ProFTP & SuSe 10

Discussion in 'Server Operation' started by latcarf, Mar 9, 2006.

  1. latcarf

    latcarf New Member

    I ran the SuSe10 HowTo, made the init.d/proftpd file, then copied my proftpd.conf from my FC4 machine to the SuSe machine. A restart got
    Code:
    server1:~ #  - Fatal: unknown configuration directive 'AuthPAMConfig' on line 16 of '/etc/proftpd.conf'.
    I commented the 2 PAM lines out and the restart went well. I then went to my NAT and reset the Vserver from the FC4 machine IP to the SuSe10 machine IP. Can't connect to the ftp site from the web.

    I searched around for some possible answers first... I saw that I would probably need log files but I could not find any in /var/log ! Here is my conf though...
    Code:
    # This is the ProFTPD configuration file
    # $Id: proftpd.conf,v 1.1 2004/02/26 17:54:30 thias Exp $
    
    ServerName			"ProFTPD server"
    ServerIdent			on "FTP Server ready."
    ServerAdmin			root@localhost
    ServerType			standalone
    DefaultServer			on
    AccessGrantMsg			"User %u logged in."
    DeferWelcome			off
    
    # Use this to excude users from the chroot
    DefaultRoot			~ !adm
    
    # Use pam to authenticate (default) and be authoritative
    #AuthPAMConfig			proftpd
    #AuthOrder			mod_auth_pam.c* mod_auth_unix.c
    
    # Do not perform ident nor DNS lookups (hangs when the port is filtered)
    IdentLookups			off
    UseReverseDNS			off
    
    # Port 21 is the standard FTP port.
    Port				21
    
    # Umask 022 is a good standard umask to prevent new dirs and files
    # from being group and world writable.
    Umask				022
    
    # Default to show dot files in directory listings
    ListOptions			"-a"
    
    # Allow to resume not only the downloads but the uploads too
    AllowRetrieveRestart		on
    AllowStoreRestart		on
    
    # To prevent DoS attacks, set the maximum number of child processes
    # to 30.  If you need to allow more than 30 concurrent connections
    # at once, simply increase this value.  Note that this ONLY works
    # in standalone mode, in inetd mode you should use an inetd server
    # that allows you to limit maximum number of processes per service
    # (such as xinetd)
    MaxInstances			20
    
    # Set the user and group that the server normally runs at.
    User				ftp
    Group				ftp
    
    # This is where we want to put the pid file
    ScoreboardFile			/var/run/proftpd.score
    
    # Normally, we want users to do a few things.
    <Global>
      AllowOverwrite		no
      <Limit ALL SITE_CHMOD>
        AllowAll
      </Limit>
      <Limit MKD DELE RNFR RNTO>
        DenyAll
      </Limit>
    </Global>
    
    # Define the log formats
    LogFormat			default	"%h %l %u %t \"%r\" %s %b"
    LogFormat			auth	"%v [%P] %h %t \"%r\" %s"
    
    # anonymous configuration, with an upload directory.
    <Anonymous ~ftp>
      User				ftp
      Group				ftp
      AccessGrantMsg		"Anonymous login ok, restrictions apply."
    #
    #  # We want clients to be able to login with "anonymous" as well as "ftp"
      UserAlias			anonymous ftp
    
    #  # Limit the maximum number of anonymous logins
      MaxClients			10 "Sorry, max %m users -- try again later"
    
    # Put the user into /pub right after login
      DefaultChdir			/TheFarm
    
    # We want 'welcome.msg' displayed at login, '.message' displayed in
    # each newly chdired directory and tell users to read README* files. 
      DisplayLogin			/welcome.msg
    
    # Some more cosmetic and not vital stuff
    # DirFakeUser			on ftp
    # DirFakeGroup			on ftp
    
    # Limit WRITE everywhere in the anonymous chroot
      <Limit WRITE SITE_CHMOD>
        AllowAll
      </Limit>
    
    # An upload directory that allows storing files but not retrieving
    # or creating directories.
       <Directory /Plant&Harvest/*>
    	  AllowOverwrite		no
    	<Limit READ>
    	  AllowAll
    	</Limit>
    	<Limit STOR>
    	  AllowAll
    	</Limit>
      </Directory>
    
    # Logging for the anonymous transfers
      ExtendedLog		/var/log/proftpd/access.log WRITE,READ default
      ExtendedLog		/var/log/proftpd/auth.log AUTH auth
    
    </Anonymous>
    Thoughts on what I did wrong?

    Lance
     
  2. falko

    falko Super Moderator

    What exactly do you mean with that?

    Please post the output of
    Code:
    netstat -tap
     
  3. latcarf

    latcarf New Member

    That is my router... I have the FTP port to 21 and the IP pointing to the box with the running FTP. To test the new setup on the other box I have to go in and change the IP over to the new box. I guess I could set up another port and use it to test the other box could'nt I?

    Here is the netstat. I ran this before I posted and saw FTP open (or should that be proFTP?). Didn't think to post it after that, sorry.
    Code:
    Active Internet connections (servers and established)
    Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
    tcp        0      0 *:imaps                 *:*                     LISTEN      4885/xinetd
    tcp        0      0 *:cvspserver            *:*                     LISTEN      4885/xinetd
    tcp        0      0 *:pop3s                 *:*                     LISTEN      4885/xinetd
    tcp        0      0 *:printer               *:*                     LISTEN      4885/xinetd
    tcp        0      0 *:time                  *:*                     LISTEN      4885/xinetd
    tcp        0      0 *:smpnameres            *:*                     LISTEN      4885/xinetd
    tcp        0      0 *:sane-port             *:*                     LISTEN      4885/xinetd
    tcp        0      0 *:echo                  *:*                     LISTEN      4885/xinetd
    tcp        0      0 *:5801                  *:*                     LISTEN      4885/xinetd
    tcp        0      0 *:rsync                 *:*                     LISTEN      4885/xinetd
    tcp        0      0 *:5802                  *:*                     LISTEN      4885/xinetd
    tcp        0      0 *:netbios-ssn           *:*                     LISTEN      5252/smbd
    tcp        0      0 *:5803                  *:*                     LISTEN      4885/xinetd
    tcp        0      0 *:systat                *:*                     LISTEN      4885/xinetd
    tcp        0      0 *:vboxd                 *:*                     LISTEN      4885/xinetd
    tcp        0      0 *:5901                  *:*                     LISTEN      4885/xinetd
    tcp        0      0 *:pop2                  *:*                     LISTEN      4885/xinetd
    tcp        0      0 *:daytime               *:*                     LISTEN      4885/xinetd
    tcp        0      0 *:5902                  *:*                     LISTEN      4885/xinetd
    tcp        0      0 *:pop3                  *:*                     LISTEN      4885/xinetd
    tcp        0      0 *:5903                  *:*                     LISTEN      4885/xinetd
    tcp        0      0 *:netstat               *:*                     LISTEN      4885/xinetd
    tcp        0      0 *:imap                  *:*                     LISTEN      4885/xinetd
    tcp        0      0 *:sunrpc                *:*                     LISTEN      4573/portmap
    tcp        0      0 *:chargen               *:*                     LISTEN      4885/xinetd
    tcp        0      0 *:ftp                   *:*                     LISTEN      4885/xinetd
    tcp        0      0 server1:domain          *:*                     LISTEN      4949/named
    tcp        0      0 localhost:domain        *:*                     LISTEN      4949/named
    tcp        0      0 *:ipp                   *:*                     LISTEN      4964/cupsd
    tcp        0      0 *:smtp                  *:*                     LISTEN      5018/master
    tcp        0      0 localhost:953           *:*                     LISTEN      4949/named
    tcp        0      0 *:microsoft-ds          *:*                     LISTEN      5252/smbd
    tcp        0      0 *:www-http              *:*                     LISTEN      5382/httpd2-prefork
    tcp        0      0 *:domain                *:*                     LISTEN      4949/named
    tcp        0      0 *:ssh                   *:*                     LISTEN      4784/sshd
    tcp        0      0 *:smtp                  *:*                     LISTEN      5018/master
    tcp        0      0 localhost:953           *:*                     LISTEN      4949/named
    tcp        0      0 server1:www-http        c5850-a2-1-6:slp-notify TIME_WAIT   -
    tcp        0  18980 server1:www-http        c5850-a2-1-6:datacaptor ESTABLISHED 8119/httpd2-prefork
    tcp        0  18980 server1:www-http        c5850-a2-:gammafetchsvr ESTABLISHED 5655/httpd2-prefork
     
  4. falko

    falko Super Moderator

    Should be ok if you switch the IP addresses.

    Seems as if your FTP daemon is run by xinetd. Can you find an ftp related file in /etc/xinet.d?
     
  5. latcarf

    latcarf New Member

    Yes, this is because the HowTo for SuSue10 has us create one. I'll paste it here so you don't have to wonder somewhere else to see it...
    Code:
    #! /bin/sh
    # Copyright (c) 2000-2001 SuSE GmbH Nuernberg, Germany.
    # All rights reserved.
    #
    # Original author: Marius Tomaschewski <mt@suse.de>
    #
    # Slightly modified in 2003 for use with SuSE Linux 8.1,
    # by http://www.learnlinux.co.uk/
    #
    # Slightly modified in 2005 for use with SuSE Linux 9.2,
    # by Falko Timme
    #
    # /etc/init.d/proftpd
    #
    ### BEGIN INIT INFO
    # Provides:                proftpd
    # Required-Start:        $network $remote_fs $syslog $named
    # Required-Stop:
    # Default-Start:        3 5
    # Default-Stop:        0 1 2 6
    # Description:                Starts ProFTPD server
    ### END INIT INFO
    
    # Determine the base and follow a runlevel link name.
    base=${0##*/}
    link=${base#*[SK][0-9][0-9]}
    
    # Force execution if not called by a runlevel directory.
    test $link = $base && START_PROFTPD=yes  # Modified by learnlinux.co.uk
    test "$START_PROFTPD" = yes || exit 0    # Modified by learnlinux.co.uk
    
    # Return values acc. to LSB for all commands but
    # status (see below):
    #
    # 0 - success
    # 1 - generic or unspecified error
    # 2 - invalid or excess argument(s)
    # 3 - unimplemented feature (e.g. "reload")
    # 4 - insufficient privilege
    # 5 - program is not installed
    # 6 - program is not configured
    # 7 - program is not running
    
    proftpd_cfg="/etc/proftpd.conf"
    proftpd_bin="/usr/local/sbin/proftpd"
    proftpd_pid="/usr/local/var/proftpd.pid"
    
    [ -r $proftpd_cfg ] || exit 6
    [ -x $proftpd_bin ] || exit 5
    
    # Source status functions
    . /etc/rc.status
    
    # First reset status of this service
    rc_reset
    
    case "$1" in
        start)
      echo -n "Starting ProFTPD Server: "
      test -f /etc/shutmsg && rm -f /etc/shutmsg
      /sbin/startproc $proftpd_bin
      rc_status -v
      ;;
    
        stop)
      echo -n "Shutting down ProFTPD Server: "
      test -x /usr/local/sbin/ftpshut && /usr/local/sbin/ftpshut now && sleep 1
      /sbin/killproc -TERM $proftpd_bin
      test -f /etc/shutmsg && rm -f /etc/shutmsg
      rc_status -v
      ;;
    
        restart)
      ## If first returns OK call the second, if first or
      ## second command fails, set echo return value.
      $0 stop
      $0 start
      rc_status
      ;;
    
        try-restart)
      ## Stop the service and if this succeeds (i.e. the
      ## service was running before), start it again.
      ## Note: not (yet) part of LSB (as of 0.7.5)
      $0 status >/dev/null &&  $0 restart
      rc_status
      ;;
    
        reload|force-reload)
      ## Exclusive possibility: Some services must be stopped
      ## and started to force a new load of the configuration.
      echo -n "Reload ProFTPD Server: "
      /sbin/killproc -HUP $proftpd_bin
      rc_status -v
      ;;
    
        status)
      # Status has a slightly different for the status command:
      # 0 - service running
      # 1 - service dead, but /var/run/  pid  file exists
      # 2 - service dead, but /var/lock/ lock file exists
      # 3 - service not running
      echo -n "Checking for ProFTPD Server: "
      checkproc $proftpd_bin
      rc_status -v
      ;;
    
        probe)
      ## Optional: Probe for the necessity of a reload,
      ## give out the argument which is required for a reload.
      [ $proftpd_cfg -nt $proftpd_pid ] && echo reload
      ;;
    
        *)
      echo "Usage: $0 {start|stop|status|restart|reload|try-restart|probe}"
      exit 1
      ;;
    esac
    
    # Set an exit status.
    rc_exit
     
  6. falko

    falko Super Moderator

    No, I don't mean /etc/init.d, I mean /etc/xinetd.d!
     
  7. latcarf

    latcarf New Member

    lol... if it were not for us newbs there would be no Linux humor! :rolleyes: Yes there is an xinetd.d file...
    Code:
    #
    # xinetd.conf
    #
    # Copyright (c) 1998-2001 SuSE GmbH Nuernberg, Germany.
    # Copyright (c) 2002 SuSE Linux AG, Nuernberg, Germany.
    #
    
    defaults
    {
    	log_type        = FILE /var/log/xinetd.log 
            log_on_success  = HOST EXIT DURATION
    	log_on_failure	= HOST ATTEMPT
    #        only_from       = localhost
            instances       = 30
    	cps		= 50 10
    
    #
    # The specification of an interface is interesting, if we are on a firewall.
    # For example, if you only want to provide services from an internal
    # network interface, you may specify your internal interfaces IP-Address.
    #
    #	interface	= 127.0.0.1
    
    }
    
    includedir /etc/xinetd.d
    I also noticed a vsftpd.conf file, could proftp and vsftp be conflicting with each other? Seems in the HowTo for FC4 we removed vsftp but I don't recall that being in the HowTo for SuSe10. vsftpd.conf --->
    Code:
    # Example config file /etc/vsftpd.conf
    #
    # The default compiled in settings are fairly paranoid. This sample file
    # loosens things up a bit, to make the ftp daemon more usable.
    # Please see vsftpd.conf.5 for all compiled in defaults.
    #
    # If you do not change anything here you will have a minimum setup for an
    # anonymus FTP server.
    #
    # READ THIS: This example file is NOT an exhaustive list of vsftpd options.
    # Please read the vsftpd.conf.5 manual page to get a full idea of vsftpd's
    # capabilities.
    
    # General Settings
    #
    # Uncomment this to enable any form of FTP write command.
    #
    #write_enable=YES
    #
    # Activate directory messages - messages given to remote users when they
    # go into a certain directory.
    #
    dirmessage_enable=YES
    #
    # It is recommended that you define on your system a unique user which the
    # ftp server can use as a totally isolated and unprivileged user.
    #
    #nopriv_user=ftpsecure
    #
    # You may fully customise the login banner string:
    #
    #ftpd_banner="Welcome to FOOBAR FTP service."
    #
    # You may activate the "-R" option to the builtin ls. This is disabled by
    # default to avoid remote users being able to cause excessive I/O on large
    # sites. However, some broken FTP clients such as "ncftp" and "mirror" assume
    # the presence of the "-R" option, so there is a strong case for enabling it.
    #
    #ls_recurse_enable=YES
    #
    # You may specify a file of disallowed anonymous e-mail addresses. Apparently
    # useful for combatting certain DoS attacks.
    #
    #deny_email_enable=YES
    #
    # (default follows)
    #
    #banned_email_file=/etc/vsftpd.banned_emails
    #
    # If  enabled,  all  user  and  group  information in
    # directory listings will be displayed as "ftp".
    #
    #hide_ids=YES
    
    # Local FTP user Settings
    # 
    # Uncomment this to allow local users to log in.
    #
    #local_enable=YES
    #
    # Default umask for local users is 077. You may wish to change this to 022,
    # if your users expect that (022 is used by most other ftpd's)
    #
    #local_umask=022
    #
    # Uncomment to put local users in a chroot() jail in their home directory
    # after login.
    #
    #chroot_local_user=YES
    #
    # You may specify an explicit list of local users to chroot() to their home
    # directory. If chroot_local_user is YES, then this list becomes a list of
    # users to NOT chroot().
    #
    #chroot_list_enable=YES
    #
    # (default follows)
    #
    #chroot_list_file=/etc/vsftpd.chroot_list
    #
    # The maximum data transfer rate permitted, in bytes per second, for
    # local authenticated users. The default is 0 (unlimited).
    #
    #local_max_rate=7200
    
    
    # Anonymus FTP user Settings
    #
    # Allow anonymous FTP?
    #
    anonymous_enable=YES
    #
    # Anonymous users will only be allowed to download files which are
    # world readable.
    #
    anon_world_readable_only=YES
    #
    # Uncomment this to allow the anonymous FTP user to upload files. This only
    # has an effect if the above global write enable is activated. Also, you will
    # obviously need to create a directory writable by the FTP user.
    #
    #anon_upload_enable=YES
    #
    # Default umask for anonymus users is 077. You may wish to change this to 022,
    # if your users expect that (022 is used by most other ftpd's)
    #
    #anon_umask=022
    #
    # Uncomment this if you want the anonymous FTP user to be able to create
    # new directories.
    #
    #anon_mkdir_write_enable=YES
    #
    # Uncomment this to enable anonymus FTP users to perform other write operations
    # like deletion and renaming.
    #
    #anon_other_write_enable=YES
    #
    # If you want, you can arrange for uploaded anonymous files to be owned by
    # a different user. Note! Using "root" for uploaded files is not
    # recommended!
    #
    #chown_uploads=YES
    #chown_username=whoever
    #
    # The maximum data transfer rate permitted, in bytes per second, for anonymous
    # authenticated users. The default is 0 (unlimited).
    #
    #anon_max_rate=7200
    
    
    # Log Settings
    #
    # Log to the syslog daemon instead of using an logfile.
    #
    syslog_enable=YES
    #
    # Uncomment this to log all FTP requests and responses.
    #
    #log_ftp_protocol=YES
    #
    # Activate logging of uploads/downloads.
    #
    #xferlog_enable=YES
    #
    # You may override where the log file goes if you like. The default is shown
    # below.
    #
    #vsftpd_log_file=/var/log/vsftpd.log
    # 
    # If you want, you can have your log file in standard ftpd xferlog format.
    # Note: This disables the normal logging unless you enable dual_log_enable below. 
    #
    #xferlog_std_format=YES
    #
    # You may override where the log file goes if you like. The default is shown
    # below.
    #
    #xferlog_file=/var/log/xferlog
    #
    # Enable this to have booth logfiles. Standard xferlog and vsftpd's own style log.
    #
    #dual_log_enable=YES
    #
    # Uncomment this to enable session status information in the system process listing.
    #
    #setproctitle_enable=YES
    
    # Transfer Settings
    #
    # Make sure PORT transfer connections originate from port 20 (ftp-data).
    #
    connect_from_port_20=YES
    #
    # You may change the default value for timing out an idle session.
    #
    #idle_session_timeout=600
    #
    # You may change the default value for timing out a data connection.
    #
    #data_connection_timeout=120
    #
    # Enable this and the server will recognise asynchronous ABOR requests. Not
    # recommended for security (the code is non-trivial). Not enabling it,
    # however, may confuse older FTP clients.
    #
    #async_abor_enable=YES
    #
    # By default the server will pretend to allow ASCII mode but in fact ignore
    # the request. Turn on the below options to have the server actually do ASCII
    # mangling on files when in ASCII mode.
    # Beware that turning on ascii_download_enable enables malicious remote parties
    # to consume your I/O resources, by issuing the command "SIZE /big/file" in
    # ASCII mode.
    # These ASCII options are split into upload and download because you may wish
    # to enable ASCII uploads (to prevent uploaded scripts etc. from breaking),
    # without the DoS risk of SIZE and ASCII downloads. ASCII mangling should be
    # on the client anyway..
    #
    #ascii_upload_enable=YES
    #ascii_download_enable=YES
    #
    # Set to NO if you want to disallow the  PASV  method of obtaining a data
    # connection.
    #
    #pasv_enable=NO
    
    # PAM setting. Do NOT change this unless you know what you do!
    #
    pam_service_name=vsftpd
    
    # Set listen=YES if you want vsftpd to run standalone
    #
    # listen=YES
     
  8. falko

    falko Super Moderator

    Now you posted /etc/xinetd.conf, but I want you to have a look in the /etc/xinetd.d directory for some FTP related file.
    My guess is that there's another FTP running (controlled by xinetd); it can't be ProFTPd because in /etc/proftpd.conf it says that ProFTPd is run standalone.
     
  9. latcarf

    latcarf New Member

    oops! well... now I am in Michigan for the weekend and won't be able to access the box until Sunday evening. :( In SuSe10, Yast, Network Services there is a program called "FFTP" (has a shoe for an icon) but I thought I turned it off.

    How would I post a directory? screen shot?
     
  10. falko

    falko Super Moderator

    No, I don't want you to post a directory, I want you to have a look into that directory and see if there's some FTP related file. If you find one, post its contents here.

    If you're in doubt, please post the output of
    Code:
    ls -la /etc/xinetd.d/
     
  11. latcarf

    latcarf New Member

    I am away for the weekend but I will take a look tonight when I get home. :)
     
  12. latcarf

    latcarf New Member

    Okay in /etc/xinetd.d/ I found 2 files that are clearly FTP...

    tftp
    Code:
    # default: off
    # description: tftp service is provided primarily for booting or when a \
    # 	router need an upgrade. Most sites run this only on machines acting as
    # 	"boot servers".
    service tftp
    {
    	socket_type     = dgram
    	protocol        = udp
    	wait            = yes
    	user            = root
    	server          = /usr/sbin/in.tftpd
    	server_args     = -s /tftpboot
    	disable         = yes
    }
    and vsftp
    Code:
    # default: off
    # description:
    #   The vsftpd FTP server serves FTP connections. It uses
    #   normal, unencrypted usernames and passwords for authentication.
    # vsftpd is designed to be secure.
    #
    # NOTE: This file contains the configuration for xinetd to start vsftpd.
    #       the configuration file for vsftp itself is in /etc/vsftpd.conf
    service ftp
    {
    #        server_args             =
    #        log_on_success          += DURATION USERID
    #        log_on_failure          += USERID
    #        nice                    = 10
    	socket_type     = stream
    	protocol        = tcp
    	wait            = no
    	user            = root
    	server          = /usr/sbin/vsftpd
    }
    and the output of ls -la /etc/xinetd.d/
    Code:
    drwxr-xr-x    2 root root  704 Feb 27 20:13 .
    drwxr-xr-x  105 root root 9088 Mar 12 18:36 ..
    -rw-r--r--    1 root root  228 Feb 27 20:10 chargen
    -rw-r--r--    1 root root  248 Feb 27 20:10 chargen-udp
    -rw-r--r--    1 root root  260 Feb 27 20:10 cups-lpd
    -rw-r--r--    1 root root  376 Feb 27 20:10 cvs
    -rw-r--r--    1 root root  228 Feb 27 20:10 daytime
    -rw-r--r--    1 root root  248 Feb 27 20:10 daytime-udp
    -rw-r--r--    1 root root  220 Feb 27 20:10 echo
    -rw-r--r--    1 root root  239 Feb 27 20:10 echo-udp
    -rw-r--r--    1 root root  404 Feb 27 20:10 fam
    -rw-r--r--    1 root root  167 Feb 27 20:10 i4l-vbox
    -rw-r--r--    1 root root  985 Feb 27 20:10 imap
    -rw-r--r--    1 root root  364 Feb 27 20:10 nagios-nrpe
    -rw-r--r--    1 root root  480 Feb 27 20:10 netstat
    -rw-r--r--    1 root root  216 Feb 27 20:10 qpopper
    -rw-r--r--    1 root root  234 Feb 27 20:10 rsync
    -rw-r--r--    1 root root  338 Feb 27 20:10 sane-port
    -rw-r--r--    1 root root  237 Feb 27 20:10 servers
    -rw-r--r--    1 root root  239 Feb 27 20:10 services
    -rw-r--r--    1 root root  111 Feb 27 20:13 smb
    -rw-r--r--    1 root root  248 Feb 27 20:10 swat
    -rw-r--r--    1 root root  462 Feb 27 20:10 systat
    -rw-r--r--    1 root root  387 Mar  8 18:51 tftp
    -rw-r--r--    1 root root  254 Feb 27 20:10 time
    -rw-r--r--    1 root root  248 Feb 27 20:10 time-udp
    -rw-r--r--    1 root root 2400 Feb 27 20:10 vnc
    -rw-r--r--    1 root root  653 Feb 27 20:10 vsftpd
    
     
  13. falko

    falko Super Moderator

    Put
    Code:
    disable         = yes
    into /etc/xinetd.d/vsftp:

    Code:
    # default: off
    # description:
    #   The vsftpd FTP server serves FTP connections. It uses
    #   normal, unencrypted usernames and passwords for authentication.
    # vsftpd is designed to be secure.
    #
    # NOTE: This file contains the configuration for xinetd to start vsftpd.
    #       the configuration file for vsftp itself is in /etc/vsftpd.conf
    service ftp
    {
    #        server_args             =
    #        log_on_success          += DURATION USERID
    #        log_on_failure          += USERID
    #        nice                    = 10
    	socket_type     = stream
    	protocol        = tcp
    	wait            = no
    	user            = root
    	server          = /usr/sbin/vsftpd
            disable         = yes
    }
    and restart xinetd:
    Code:
    /etc/init.d/xinetd restart
    Then restart ProFTPd:
    Code:
    /etc/init.d/proftpd restart
     
  14. latcarf

    latcarf New Member

    I did this and still can't go to the site. I have looked at everything again and just cannot seem to find the missing link.

    One thing I noticed that is different is that in FC4 the ftp directory was in /var, in SuSe10 it is in /srv. Maybe using my FC4 proftpd.conf is conflicting with this but I cannot see how since /etc/init.d/proftpd is pointing to /etc/proftpd.conf.

    In SuSe the log files are not in /var/log but I guess they won't generate until I can actually get to the site and log in, is that correct?
     
  15. falko

    falko Super Moderator

    What does
    Code:
    netstat -tap
    show?

    That's right.
     
  16. latcarf

    latcarf New Member

    Code:
    Active Internet connections (servers and established)
    Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
    tcp        0      0 *:imaps                 *:*                     LISTEN      18733/xinetd
    tcp        0      0 *:cvspserver            *:*                     LISTEN      18733/xinetd
    tcp        0      0 *:pop3s                 *:*                     LISTEN      18733/xinetd
    tcp        0      0 *:printer               *:*                     LISTEN      18733/xinetd
    tcp        0      0 *:time                  *:*                     LISTEN      18733/xinetd
    tcp        0      0 *:smpnameres            *:*                     LISTEN      18733/xinetd
    tcp        0      0 *:sane-port             *:*                     LISTEN      18733/xinetd
    tcp        0      0 *:echo                  *:*                     LISTEN      18733/xinetd
    tcp        0      0 *:5801                  *:*                     LISTEN      18733/xinetd
    tcp        0      0 *:rsync                 *:*                     LISTEN      18733/xinetd
    tcp        0      0 *:5802                  *:*                     LISTEN      18733/xinetd
    tcp        0      0 *:5803                  *:*                     LISTEN      18733/xinetd
    tcp        0      0 *:systat                *:*                     LISTEN      18733/xinetd
    tcp        0      0 *:netbios-ssn           *:*                     LISTEN      5346/smbd
    tcp        0      0 *:vboxd                 *:*                     LISTEN      18733/xinetd
    tcp        0      0 *:5901                  *:*                     LISTEN      18733/xinetd
    tcp        0      0 *:pop2                  *:*                     LISTEN      18733/xinetd
    tcp        0      0 *:daytime               *:*                     LISTEN      18733/xinetd
    tcp        0      0 *:5902                  *:*                     LISTEN      18733/xinetd
    tcp        0      0 *:pop3                  *:*                     LISTEN      18733/xinetd
    tcp        0      0 *:5903                  *:*                     LISTEN      18733/xinetd
    tcp        0      0 *:netstat               *:*                     LISTEN      18733/xinetd
    tcp        0      0 *:imap                  *:*                     LISTEN      18733/xinetd
    tcp        0      0 *:sunrpc                *:*                     LISTEN      4674/portmap
    tcp        0      0 *:chargen               *:*                     LISTEN      18733/xinetd
    tcp        0      0 *:ftp                   *:*                     LISTEN      20567/proftpd: (acc
    tcp        0      0 server1:domain          *:*                     LISTEN      4926/named
    tcp        0      0 localhost:domain        *:*                     LISTEN      4926/named
    tcp        0      0 *:ipp                   *:*                     LISTEN      4933/cupsd
    tcp        0      0 *:smtp                  *:*                     LISTEN      5084/master
    tcp        0      0 localhost:953           *:*                     LISTEN      4926/named
    tcp        0      0 *:microsoft-ds          *:*                     LISTEN      5346/smbd
    tcp        0      0 *:www-http              *:*                     LISTEN      5455/httpd2-prefork
    tcp        0      0 *:domain                *:*                     LISTEN      4926/named
    tcp        0      0 *:ssh                   *:*                     LISTEN      4907/sshd
    tcp        0      0 *:smtp                  *:*                     LISTEN      5084/master
    tcp        0      0 localhost:953           *:*                     LISTEN      4926/named
    If I am reading this right it shows it running...

    I have my router set to the SuSe box which is 192.168.2.3 21:21 but the ftp site is still currently running off the FC4 box 192.168.2.5. As soon as I go into the FC4 box and run service proftpd stop and try to go to the ftp site I get "the connection refused" message. Same process I went though with www until I finally got it configured correctly.
     
    Last edited: Mar 14, 2006
  17. falko

    falko Super Moderator

    Yes, ProFTPd is running.

    Please check your router settings again. Maybe you must restart it.
     
