CentOS 5 Server :: Vsftpd Using Virtual Users And Encrypting It?
Aug 10, 2011
Using THIS I was able to get virtual users working via standard ftp. After wrestling with selinux and such I'm able to log in as a user defined in the virtual-users file.
At the bottom is the vsftpd.conf. I can start the server no problem. I've been making edits to it so I'm not sure what's right/wrong at this point in it. I have a snapshot I keep reverting to where ftp works with virtual users and then I start monkeying with it again.
First problem I have is I'm not exactly sure how to test it. If I use WinSCP, I try SFTP and in the vsftpd.log I see:
I thought someone might find this useful and not have to lose a day for getting it work... (as I did)...
so this is a Tutorial HowTo based on Virtual Hosting With vsftpd And MySQL On Debian Etch but with modifications needed to work on CentOS 5 (in my case it was CentOS 5.4 x86 32bit).
You will need (if not already installed): yum install vsftpd mysql-server
I am trying to set up a Mail Server -- Virtual Users with Postfix, PostfixAdmin, Courier, Mailscanner, ClamAV On CentOS 5.5 using this guide. These are the version and softwares I have used till now:-
I'm testing a Debian Lenny virtual machine to simulate my ideal setup for FTP server (with vsftpd): I want all internal users (corporation users with Active Directory accounts) to ftp into the same directory (i.e. /var/FTP/AD-DOMAIN/) and external users (customers) to ftp into their home directories (created manually on request).
I added user_config_dir=/etc/vsftpd_user_conf option in /etc/vsftpd.conf file and I've created /etc/vsftpd_user_conf/domain-user1 with local_root=/var/FTP/AD-DOMAIN
I have setup vsftp so I can ftp with every external and internal user chrooted and is working properly. AD validation for internal users and "normal" validation (via /etc/passwd) for external users work perfect.
I can FTP this server into /var/FTP/AD-DOMAIN with any AD user with its home directory created (i.e. /home/AD-DOMAIN/domain-user1/) but if I try to ftp with any AD user without its home directory created I get the error "500 OOPS: cannot change directory:/home/AD-DOMAIN/domain-user2"
I have found some references (http://wiki.flexion.org/FtpServer.html and http://howto.gumph.org/content/setup...ies-in-vsftpd/) about vsftp PAM authentication so I would supposedly get rid of the error message and the user would log into /var/FTP/AD-DOMAIN without problems, but I can't figure out how to setup my FTP server.
In the past I found some great help on this forum, so here goes. Bare with me because it's a long story. I'll try to be as complete as possible. I've installed and configured OpenLdap on a virtual machine with ip 192.168.39.134. I've added 2 users via LAM. In the ou WikiUsers and the domain is wiki.local.
I've then created another host with ip 192.168.39.133 with mediawiki installed on it. Then I added the extension LDAPAuthenthication. In the LdapAuthentication file I added this code (only the last paragraph is mine, I added the others to show it's location in the script):
I know I'm close because I can't register any new users or accounts on the mediawiki site. Although I could before I added the LDAP service. This is indeed all just to test and get to know how LDAP works. That's why it's all virtual in VMWare. I did not really configure anything on the LDAP, i just installed it and chose a domain (wiki.local).
I installed vsftpd server in one of my servers using "yum install vsftpd" command. NFS server is running in the other server and mounted as "/data" in this FTP server. root in FTP server has also root authority in NFS server. All the files and sub-folders under "/data" in FTP server have 755 or 766 mode. Even I modified vsftpd setting to allow root login.
When I login as root to FTP server with FileZilla client, I can see all the file list in root home directory and move to /data directory. I can download any file in a local HDD but I can not download any file in /data directory.
I open "man vsftpd.conf", it says syslog_enable If enabled, then any log output which would have gone o /var/log/vsftpd.log goes to the system log instead. Logging is done under the FTPD facility. Default: NO So I add "syslog_enable=YES" to the /etc/vsftpd.conf, and add "ftpd.* /var/log/ftplog" into /etc/syslog.conf. But there is no log infomation in the ftplog file.
I'm still learning my way around CentOS and linux in general... Using CentOS 5.4
BUT, I used the scripts from HowTo/Chroot Vsftpd and it did not work with the non-TLS script config, but the with TSL worked great. I wasn't sure where to put the vsftpd_virtualuser_config.tpl file but I copied it over when the script failed to find it... to where it was looking.
So I think it's working but my question is, TLS doesn't use port 21 but the script defaults to that port. I'm using FileZilla from an XP machine at work and I'm forwarding all the ports given in the HowTo. So I'm forcing the client to use TLS on port 21 but it hangs on the connection. If I use non TLS I get in but it tells me it requires TSL. I've had no luck with vsftpd in the past and this is my next attempt.
I've only recently encountered this problem with vsftpd when I was creating new ftp accounts. I keep on getting:
550 Access Denied.
on every action I try to do on ftp, no matter what. I've been trying to solve this myself however my attempts have been futile.
The permissions, and ownership have been checked and rechecked tens of times now, so thats not the issue. I've reinstalled the OS of my server twice now, and the problem is still persisting. Heres my config file, this isnt for anon by the way.
Code: # Example config file /etc/vsftpd/vsftpd.conf # # The default compiled in settings are fairly paranoid. This sample file # loosens things up a bit, to make the ftp daemon more usable. # Please see vsftpd.conf.5 for all compiled in defaults. #
I already have this setup working in a debian server but I would like to setup the same in CentOS 5.3. I just copied all the configuration files to the CentOS server but I'm getting the following errors in messages:
vsftpd: nss_ldap: reconnecting to LDAP server (sleeping 64 seconds)... vsftpd: nss_ldap: reconnecting to LDAP server (sleeping 64 seconds)... crond[24483]: nss_ldap: reconnecting to LDAP server (sleeping 4 seconds)... crond[24483]: nss_ldap: reconnecting to LDAP server (sleeping 8 seconds)... crond[24483]: nss_ldap: reconnecting to LDAP server (sleeping 16 seconds)... crond[24483]: nss_ldap: reconnecting to LDAP server (sleeping 32 seconds)...
I set up my vsftpd server, but when using "sftp servername" it's not using vsftpd but another (what seems like) built-in sftp server. Even when I stop the vsftpd service I am still able to get a prompt to log in. I haven't installed any other ftp servers.
I've a Windows 7 host OS and I've installed Fedora 11 as a Virtual OS using Virtualbox.I want a friend of mine to connect to my Fedora server using telnet from internet. What I would like to know is how do i configure my Virtualbox to allow my friend to connect to my server. Also, is there any setting I need to change in Fedora to allow this?
I was following the above guide to get a mail server up and running. The major difference in it all is the fact that my server is running i686, but I compensated for that easily, just a difference in folder/RPM names. [URL]. Otherwise I followed it to a "T." Everything seemed to go smoothly, no trips or falls until the very end.
After installing squirrelmail and trying to login on admin@withfrosted.com returns ERROR: Connection dropped by IMAP server. Uncle google tells me to run this command because SELinux is overzealous: setsebool -P httpd_can_network_connect=1
And that works, and I thought I was home free. However, after that, I'm presented with a new error. However, google told me to send an email to create the mailbox because it wasn't there, yet. So I send a test email on over, but that fails, and so does mailx. Next I created /home/vmail/withfrosted.com/admin while logged into the vmail user for proper permissions. Squirrelmail now logs into the mail box but gives me yet another new error, in which I am now stuck on: ERROR: ERROR: Could not complete request. Query: SELECT "INBOX" Reason Given: Unable to open this mailbox.
As a summary, because I'm all over the place, here: 1. Can't view the mailbox via Squirrelmail. 2. Can't receive email, tried with mailx and a test email from gmail.
Regarding #2, the gmail test email, from the maillog: May 9 07:25:45 withfrosted postfix/smtpd[21095]: connect from mail-qy0-f177.google.com[209.85.221.177] May 9 07:25:45 withfrosted postfix/smtpd[21095]: 26CE516241D: client=mail-qy0-f177.google.com[209.85.221.177] May 9 07:25:45 withfrosted postfix/cleanup[21104]: 26CE516241D: message-id=<z2pe336661a1005090425zaee8dc71jc3002cb7cb25e0fa@mail.gmail.com> May 9 07:25:45 withfrosted postfix/qmgr[19083]: 26CE516241D: from=<issact@gmail.com>, size=1866, nrcpt=1 (queue active) May 9 07:25:45 withfrosted amavis[21024]: (21024-01) (!)connect_to_sql: unable to connect to DSN 'DBI:mysql:database=mail;host=127.0.0.1;port=3306': Can't connect to MySQL server on '127.0.0.1' (13) May 9 07:25:45 withfrosted amavis[21024]: (21024-01) (!!)TROUBLE in process_request: connect_to_sql: unable to connect to any dataset at (eval 98) line 241, <GEN15> line 5. May 9 07:25:45 withfrosted amavis[21024]: (21024-01) (!)Requesting process rundown after fatal error May 9 07:25:45 withfrosted postfix/smtp[21105]: 26CE516241D: to=<admin@withfrosted.com>, relay=127.0.0.1[127.0.0.1]:10024, delay=0.2, delays=0.11/0.01/0.01/0.07, dsn=4.3.2, status=deferred (host 127.0.0.1[127.0.0.1] said: 421 4.3.2 Service shutting down, closing channel (in reply to RCPT TO command)) May 9 07:26:15 withfrosted postfix/smtpd[21095]: disconnect from mail-qy0-f177.google.com[209.85.221.177]
I'm able to connect to ftp as a virtual user. It was also difficult as nowhere mentioned, that it should be done with SSL. Anyway I found the answer and got connection. But now I can't connect to ftp server as system user. It gives me "530 Permission denied", or if I delete the user from the file denied_users, - "530 Login incorrect".
