vsftpd requires user@address in address bar

hazmatt20 · 10-25-2006, 06:20 PM

I have previously had vsftpd working on a FC4 box where if you put in the ftp address (ftp://example.com, ftp.example.com, or ftp://192.168.0.3 on local network), you would be given a login prompt. However, after moving to a different machine running Ubuntu 6.06, using said address gives an error:

Code:

This FTP server does not allow anonymous logins.

Doing so also creates a line in /var/log/vsftpd.log that says:

Code:

CONNECT: Client "192.168.0.2"

where 192.168.0.2 is the computer I try to access it from. The only way to connect through a web browser is to put in ftp://user@example.com (ftp clients work normally). Here is my vsftpd.conf:

Code:

listen=YES
anonymous_enable=NO
local_enable=YES
write_enable=YES
dirmessage_enable=YES
xferlog_enable=YES
connect_from_port_20=YES
chown_uploads=YES
chown_username=<myuser>
nopriv_user=ftpadmin
chroot_local_user=YES
chroot_list_enable=YES
chroot_list_file=/etc/vsftpd.chroot_list
secure_chroot_dir=/var/run/vsftpd
pam_service_name=vsftpd
# This option specifies the location of the RSA certificate to use for SSL
# encrypted connections.
rsa_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem
# This option specifies the location of the RSA key to use for SSL
# encrypted connections.
rsa_private_key_file=/etc/ssl/private/ssl-cert-snakeoil.key
pasv_enable=YES

All logins are permitted user logins, no anon. Any help would be appreciated.

diilbert · 10-25-2006, 07:58 PM

Which browser ? I have checked my vsftpd configuration and it is essentially the same, except for the chroot settings.

hazmatt20 · 10-26-2006, 12:25 AM

IE and firefox both do the same thing. Firefox sometimes crashes, even.

timmeke · 10-26-2006, 05:41 AM

Many browsers assume that you want to contact the FTP server via the "anonymous" user if you don't specify a username in the URL. If the FTP server doesn't allow anonymous users, then you don't get in.

I'm guessing that what happened in your case is that you went from an FTP server that did allow anonymous logins (FC4) to one that didn't (on your Ubuntu box).

So, in short, it's not vsftpd's fault that you need to add a user to your ftp:// address in the browser. Adding that user only prevents the default login attempt as "anonymous".
To solve this, you can either:
1. Allow anonymous logins for the FTP server or
2. Change the browser's default behaviour (if possible), i.e. to make it ask for a username instead of assuming "anonymous" as default. Check out your browser's settings for that.

Or just use a nice (free) FTP client instead of your browser.

diilbert · 10-26-2006, 05:50 AM

Now that I think of it I had this problem with my first install of vsftpd on Gentoo. And I did fix the problem. After reviewing the vsftpd.conf on that server there are only 2 settings that may have fixed it.

Try them for yourself and let me know:

Quote:

pasv_promiscuous
Set to YES if you want to disable the PASV security check that ensures the data connection originates from the same IP address as the control connection. Only enable if you know what you are doing! The only legitimate use for this is in some form of secure tunnelling scheme, or perhaps to facilitate FXP support.

Default: NO

Quote:

async_abor_enable
When enabled, a special FTP command known as "async ABOR" will be enabled. Only ill advised FTP clients will use this feature. Additionally, this feature is awkward to handle, so it is disabled by default. Unfortunately, some FTP clients will hang when cancelling a transfer unless this feature is available, so you may wish to enable it.

Default: NO

I think it may have been the first one. But in any case I could post my vsftpd.conf if you want to compare it.

diilbert · 10-26-2006, 05:54 AM

Quote:

Originally Posted by timmeke

I'm guessing that what happened in your case is that you went from an FTP server that did allow anonymous logins (FC4) to one that didn't (on your Ubuntu box).

As I noted above there is a fix for this, because I have had the problem and solved it without allowing anon logins.

hazmatt20 · 10-27-2006, 12:44 AM

I tried enabling both settings but neither fixed it after restarting vsftpd. I would like to see your vsfptd.conf if you don't mind.

I also should note that I did have anonymous specifically disabled on the FC4 box. When you entered the ftp address in a browser, it would simply prompt you for a login.

hazmatt20 · 10-27-2006, 01:22 AM

Well, I found this interesting.

http://forums.gentoo.org/viewtopic-t...0573d88fa4339e

So, I'm trying to install 2.0.3. Got the tarball, but when I run make, it gives me sysutil.c errors. The vsftpd faq says this is probably due to no ipv6 support. What do I need to install?

hazmatt20 · 10-27-2006, 02:30 AM

New update. Found a .deb for 2.0.3 (had to install libssl0 first). Didn't fix it, but now it says "530 Permission Denied".

diilbert · 10-27-2006, 05:34 AM

I posted to the gentoo forum (the thread you linked), to see what setting he had set to fix the problem. (Because it something to do with a setting).

And by the way I am using 2.0.3 on Debian right now and I am not getting this problem.

Here is my vsftpd.conf (removed the private stuff and comments to save space)

Code:

listen=YES
anonymous_enable=NO
local_enable=YES
write_enable=YES
local_umask=002
dirmessage_enable=YES
xferlog_enable=YES
connect_from_port_20=YES
chown_uploads=YES
chown_username=[USERNAME]
xferlog_file=/var/log/vsftpd.log
xferlog_std_format=YES
idle_session_timeout=300
nopriv_user=nobody
ftpd_banner=Welcome to 
secure_chroot_dir=/var/run/vsftpd
pam_service_name=vsftpd
rsa_cert_file=/etc/ssl/certs/vsftpd.pem

Try making this your vsftpd.conf (backing up the old one of course) and restarting vsftpd. If the problem still exists it is definitely not the configuration.

hazmatt20 · 10-27-2006, 01:53 PM

So, I can't find any difference in the two confs that could have caused it, but that did the trick! Thanks a lot for your help.

diilbert · 10-27-2006, 08:05 PM

No problem. There is something, but I can't remember which it was either.