Error:	Could not connect to server
So, I made sure of the following:

Code:
$ sudo /usr/sbin/usermod -a -G users vsftpd  (verified vsftp user was in the users group)
$ sudo chmod 700 /home/vsftpd
$ sudo chown vsftpd.users /home/vsftpd

$ sudo chmod 700 /home/users/drupal
$ sudo chown vsftpd.users /home/users/drupal
That gives me this (from users director):
Code:
$ ls -al
drwx------  2 vsftpd users 4096 Aug 17 11:00 drupal
(note, I tried to chmod to 777 without any change in the result)

So, I'm getting logged in now, but can't change directories...
 
Old 08-18-2011, 10:40 AM   #12
lithos
Senior Member
 
Registered: Jan 2010
Location: SI : 45.9531, 15.4894
Distribution: CentOS, OpenNA/Trustix, testing desktop openSuse 12.1 /Cinnamon/KDE4.8
Posts: 1,144

Rep: Reputation: 217Reputation: 217Reputation: 217
Quote:
I did NOT create a local user called drupal though, it's my understanding that with this setup, local users are not necessary
Correct! Only
Quote:
4 Configure VSFTPD (Very Secure FTP server):

Create a non-privileged user called 'vsftpd' (with the homedir /home/vsftpd) belonging to the group 'users' ...
is necessary.

but I think (I'm not sure) that vsftpd (service) cannot chdir to /home/users/drupal because of directory privileges (try /home/users with 755 maybe), I can only think of /home/users (and all subdirs) is not available to vsftpd user.

What If you try "su vsftpd" and then "chdir /home/users/drupal", what is the result? Please try this to establish the right permissions, then it should work ok (and maybe restart vsftpd sometimes :-).

You're certainly on the right way to make it work.

I'm just guessing: maybe you have "selinux" enabled ?

Last edited by lithos; 08-18-2011 at 10:44 AM.
 
Old 08-18-2011, 03:23 PM   #13
Carnix
LQ Newbie
 
Registered: Aug 2011
Posts: 10

Original Poster
Rep: Reputation: Disabled
Er. my last post didn't actually post.

So, I got it to work. It was, in fact, the selinux thing. I found some other pages about FTP being disallowed on home directories and whatever, although none of them actually help to fix the problem. So, I changed the virtual user's home directory to /var/www/html and chmod 775 -R (the only way I was able to make it work) and it worked!! I've already set up my team with individual logins and it all works great.

That was earlier this morning, like maybe 11ish Eastern. It's 3pm eastern now, and I just got off the phone with an IT guy who noticed I'd brought up an FTP server. Even though this is an internal-only server, that's still a big no-no so I have to remove it... GAAAAAAH!!!!!!!!!

The plus side is, now, IT said they'd help me out and will configure SFTP (which is what IT requires) on it so I'll still be able to do what I need on it... oh well.

Thanks for your help though, at least I now know how to do it!
 
Old 08-18-2011, 06:31 PM   #14
lithos
Senior Member
 
Registered: Jan 2010
Location: SI : 45.9531, 15.4894
Distribution: CentOS, OpenNA/Trustix, testing desktop openSuse 12.1 /Cinnamon/KDE4.8
Posts: 1,144

Rep: Reputation: 217Reputation: 217Reputation: 217
Thank you for your reply.

It might be maybe possible you keep it if you change the port FTP uses (Listen...) to some well known ports like 22 (SSH) or maybe 443 (https) or just some other random port to make it not so obvious?

Nice to see it worked, so this could be marked as Solved ?

Last edited by lithos; 08-18-2011 at 06:35 PM.
 
Old 08-18-2011, 09:22 PM   #15
chrism01
LQ Guru
 
Registered: Aug 2004
Location: Sydney
Distribution: Centos 6.8, Centos 5.10
Posts: 17,260

Rep: Reputation: 2328Reputation: 2328Reputation: 2328Reputation: 2328Reputation: 2328Reputation: 2328Reputation: 2328Reputation: 2328Reputation: 2328Reputation: 2328Reputation: 2328
Actually, vsftpd can support TLS, so it can be made secure ...
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Starting vsftpd for vsftpd: 500 OOPS: SSL: cannot load RSA certificate MisterTickle Linux - Server 2 02-11-2011 08:41 PM
vsftpd + ssl for dummies piforever Fedora 0 03-18-2007 02:05 PM
SUSE Linux 9.3 for Dummies (For Dummies S.) samuelmp SUSE / openSUSE 11 08-01-2005 02:42 PM
C++ For Dummies AFI_Flame Programming 6 10-15-2004 03:00 PM
Terminals for dummies Xemul Linux - General 4 12-06-2002 05:56 AM


All times are GMT -5. The time now is 11:07 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration