vsftpd user login directory listing error

johnmaxwell · 07-24-2014, 08:41 AM

My config file /etc/vsftpd/vsftpd.conf

Code:

# Example config file /etc/vsftpd/vsftpd.conf
#
# The default compiled in settings are fairly paranoid. This sample file
# loosens things up a bit, to make the ftp daemon more usable.
# Please see vsftpd.conf.5 for all compiled in defaults.
#
# READ THIS: This example file is NOT an exhaustive list of vsftpd options.
# Please read the vsftpd.conf.5 manual page to get a full idea of vsftpd's
# capabilities.
#
# Allow anonymous FTP? (Beware - allowed by default if you comment this out).
anonymous_enable=NO
#
# Uncomment this to allow local users to log in.
local_enable=YES
#
# Uncomment this to enable any form of FTP write command.
write_enable=YES
#
# Default umask for local users is 077. You may wish to change this to 022,
# if your users expect that (022 is used by most other ftpd's)
local_umask=022
#
# Uncomment this to allow the anonymous FTP user to upload files. This only
# has an effect if the above global write enable is activated. Also, you will
# obviously need to create a directory writable by the FTP user.
#anon_upload_enable=YES
#
# Uncomment this if you want the anonymous FTP user to be able to create
# new directories.
#anon_mkdir_write_enable=YES
#
# Activate directory messages - messages given to remote users when they
# go into a certain directory.
dirmessage_enable=YES
#
# The target log file can be vsftpd_log_file or xferlog_file.
# This depends on setting xferlog_std_format parameter
xferlog_enable=YES
#
# Make sure PORT transfer connections originate from port 20 (ftp-data).
connect_from_port_20=YES
#
# If you want, you can arrange for uploaded anonymous files to be owned by
# a different user. Note! Using "root" for uploaded files is not
# recommended!
#chown_uploads=YES
#chown_username=whoever
#
# The name of log file when xferlog_enable=YES and xferlog_std_format=YES
# WARNING - changing this filename affects /etc/logrotate.d/vsftpd.log
#xferlog_file=/var/log/xferlog
#
# Switches between logging into vsftpd_log_file and xferlog_file files.
# NO writes to vsftpd_log_file, YES to xferlog_file
xferlog_std_format=YES
#
# You may change the default value for timing out an idle session.
#idle_session_timeout=600
#
# You may change the default value for timing out a data connection.
#data_connection_timeout=120
#
# It is recommended that you define on your system a unique user which the
# ftp server can use as a totally isolated and unprivileged user.
#nopriv_user=ftpsecure
#
# Enable this and the server will recognise asynchronous ABOR requests. Not
# recommended for security (the code is non-trivial). Not enabling it,
# however, may confuse older FTP clients.
#async_abor_enable=YES
#
# By default the server will pretend to allow ASCII mode but in fact ignore
# the request. Turn on the below options to have the server actually do ASCII
# mangling on files when in ASCII mode.
# Beware that on some FTP servers, ASCII support allows a denial of service
# attack (DoS) via the command "SIZE /big/file" in ASCII mode. vsftpd
# predicted this attack and has always been safe, reporting the size of the
# raw file.
# ASCII mangling is a horrible feature of the protocol.
#ascii_upload_enable=YES
#ascii_download_enable=YES
#
# You may fully customise the login banner string:
#ftpd_banner=Welcome to blah FTP service.
#
# You may specify a file of disallowed anonymous e-mail addresses. Apparently
# useful for combatting certain DoS attacks.
#deny_email_enable=YES
# (default follows)
#banned_email_file=/etc/vsftpd/banned_emails
#
# You may specify an explicit list of local users to chroot() to their home
# directory. If chroot_local_user is YES, then this list becomes a list of
# users to NOT chroot().
#chroot_local_user=YES
#chroot_list_enable=YES
# (default follows)
#chroot_list_file=/etc/vsftpd/chroot_list
#
# You may activate the "-R" option to the builtin ls. This is disabled by
# default to avoid remote users being able to cause excessive I/O on large
# sites. However, some broken FTP clients such as "ncftp" and "mirror" assume
# the presence of the "-R" option, so there is a strong case for enabling it.
#ls_recurse_enable=YES
#
# When "listen" directive is enabled, vsftpd runs in standalone mode and
# listens on IPv4 sockets. This directive cannot be used in conjunction
# with the listen_ipv6 directive.
listen=YES
#
# This directive enables listening on IPv6 sockets. To listen on IPv4 and IPv6
# sockets, you must run two copies of vsftpd with two configuration files.
# Make sure, that one of the listen options is commented !!
#listen_ipv6=YES

pam_service_name=vsftpd
userlist_enable=YES
tcp_wrappers=YES

pasv_enable=YES
#pasv_promiscuous=NO
pasv_max_port=1600
pasv_min_port=1500
pasv_address=115.127.27.59
port_enable=YES
pasv_addr_resolve=NO
dirlist_enable=YES

my pam file for vsftpd /etc/pam.d/vsftpd

Code:

session    optional     pam_keyinit.so    force revoke
auth       required	pam_listfile.so item=user sense=deny file=/etc/vsftpd/ftpusers onerr=succeed
auth       required	pam_shells.so
auth       include	password-auth
account    include	password-auth
session    required     pam_loginuid.so
session    include	password-auth

ldd vsftpd output

Code:

ldd vsftpd
        not a dynamic executable

iptables

Code:

modprobe ip_conntrack
modprobe ip_conntrack_ftp
modprobe nf_conntrack_ftp
modprobe ip_nat_ftp ports=21
modprobe ip_nat_ftp 
modprobe ip_nat_irc

#Declare interfaces, ip-address, and other things
wan="p4p1"
lan="p4p2"
wanip="115.127.27.59"
lanip="192.168.100.1"

#Basic policy set to drop in filter
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT DROP

#FTP
iptables -A INPUT -p tcp -d $wanip --dport 21 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp -s $wanip --sport 21 -m state --state ESTABLISHED -j ACCEPT

iptables -A INPUT -p tcp --sport 1500:1600 -d $wanip --dport 1500:1600 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -p tcp -s $wanip --sport 1500:1600 -d 0/0 --dport 1500:1600 -m state --state ESTABLISHED -j ACCEPT

iptables -A OUTPUT -p tcp -s $wanip --sport 20 --dport 1500:1600 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p tcp --sport 1500:1600 -d $wanip --dport 20 -m state --state ESTABLISHED -j ACCEPT

##############################################################################################################

Code:

 ls -al /home/
total 32
drwxr-xr-x.  5 root       root        4096 Jul 24 18:40 .
dr-xr-xr-x. 27 root       root        4096 Jul 24 19:12 ..
drwx------.  4 ftptesting ftptesting  4096 Jul 24 18:40 ftptesting
drwx------.  2 root       root       16384 Jul  8 22:11 lost+found
drwx------.  4 user1      ftp         4096 Jul 24 01:03 user1

So now the error is when i try with winscp it accepts the connection login with "ftptesting" password but the directory list is not comming.

T3RM1NVT0R · 07-24-2014, 02:49 PM

What is the error message that you are getting? If selinux running on this machine. If yes, is the following parameter set to on:

Code:

ftp_home_dir --> off

if not, then turn it on and then give it a try (no need to restart vsftpd service):

Code:

setsebool -P ftp_home_dir on

johnmaxwell · 07-25-2014, 02:16 AM

this is my selinux settings

Code:

 getsebool -a | grep ftp
allow_ftpd_anon_write --> off
allow_ftpd_full_access --> off
allow_ftpd_use_cifs --> off
allow_ftpd_use_nfs --> off
ftp_home_dir --> on
ftpd_connect_db --> off
ftpd_use_fusefs --> off
ftpd_use_passive_mode --> off
httpd_enable_ftp_server --> off
tftp_anon_write --> off
tftp_use_cifs --> off
tftp_use_nfs --> off

T3RM1NVT0R · 07-25-2014, 07:18 AM

Quote:

So now the error is when i try with winscp it accepts the connection login with "ftptesting" password but the directory list is not comming.

You didn't mention that error that you get. Also does it work fine when you access it via command line and not via winscp, I doubt it will work but may be you can get a more verbose error message.

johnmaxwell · 08-03-2014, 03:02 AM

my new vsftpd.conf file it works, with winscp.

Code:

anonymous_enable=NO
local_enable=YES
write_enable=YES
local_umask=022
dirmessage_enable=YES
xferlog_enable=YES
connect_from_port_20=YES
xferlog_std_format=YES
banner_file=/etc/vsftpd/other/banner.txt
#ftpd_banner=Welcome to blah FTP service.
listen=YES
pam_service_name=vsftpd
userlist_enable=YES
userlist_deny=NO
userlist_file=/etc/vsftpd/other/user.allow
tcp_wrappers=YES
pasv_enable=YES
pasv_promiscuous=YES
pasv_min_port=1503
pasv_max_port=1600
accept_timeout=500
connect_timeout=500
data_connection_timeout=1000
ssl_enable=YES
#implicit_ssl=YES
allow_anon_ssl=NO
force_local_logins_ssl=YES
force_local_data_ssl=YES
ssl_tlsv1=YES
ssl_sslv2=YES
ssl_sslv3=YES
#ssl_ciphers=HIGH
rsa_cert_file=/etc/vsftpd/ssl/vsftpd.pem
#rsa_private_key_file=/etc/vsftpd/ssl/vsftpd.pem
force_dot_files=YES
download_enable=YES
chroot_local_user=YES
chroot_list_enable=YES
chroot_list_file=/etc/vsftpd/other/chroot.list
hide_ids=YES
port_enable=YES
#listen_port=990
#ftp_data_port=989

the problem was with this line

Code:

#rsa_private_key_file=/etc/vsftpd/ssl/vsftpd.pem

if it is enabled than vsftpd does not work

T3RM1NVT0R · 08-03-2014, 03:43 PM

Glad to hear that it is working now! I don't see this line "#rsa_private_key_file=/etc/vsftpd/ssl/vsftpd.pem" in your original post wherein you have pasted your vsftpd.conf file.

Enjoy linux!