Setup of VSFTPD virtual users
If you are hosting several web sites, for security reason, you may want the webmasters to access their own files only. One of the good way is to give them FTP access by setup of VSFTPD virtual users and directories. This article describes how you can do that easily.
(See also: Setup of VSFTPD virtual users – another approach)
1. Installation of VSFTPD
For Red Hat, CentOS and Fedora, you may install VSFTPD by the command
# yum install vsftpd
For Debian and Ubuntu,
# apt-get install vsftpd
2. Virtual users and authentication
We are going to use pam_userdb to authenticate the virtual users. This needs a username / password file in `db’ format – a common database format. We need `db_load’ program. For CentOS, Fedora, you may install the package `db4-utils’:
# yum install db4-utils
For Ubuntu,
# apt-get install db4.2-util
To create a `db’ format file, first create a plain text file `virtual-users.txt’ with the usernames and passwords on alternating lines:
mary
123456
jack
654321
Then execute the following command to create the actual database:
# db_load -T -t hash -f virtual-users.txt /etc/vsftpd/virtual-users.db
Now, create a PAM file /etc/pam.d/vsftpd-virtual which uses your database:
auth required pam_userdb.so db=/etc/vsftpd/virtual-users
account required pam_userdb.so db=/etc/vsftpd/virtual-users
3. Configuration of VSFTPD
Create a configuration file /etc/vsftpd/vsftpd-virtual.conf,
# disables anonymous FTP
anonymous_enable=NO
# enables non-anonymous FTP
local_enable=YES
# activates virtual users
guest_enable=YES
# virtual users to use local privs, not anon privs
virtual_use_local_privs=YES
# enables uploads and new directories
write_enable=YES
# the PAM file used by authentication of virtual uses
pam_service_name=vsftpd-virtual
# in conjunction with 'local_root',
# specifies a home directory for each virtual user
user_sub_token=$USER
local_root=/var/www/virtual/$USER
# the virtual user is restricted to the virtual FTP area
chroot_local_user=YES
# hides the FTP server user IDs and just display "ftp" in directory listings
hide_ids=YES
# runs vsftpd in standalone mode
listen=YES
# listens on this port for incoming FTP connections
listen_port=60021
# the minimum port to allocate for PASV style data connections
pasv_min_port=62222
# the maximum port to allocate for PASV style data connections
pasv_max_port=63333
# controls whether PORT style data connections use port 20 (ftp-data)
connect_from_port_20=YES
# the umask for file creation
local_umask=022
4. Creation of home directories
Create each user’s home directory in /var/www/virtual, and change the owner of the directory to the user `ftp’:
# mkdir /var/www/virtual/mary
# chown ftp:ftp /var/www/virtual/mary
5. Startup of VSFTPD and test
Now we can start VSFTPD by the command:
# /usr/sbin/vsftpd /etc/vsftpd/vsftpd-virtual.conf
and test the FTP access of a virtual user:
# lftp -u mary -p 60021 192.168.1.101
The virtual user should have full access to his directory.
September 3rd, 2009 at 6:14 am
Great tutorial, but if the ftp server is up and running, how can I add and delete users?
September 14th, 2009 at 10:29 pm
This is fair easy:
1. Redo some things of step 2:
Update the plain text file `virtual-users.txt’ you did before with the usernames and passwords on alternating lines:
mary
123456
jack
654321
mynewuser
162534
Then execute again the following command to create the actual database:
# db_load -T -t hash -f virtual-users.txt /etc/vsftpd/virtual-users.db
Redo the step 4 for the new user folder:
# mkdir /var/www/virtual/mynewuser
# chown ftp:ftp /var/www/virtual/mynewuser
That’ll do.
September 29th, 2009 at 8:51 pm
Great howto! Useful for a standalone set up but where can find one where I can set up virtual users and regular accounts all running on port 21? Meaning those with shell access and those without shell access can both use an ftp client on port 21.
I use pair networks and I have ftp access for my shell account and can set up virtual ftp accounts all on port 21.
October 30th, 2009 at 9:33 pm
I’d like to know the same thing… How do I set up vsftpd so that regular users (those in /etc/passwd) AND virtual users have access? Thx, B.
December 15th, 2009 at 5:20 pm
Excellent. Did it in 20 min. with ssl !!!!
Easier than I thought
December 23rd, 2009 at 6:06 am
How to I reset all pertinent config files resulting from previous attempts with other tutorials, in order to try a “pure” version of this one? I’m using centos. I’m not really hopeful that it would really make a difference, as this tutorial sets its own configuration files, so it shouldn’t be an issue, I guess. But anyway, if anyone knows about some easier way to do that (get rid of configuration files that may be conflicting), I’d like a lot to know. Thanks.
January 2nd, 2010 at 10:43 pm
I get this on debian lenny, when I run “db_load -T -t hash -f vsftpd_users.txt /etc/vsftpd/virtual-users.db”:
bash: db_load: command not found
????
January 7th, 2010 at 4:39 pm
yeah im getting same error as jacob
bash: db_load: command not found ??? any ideas im using ubuntu hardy
January 7th, 2010 at 4:51 pm
doesn’t matter i fixed it via using the following command
db4.2_load -T -t hash -f virtual-users.txt /etc/vsftpd/virtual-users.db
January 25th, 2010 at 6:35 pm
[...] Źródło: http://linuxforfun.net/2008/04/05/vsftpd-virtual-users/ [...]
February 7th, 2010 at 10:07 am
I get this error when starting the ftp server:
500 OOPS: could not bind listening IPv4 socket
Can anyone help?
March 12th, 2010 at 11:26 am
Is there anyway to have domain centric authentication ?
So domains example1.com and example2.com will have different users ?