[SOLVED] problem with sfpt/ftp

DrLove73 · 09-25-2009, 07:10 AM

FYI, I am a he, not she

.

unix1adm · 09-25-2009, 02:08 PM

I am not sure you are all reading the full text. I will try to explain it again.

I have 2 issues ftp and sftp will not allow a put of file but will allow a get.

So Yes I know there are different setup files.

I will try to explain better. Please do not take this as curt just the facts.

Lets establish the geographical locations.
3 users, User A, User B and User C. all users are in different locations, and different IP ranges. All users are using filezilla program.

User A can sftp and ftp fine. He can do puts and gets using ftp or sftp from his place.

User B from his place cannot do a put but can do a get using sfpt and ftp.

User C (me) can do a get using ftp and sftp. However user C cannot do a put. But if user C tries a put using command line psftp (putty sftp) he can put a file.

User A from his primary location can use user B and C accounts and do a put get etc using filezilla fine.

User A travels to user B place and tries to do a put using sftp or ftp using user B or C ID on his laptop on User B network. He cannot do a put. He can only do a get. He cannot do a put using user A id either from this location.

OK any ideas now?

I dont doubt it is something with a config file but what would be locking out the other networks?

In summary ONLY USER A can fpt/sftp and do a put/get from his location using any of the 3 IDs.

No other users can do a put.
I hope this is clearer now. If not let me know.

DrLove73 · 09-25-2009, 03:30 PM

OK, that is much better concerning info. My guess it is HOST/IP based restriction. There is probably option to declare some IP's or hostnames "local network" that will allow special abilities like upload.

I now see that vsftpd has STFP functionality, so I guess that it is responsible for both SFTP and FTP connections.

Go here: http://vsftpd.beasts.org/vsftpd_conf.html

And look for restriction option. My first guess would be this:

Code:

virtual_use_local_privs
    If enabled, virtual users will use the same privileges as local users. By default,
virtual users will use the same privileges as anonymous users, which tends to be more
restrictive (especially in terms of write access).

    Default: NO

vsftpd.conf should be in /etc/ folder.

Also take a look at this: http://www.linuxjournal.com/article/7520

When you take a look at config file, faster route would be to search for full IP (or partial, like subnet) and/or hostname that has upload permission.

Do not think of us in a bad way, giving us very little or potentially confusing info always produces misunderstandings with the ones trying to help.

unix1adm · 09-25-2009, 06:21 PM

"Do not think of us in a bad way, giving us very little or potentially confusing info always produces misunderstandings with the ones trying to help."

Not at all. I welcome all the info people offer. I just wanted to be sure you understood the problem.

I will look into what you posted and see what I can find..

