disallow FTP while only allowing SFTP

Fracker · 12-31-2013, 05:50 AM

Hi Guyz,

I configure SFTP server with Chroot, also disallowed user to login via ssh.

Now issue is FTP, i tried to login with the user got on scary result.

Password:
500 OOPS: cannot change directory:/folder
500 OOPS: child died
Connection closed by remote host.

Now how to stop FTP? While using only SFTP.

Fracker · 12-31-2013, 06:19 AM

ok did things like disable port 21 on iptables, and at vsftpd
ftp_enable=no

now ftp is not working but sftp is.. Still not sure where it is secure completely or not.

Also one more thing, i am trying

AllowUsers jim@11.22.33.56

now do i need to add sftp users as well to same configuration?

unSpawn · 01-02-2014, 05:23 AM

Quote:

Originally Posted by Fracker

(..) Now issue is FTP, i tried to login with the user got on scary result.

Code:

Password:
500 OOPS: cannot change directory:/folder
500 OOPS: child died
Connection closed by remote host.

The "cannot change directory" could be a permission issue.

Quote:

Originally Posted by Fracker

Now how to stop FTP? While using only SFTP.

/

Quote:

Originally Posted by Fracker

ok did things like disable port 21 on iptables, and at vsftpd
ftp_enable=no now ftp is not working but sftp is.. Still not sure where it is secure completely or not.

SFTP and FTP(S) are two different protocols usually provided by two different daemons. As far as I know Vsftpd doesn't provide SFTP. If you do not want to provide FTP then the best way to accomplish that is to shut down (and remove?) the FTP daemon.

Quote:

Originally Posted by Fracker

Also one more thing, i am trying
AllowUsers jim@11.22.33.56
now do i need to add sftp users as well to same configuration?

Yes. That kind of makes sense doesn't it? ;-p

Noway2 · 01-02-2014, 09:39 AM

Just to follow up on one point:

Quote:

SFTP and FTP(S) are two different protocols usually provided by two different daemons.

You do have login disabled for the "user" accounts that these daemons run under, don't you?