[SOLVED] FTP/Sharing file

lithos · 02-23-2012, 02:02 AM

Quote:

Originally Posted by alphatest

Hi,

create mysql -u root -p or create mysql -u vsftpd -p ?

i follow from the guide, create to root and setup vsftpd database.

from your last reply seem to be create to vsftpd

thanks

Hi,

Yes, you create the database as root and then grant 'read' permissions to vsftpd user.

Code:

# mysql -u root -p

CREATE DATABASE vsftpd;
GRANT SELECT ON vsftpd.* TO 'vsftpd'@'localhost' IDENTIFIED BY 'vsftpdpassword';   <-- here you allow user vsftpd to read the database, users are added through root of mysql (which has the permission to insert...)
FLUSH PRIVILEGES;

then if you want 100 or more users with different "home" directories then yes, you need to create different 'config' files for each

Quote:

Hi,

if i want create 100 ftp user then

i need
Quote:
vi /etc/vsftpd/vsftpd_user_conf/user1
with configuration settings in it:
dirlist_enable=YES
download_enable=YES
# full path to the directory where 'user1' will have access, change to your needs
local_root=/home/users/user1
write_enable=YES
to create this to every user ..right ?

otherwise, if you want just 100 users with different usernames/passwords and make them access 'default home' dir
then make sure how this line is defined (the path):

Code:

# here the vsftpd will allow the 'vsftpd' user to login into '/home/vsftpd/$USER directory
guest_enable=YES
guest_username=vsftpd
local_root=/home/vsftpd/$USER

meaning this:
- vsftpd users are located in /home/vsftpd/user1... directory (/home/vsftpd/user2, /home/vsftpd/user3 ...)
so you need to create this directories and make them permissions to vsftpd user

Code:

Now user1's homedir is '/home/vsftpd/user1' , unfortunately vsftpd doesn't create that directory automatically if it doesn't exist. Therefore create it manually now and make it owned by the vsftpd user and group 'users':

    mkdir /home/vsftpd/user1
    chown vsftpd:users /home/vsftpd/user1

But your main problem is in vsftpd reading username/password from mysql database, so check the settings in "/etc/pam.d/vsftpd "
you need to define the password which you granted to vsftpd user in mysql

Code:

auth required pam_mysql.so user=vsftpd passwd=vsftpdpassword host=localhost db=vsftpd table=accounts usercolumn=username passwdcolumn=pass crypt=3
account required pam_mysql.so user=vsftpd passwd=vsftpdpassword host=localhost db=vsftpd table=accounts usercolumn=username passwdcolumn=pass crypt=3

or you can have also trouble connecting to mysql as defined "host=localhost" which you may need to set as "host=127.0.0.1"

Quote:

Thu Feb 23 02:19:46 2012 [pid 29591] [user2] FTP response: Client "210.19.31.162", "530 Login incorrect."

means that vsftpd daemon service cannot establish user's passwords, everything else should be fine when that is solved.

alphatest · 02-23-2012, 08:52 PM

Hi,

i follow all that thing but still cannot, just leave the many login for a while...as i need to solve why it's cannot login first.

try to remove all and reconfigure back.

so confusing why is can't work properly.

alphatest · 02-23-2012, 09:16 PM

Hi,

i got this from log

ftp setroubleshoot: SELinux is preventing the httpd from using potentially mislabeled files (./locale). For complete SELinux messages. run sealert -l a41c3a9c-7921-47d2-9a60-9de52b48f046
Feb 23 15:59:08 ftp yum-updatesd-helper: error getting update info: Cannot retrieve repository metadata (repomd.xml) for repository: addons. Please verify its path and try again

lithos · 02-24-2012, 02:04 AM

well,
that's an issue I didn't consider

so what would probably fix it is this (taken from here, here and here):

Code:

# setsebool -P ftp_home_dir=1

that's what it says will allow vsftpd into home directories.

Maybe something more will need to be set, but I don't know SElinux

so here a call for help to anyone familiar with SELinux and VSFTPD.

rhbegin · 02-24-2012, 07:37 AM

Quote:

Originally Posted by lithos

well,
that's an issue I didn't consider

so what would probably fix it is this (taken from here, here and here):

Code:

# setsebool -P ftp_home_dir=1

that's what it says will allow vsftpd into home directories.

Maybe something more will need to be set, but I don't know SElinux

so here a call for help to anyone familiar with SELinux and VSFTPD.

run this command to view the most recent denials:

# sealert -a /var/log/audit/audit.log|less

alphatest · 02-25-2012, 09:38 AM

[root@ftp admin]# sealert -a /var/log/audit/audit.log|less
found 0 alerts in /var/log/audit/audit.log

thanks

alphatest · 02-26-2012, 10:03 AM

Hi,

i try all the possibilities and also re install but the result still the same, where to check again ?

could some one please look into this

when to login

this error

Connected to ftp.a.com.my.
220 (vsFTPd 2.0.5)
Name (ftp.a.com.my): user1
331 Please specify the password.
Password:
530 Login incorrect.
ftp: Login failed
ftp>

check at log/secure

Feb 27 00:02:23 ftp vsftpd: PAM (vsftpd) illegal module type: table=accounts
Feb 27 00:02:23 ftp vsftpd: PAM pam_parse: expecting return value; [...usercolumn=username]
Feb 27 00:02:23 ftp vsftpd: PAM unable to dlopen(/lib64/security/passwdcolumn=pass)
Feb 27 00:02:23 ftp vsftpd: PAM [error: /lib64/security/passwdcolumn=pass: cannot open shared object file: No such file or directory]
Feb 27 00:02:23 ftp vsftpd: PAM adding faulty module: /lib64/security/passwdcolumn=pass
Feb 27 00:02:23 ftp vsftpd: PAM (vsftpd) illegal module type: db=vsftpd
Feb 27 00:02:23 ftp vsftpd: PAM pam_parse: expecting return value; [...table=accounts]
Feb 27 00:02:23 ftp vsftpd: PAM unable to dlopen(/lib64/security/usercolumn=username)
Feb 27 00:02:23 ftp vsftpd: PAM [error: /lib64/security/usercolumn=username: cannot open shared object file: No such file or directory]
Feb 27 00:02:23 ftp vsftpd: PAM adding faulty module: /lib64/security/usercolumn=username

i do not know why this problem...already install back but still the same

lithos could be help on this

thanks

alphatest · 02-26-2012, 11:16 AM

Quote:

Originally Posted by rhbegin

run this command to view the most recent denials:

# sealert -a /var/log/audit/audit.log|less

[root@ftp admin]# sealert -a /var/log/audit/audit.log|less
ERROR: failed to read complete file, 3434396 bytes read out of total 3434155 bytes (/var/log/audit/audit.log)
found 1 alerts in /var/log/audit/audit.log
--------------------------------------------------------------------------------

Summary:

SELinux is preventing vsftpd (ftpd_t) "kill" to <Unknown> (ftpd_t).

Detailed Description:

[SELinux is in permissive mode, the operation would have been denied but was
permitted due to permissive mode.]

SELinux denied access requested by vsftpd. It is not expected that this access
is required by vsftpd and this access may signal an intrusion attempt. It is
also possible that the specific version or configuration of the application is
causing it to require additional access.

Allowing Access:

You can generate a local policy module to allow this access - see FAQ
(http://fedora.redhat.com/docs/selinu...fc5/#id2961385) Or you can disable
SELinux protection altogether. Disabling SELinux protection is not recommended.
Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi)
against this package.

Additional Information:

Source Context user_u:system_r:ftpd_t
Target Context user_u:system_r:ftpd_t
Target Objects None [ capability ]
Source vsftpd
Source Path <Unknown>
Port <Unknown>
Host <Unknown>
Source RPM Packages
Target RPM Packages
Policy RPM selinux-policy-2.4.6-137.el5
Selinux Enabled True
Policy Type targeted
MLS Enabled True
Enforcing Mode Permissive
Plugin Name catchall
Host Name ftp.a.com.my
Platform Linux ftp.a.com.my 2.6.18-92.el5 #1 SMP Tue Jun
10 18:51:06 EDT 2008 x86_64 x86_64
Alert Count 2
First Seen Mon Feb 27 00:17:47 2012
Last Seen Mon Feb 27 00:49:42 2012
Local ID 9f4d140d-dc5a-4163-a7d2-53104b2d3211
Line Numbers 13364, 13419