1. Still I can't understand, how I can log in to FTP server with a system user.Also some other questions regarding this matter:
2. My httpd server Apache has a virtual hosts located in "/home" directory.The scripts create users in "/var/ftp virtual_users". Will it cause any problem if I will change them to "/home"? All I need to do with this is ability to have several virtual hosts in one server with separate access to each of them via FTP. And 1 account with access to all files in "/home".
3. In my ftp client I can see the owner of virtual host "ftp" instead of username.
I'm having difficulties with uploading files to a CentOS-server with vsftpd. I have the exact same configuration on a Fedora10 and there I have no problems...
Trying to set up VSFTPD on the CentOS 5 box at work, which is an internal web development server. I'm leaving soon, and all knowledge of or desire to learn SSH is going with me so the other employees will need to be able to access the web root using FTP clients.
Essentially there is no need for special user accounts or privileges, it's an internal server in a tiny company. I've got the LocalRoot set to /var/www/ which I can log in to and read all files via FTP, however despite setting everything to 777 in /var/www/ and below, I still can't get any write privileges on the FTP server.
I am attempting to connect to VSFTPD via Filezilla from a windows machine, but regardless of which user name I use I get a "530 Login incorrect" error. I have tried turning off the firewalls on both the CentOS and Windows side of things with no result. I disabled the SSL/TLS commands in the config file, also with no change. I tried a couple of different FTP clients, but got similar results regardless of which client I used. I have been going over man pages and documentation for a couple of days now, but cannot come up with an answer. I suspect it lies in my configuration, but I got the same results when I reverted my config file back to the original. what else I can do? One other note is that I am attempting to connect via a LAN, at this point I don't care if it works across the WAN as I only intend to use it to upload files to my web server.
I am running FTP server using vsftpd 2.0.5-12 on Centos 5.3 64bit with default settings, annonymous access enabled. Each night new files are created and moved into a FTP subdirectory (/var/ftp/spectra) by a script. The files are owned by a local user/group, not root, and the same holds for the /var/ftp/spectra subdirectory. The new files are not visible via FTP. Only visible are files that were created the same day when I made the directory /var/ftp/spectra. Also files that are created "in place", e.g. by vi, are visible until I change their owner/group. This is the situation when vsftpd is runned as a system service (/etc/init.d/vsftpd start).
When I start the vsftpd directly using the command /usr/sbin/vsftpd (both without or with the configuration file specified), all files are visible and normally accessible via FTP.
I have never had the packaged vsftpd start with the ssl_enable option set to YES. The mysql on those servers works just fine with SSL enabled. After reading there seems to be a different package available on rh5 repo. This server shows up to date with 2.0.5-12.el5_3.1. The rh5 list shows 2.0.5-16_el5 per this:[URL].. My question is, is there a set lead time till adoption of current RH packages or is just random? I have to have SSL_ftp running and didn't want to step out of the repo lists if possible.
How do I turn winbind authentication off or vsftpd. I keep getting these error messages in the /var/log/ secure:vsftpd: pam_winbind(vsftpd:auth): request failed: No such user, PAM error was User not known to the underlying authentication module (10), NT error was NT_STATUS_NO_SUCH_USER.I already tried remarking out different things in the config files. Is it safe to remark out the winbind stuff in /etc/pam.d/system-auth if we are using the smbclient to connect to a Windows share?Why would you want to to use AD to authenticate users for something simple like FTP is beyond me.I merely want it to authenticate against local system users.