  18. latcarf

    latcarf New Member

    I have tried that without success... however, I believe I have found the problem. In SuSe Yast, Security and Users, Firewall there is an "Allowed Services" section. The only services that appear to be allowed are HTTP and Samba. When I click the Services to Allow list to add another service proftpd (or vsftpd) are not listed, only tftp. Seems all I have to do is figure out how to add proftpd or set the firewall outside of Yast. maybe....
     
  19. falko

    falko Super Moderator

    Sounds reasonable. :)
     
  20. latcarf

    latcarf New Member

    SuSe Reload, proftpd to vsftpd

    I never could get proftpd to work and hosed SuSe YaST in the process. I did a fresh load of SuSe and decided to try vsftpd since it comes with the distro.

    I had some issues which I attribute to being a newb :D I have one last problem I cannot seem to figure out... I can connect via Konsole and Internet, no problem. I cannot transfer (write) to the site, problem. I think I have the conf correct but here it is, anyone see anything wrong?
    Code:
    # Example config file /etc/vsftpd.conf
    #
    # The default compiled in settings are fairly paranoid. This sample file
    # loosens things up a bit, to make the ftp daemon more usable.
    # Please see vsftpd.conf.5 for all compiled in defaults.
    #
    # If you do not change anything here you will have a minimum setup for an
    # anonymus FTP server.
    #
    # READ THIS: This example file is NOT an exhaustive list of vsftpd options.
    # Please read the vsftpd.conf.5 manual page to get a full idea of vsftpd's
    # capabilities.
    
    # General Settings
    #
    # Uncomment this to enable any form of FTP write command.
    #
    write_enable=YES
    #
    # Activate directory messages - messages given to remote users when they
    # go into a certain directory.
    #
    dirmessage_enable=YES
    #
    # It is recommended that you define on your system a unique user which the
    # ftp server can use as a totally isolated and unprivileged user.
    #
    #nopriv_user=ftpsecure
    #
    # You may fully customise the login banner string:
    #
    ftpd_banner="Welcome to The Fractal Farm FTP service."
    #
    # You may activate the "-R" option to the builtin ls. This is disabled by
    # default to avoid remote users being able to cause excessive I/O on large
    # sites. However, some broken FTP clients such as "ncftp" and "mirror" assume
    # the presence of the "-R" option, so there is a strong case for enabling it.
    #
    #ls_recurse_enable=YES
    #
    # You may specify a file of disallowed anonymous e-mail addresses. Apparently
    # useful for combatting certain DoS attacks.
    #
    #deny_email_enable=YES
    #
    # (default follows)
    #
    #banned_email_file=/etc/vsftpd.banned_emails
    #
    # If  enabled,  all  user  and  group  information in
    # directory listings will be displayed as "ftp".
    #
    #hide_ids=YES
    
    
    # Local FTP user Settings
    # 
    # Uncomment this to allow local users to log in.
    #
    local_enable=YES
    #
    # Default umask for local users is 077. You may wish to change this to 022,
    # if your users expect that (022 is used by most other ftpd's)
    #
    #local_umask=022
    #
    # Uncomment to put local users in a chroot() jail in their home directory
    # after login.
    #
    #chroot_local_user=YES
    #
    # You may specify an explicit list of local users to chroot() to their home
    # directory. If chroot_local_user is YES, then this list becomes a list of
    # users to NOT chroot().
    #
    #chroot_list_enable=YES
    #
    # (default follows)
    #
    #chroot_list_file=/etc/vsftpd.chroot_list
    #
    # The maximum data transfer rate permitted, in bytes per second, for
    # local authenticated users. The default is 0 (unlimited).
    #
    #local_max_rate=7200
    
    
    # Anonymus FTP user Settings
    #
    # Allow anonymous FTP?
    #
    anonymous_enable=YES
    #
    # Anonymous users will only be allowed to download files which are
    # world readable.
    #
    anon_world_readable_only=YES
    #
    # Uncomment this to allow the anonymous FTP user to upload files. This only
    # has an effect if the above global write enable is activated. Also, you will
    # obviously need to create a directory writable by the FTP user.
    #
    anon_upload_enable=YES
    #
    # Default umask for anonymus users is 077. You may wish to change this to 022,
    # if your users expect that (022 is used by most other ftpd's)
    #
    #anon_umask=022
    #
    # Uncomment this if you want the anonymous FTP user to be able to create
    # new directories.
    #
    #anon_mkdir_write_enable=YES
    #
    # Uncomment this to enable anonymus FTP users to perform other write operations
    # like deletion and renaming.
    #
    #anon_other_write_enable=YES
    #
    # If you want, you can arrange for uploaded anonymous files to be owned by
    # a different user. Note! Using "root" for uploaded files is not
    # recommended!
    #
    #chown_uploads=YES
    #chown_username=whoever
    #
    # The maximum data transfer rate permitted, in bytes per second, for anonymous
    # authenticated users. The default is 0 (unlimited).
    #
    #anon_max_rate=7200
    