Raw Audit Messages

type=AVC msg=audit(1330274982.553:137168): avc: denied { kill } for pid=20163 comm="vsftpd" capabi
lity=5 scontext=user_u:system_r:ftpd_t:s0 tcontext=user_u:system_r:ftpd_t:s0 tclass=capability

lithos · 02-26-2012, 11:43 AM

Quote:

Originally Posted by alphatest

...
check at log/secure

Feb 27 00:02:23 ftp vsftpd: PAM (vsftpd) illegal module type: table=accounts
Feb 27 00:02:23 ftp vsftpd: PAM pam_parse: expecting return value; [...usercolumn=username]
Feb 27 00:02:23 ftp vsftpd: PAM unable to dlopen(/lib64/security/passwdcolumn=pass)
Feb 27 00:02:23 ftp vsftpd: PAM [error: /lib64/security/passwdcolumn=pass: cannot open shared object file: No such file or directory]
Feb 27 00:02:23 ftp vsftpd: PAM adding faulty module: /lib64/security/passwdcolumn=pass
Feb 27 00:02:23 ftp vsftpd: PAM (vsftpd) illegal module type: db=vsftpd
Feb 27 00:02:23 ftp vsftpd: PAM pam_parse: expecting return value; [...table=accounts]
Feb 27 00:02:23 ftp vsftpd: PAM unable to dlopen(/lib64/security/usercolumn=username)
Feb 27 00:02:23 ftp vsftpd: PAM [error: /lib64/security/usercolumn=username: cannot open shared object file: No such file or directory]
Feb 27 00:02:23 ftp vsftpd: PAM adding faulty module: /lib64/security/usercolumn=username

Hi,

I'm sorry but this error (great you posted log) shows that VSFTPd PAM module is not working properly somehow (or maybe not even installed)
so you need to either remove/reinstall, install:

Quote:

You need pam_mysql.so library, which is not included in CentOS installation or is not YUM installable, so you have to install from RPM (or EPEL repository ... or whichever method you prefer).

What is your directory with libraries showing:

Code:

When installed, you should find it:

    ls -al /lib/security/pam_m*
    -rwxr-xr-x 1 root root 8024 Sep 4 00:51 /lib/security/pam_mail.so
    -rwxr-xr-x 1 root root 15848 Sep 4 00:51 /lib/security/pam_mkhomedir.so
    -rwxr-xr-x 1 root root 3892 Sep 4 00:51 /lib/security/pam_motd.so
    -rwxr-xr-x 1 root root 36920 Feb 28 2008 /lib/security/pam_mysql.so

similar problem I had when configuring VSFTPD and possible solution is here

also a login problem is listed here

alphatest · 02-26-2012, 03:58 PM

Hi,

already remove and reinstall back.....all the pam file need are listed.

alphatest · 02-26-2012, 10:57 PM

after all the installation/configuration adjustment finally working properly.

do not using pam_mysql from rpm

download here
http://gembuls.wordpress.com/2011/02...ory-on-centos/

after installation n update

remove pam_mysql -->rpm -e
-check vsftpd.conf n vsftpd_user_conf/ for proper configuration

that all.....follow all the guide from lithos (http://centosforserver.blogspot.com/...and-mysql.html) and download epel repo for replace rpm pam_mysql ::should be working properly

thanks for helping

alphatest · 02-26-2012, 11:10 PM

Hi,

i just have one more problem.....user can view/download/upload other user folder.

now try to fix this problem

alphatest · 02-26-2012, 11:22 PM

already fix..

thanks

alphatest · 02-27-2012, 02:03 AM

one more thing can i create user that can view/download/upload file to other user but other user cannot see this user like superuser ?

and i want one more user that cannot view by other user include that superuser like i stated above ?

thanks

lithos · 02-27-2012, 02:14 AM

Quote:

Originally Posted by alphatest

one more thing can i create user that can view/download/upload file to other user but other user cannot see this user like superuser ?

and i want one more user that cannot view by other user include that superuser like i stated above ?

thanks

Hi,

I'm glad that you got it working, but about the users viewing other's files/directories I tried to explain in post #9 what and how it can be done.
I don't know how else ...

again, great you have it working now.