unix1adm · 09-25-2009, 06:26 PM

This is all I have enabled in the vsftpd.conf file

# Example config file /etc/vsftpd/vsftpd.conf
#
# The default compiled in settings are fairly paranoid. This sample file
# loosens things up a bit, to make the ftp daemon more usable.
# Please see vsftpd.conf.5 for all compiled in defaults.
#
# READ THIS: This example file is NOT an exhaustive list of vsftpd options.
# Please read the vsftpd.conf.5 manual page to get a full idea of vsftpd's
# capabilities.
#
# Allow anonymous FTP? (Beware - allowed by default if you comment this out).
anonymous_enable=NO
#
# Uncomment this to allow local users to log in.
local_enable=YES
#
# Uncomment this to enable any form of FTP write command.
write_enable=YES
#
# Default umask for local users is 077. You may wish to change this to 022,
# if your users expect that (022 is used by most other ftpd's)
local_umask=022
# Uncomment this to allow the anonymous FTP user to upload files. This only
# has an effect if the above global write enable is activated. Also, you will
# obviously need to create a directory writable by the FTP user.
#anon_upload_enable=YES
#
# Uncomment this if you want the anonymous FTP user to be able to create
# new directories.
#anon_mkdir_write_enable=YES
#
# Activate directory messages - messages given to remote users when they
# go into a certain directory.
dirmessage_enable=YES
#
# Activate logging of uploads/downloads.
xferlog_enable=YES
#
# Make sure PORT transfer connections originate from port 20 (ftp-data).
connect_from_port_20=YES
#
# If you want, you can arrange for uploaded anonymous files to be owned by
# a different user. Note! Using "root" for uploaded files is not
# recommended!
#chown_uploads=YES
#chown_username=whoever
#
# You may override where the log file goes if you like. The default is shown
# below.
xferlog_file=/var/log/vsftpd.log
#
# If you want, you can have your log file in standard ftpd xferlog format
xferlog_std_format=YES
#
# You may change the default value for timing out an idle session.
#idle_session_timeout=600
#
# You may change the default value for timing out a data connection.
#data_connection_timeout=120
#
# It is recommended that you define on your system a unique user which the
# ftp server can use as a totally isolated and unprivileged user.
#nopriv_user=ftpsecure
#
# Enable this and the server will recognise asynchronous ABOR requests. Not
# recommended for security (the code is non-trivial). Not enabling it,
# however, may confuse older FTP clients.
#async_abor_enable=YES
#
# By default the server will pretend to allow ASCII mode but in fact ignore
# the request. Turn on the below options to have the server actually do ASCII
# mangling on files when in ASCII mode.
# Beware that on some FTP servers, ASCII support allows a denial of service
# attack (DoS) via the command "SIZE /big/file" in ASCII mode. vsftpd
# predicted this attack and has always been safe, reporting the size of the
# raw file.
# ASCII mangling is a horrible feature of the protocol.
#ascii_upload_enable=YES
#ascii_download_enable=YES
#
# You may fully customise the login banner string:
#ftpd_banner=Welcome to blah FTP service.
#
# You may specify a file of disallowed anonymous e-mail addresses. Apparently
# useful for combatting certain DoS attacks.
#deny_email_enable=YES
# (default follows)
#banned_email_file=/etc/vsftpd/banned_emails
# You may specify an explicit list of local users to chroot() to their home
# directory. If chroot_local_user is YES, then this list becomes a list of
# users to NOT chroot().
#chroot_list_enable=YES
# (default follows)
#chroot_list_file=/etc/vsftpd/chroot_list
#
# You may activate the "-R" option to the builtin ls. This is disabled by
# default to avoid remote users being able to cause excessive I/O on large
# sites. However, some broken FTP clients such as "ncftp" and "mirror" assume
# the presence of the "-R" option, so there is a strong case for enabling it.
#ls_recurse_enable=YES
#
# When "listen" directive is enabled, vsftpd runs in standalone mode and
# listens on IPv4 sockets. This directive cannot be used in conjunction
# with the listen_ipv6 directive.
listen=YES
#
# This directive enables listening on IPv6 sockets. To listen on IPv4 and IPv6
# sockets, you must run two copies of vsftpd whith two configuration files.
# Make sure, that one of the listen options is commented !!
#listen_ipv6=YES

pam_service_name=vsftpd
# userlist_enable=YES
tcp_wrappers=YES
userlist_deny=YES

DrLove73 · 09-26-2009, 09:08 AM

OK.

It is either tcp_wrappers=YES, look at http://www.redhat.com/docs/manuals/e...S2-SERVER-TCPW
or
pam_service_name=vsftpd http://www.redhat.com/docs/manuals/e...PRIVILEGES-PAM

I never done it so can not help you furter.

If that does not help, also see if vsftpd has any other config files where user restrictions can be set.

unix1adm · 09-26-2009, 01:55 PM

I made some progress on this today. I can now get user C to sftp to the machine. I am going to call user A and B and see if they are working.

I put on debugging from my Linux box and determined that filezilla was not going to the system using port 22. So I hardcoded it and it now works fine.

Thanx for those other links. Thats some good info. Did not know you could do all that loging and banners etc.

DrLove73 · 09-26-2009, 04:49 PM

Neither did I :-) But I am REALLY good creating google queries.

You could consider using webmin. It has excelent web interface for configuring anything you can think of on Linux systems. I use Virtualmin (enhanced version for domain hosting) GPL for the sites I host.

unix1adm · 09-26-2009, 06:31 PM

i use to use webmin years ago on AIX servers. I will check it out for Linux now. Thanx for the info.