    
    # Log Settings
    #
    # Log to the syslog daemon instead of using an logfile.
    #
    syslog_enable=YES
    #
    # Uncomment this to log all FTP requests and responses.
    #
    #log_ftp_protocol=YES
    #
    # Activate logging of uploads/downloads.
    #
    #xferlog_enable=YES
    #
    # You may override where the log file goes if you like. The default is shown
    # below.
    #
    #vsftpd_log_file=/var/log/vsftpd.log
    # 
    # If you want, you can have your log file in standard ftpd xferlog format.
    # Note: This disables the normal logging unless you enable dual_log_enable below. 
    #
    #xferlog_std_format=YES
    #
    # You may override where the log file goes if you like. The default is shown
    # below.
    #
    #xferlog_file=/var/log/xferlog
    #
    # Enable this to have booth logfiles. Standard xferlog and vsftpd's own style log.
    #
    #dual_log_enable=YES
    #
    # Uncomment this to enable session status information in the system process listing.
    #
    #setproctitle_enable=YES
    
    
    # Transfer Settings
    #
    # Make sure PORT transfer connections originate from port 20 (ftp-data).
    #
    connect_from_port_20=YES
    #
    # You may change the default value for timing out an idle session.
    #
    #idle_session_timeout=600
    #
    # You may change the default value for timing out a data connection.
    #
    #data_connection_timeout=120
    #
    # Enable this and the server will recognise asynchronous ABOR requests. Not
    # recommended for security (the code is non-trivial). Not enabling it,
    # however, may confuse older FTP clients.
    #
    #async_abor_enable=YES
    #
    # By default the server will pretend to allow ASCII mode but in fact ignore
    # the request. Turn on the below options to have the server actually do ASCII
    # mangling on files when in ASCII mode.
    # Beware that turning on ascii_download_enable enables malicious remote parties
    # to consume your I/O resources, by issuing the command "SIZE /big/file" in
    # ASCII mode.
    # These ASCII options are split into upload and download because you may wish
    # to enable ASCII uploads (to prevent uploaded scripts etc. from breaking),
    # without the DoS risk of SIZE and ASCII downloads. ASCII mangling should be
    # on the client anyway..
    #
    #ascii_upload_enable=YES
    #ascii_download_enable=YES
    #
    # Set to NO if you want to disallow the  PASV  method of obtaining a data
    # connection.
    #
    pasv_enable=YES
    #
    # PAM setting. Do NOT change this unless you know what you do!
    #
    pam_service_name=vsftpd
    #
    # Set listen=YES if you want vsftpd to run standalone
    #
    listen=YES
    I checked folder permissions and Groups and Users have permssions to View and Modify with only the Owner allowed to rename and delete.

    Here is netstat -tap just in case...
    Code:
    Active Internet connections (servers and established)
    Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
    tcp        0      0 *:printer               *:*                     LISTEN      29569/xinetd
    tcp        0      0 *:time                  *:*                     LISTEN      29569/xinetd
    tcp        0      0 *:smpnameres            *:*                     LISTEN      29569/xinetd
    tcp        0      0 *:sane-port             *:*                     LISTEN      29569/xinetd
    tcp        0      0 *:echo                  *:*                     LISTEN      29569/xinetd
    tcp        0      0 *:5801                  *:*                     LISTEN      29569/xinetd
    tcp        0      0 *:rsync                 *:*                     LISTEN      29569/xinetd
    tcp        0      0 *:5802                  *:*                     LISTEN      29569/xinetd
    tcp        0      0 *:5803                  *:*                     LISTEN      29569/xinetd
    tcp        0      0 *:systat                *:*                     LISTEN      29569/xinetd
    tcp        0      0 *:netbios-ssn           *:*                     LISTEN      26746/smbd
    tcp        0      0 *:5901                  *:*                     LISTEN      29569/xinetd
    tcp        0      0 *:daytime               *:*                     LISTEN      29569/xinetd
    tcp        0      0 *:5902                  *:*                     LISTEN      29569/xinetd
    tcp        0      0 *:5903                  *:*                     LISTEN      29569/xinetd
    tcp        0      0 *:netstat               *:*                     LISTEN      29569/xinetd
    tcp        0      0 *:sunrpc                *:*                     LISTEN      8013/portmap
    tcp        0      0 *:chargen               *:*                     LISTEN      29569/xinetd
    tcp        0      0 *:ftp                   *:*                     LISTEN      27830/vsftpd
    tcp        0      0 *:ipp                   *:*                     LISTEN      20511/cupsd
    tcp        0      0 localhost:smtp          *:*                     LISTEN      8209/master
    tcp        0      0 *:microsoft-ds          *:*                     LISTEN      26746/smbd
    tcp        0      0 *:www-http              *:*                     LISTEN      19489/httpd2-prefor
    tcp        0      0 *:ssh                   *:*                     LISTEN      8308/sshd
    tcp        0      0 localhost:smtp          *:*                     LISTEN      8209/master
    
    I always get this when I restart vsftpd and did some searching but really didn't see where it was a problem but I dont have enough experience yet to say it is not the problem
    Code:
    server1:~ # /usr/sbin/vsftpd &
    500 OOPS: could not bind listening IPv4 socket
    [1] 885
    [1]   Exit 1                  /usr/sbin/vsftpd
    server1:~ #
    Better yet... is "&" Start or Restart, and what is Stop!?

    (Up to now I have used Gnome but majority seems to think KDE is better so I went with it when I reloaded SuSe)
     

Share This Page