There is a new version of this tutorial available for Debian 6 (Squeeze).

All the tools your team needs in one place. Slack: Where work happens.

Virtual Hosting With vsftpd And MySQL On Debian Etch - Page 2

This tutorial exists for these OS versions

4 Configure vsftpd

First we create a non-privileged user called vsftpd (with the homedir /home/vsftpd) belonging to the group nogroup. We will run vsftpd under this user, and the FTP directories of our virtual users will be in the /home/vsftpd directory (e.g. /home/vsftpd/user1, /home/vsftpd/user2, etc.).

useradd --home /home/vsftpd --gid nogroup -m --shell /bin/false vsftpd

Then we make a backup of the original /etc/vsftpd.conf file and create our own:

cp /etc/vsftpd.conf /etc/vsftpd.conf_orig
cat /dev/null > /etc/vsftpd.conf
vi /etc/vsftpd.conf

The file should have the following contents:

listen=YES
anonymous_enable=NO
local_enable=YES
write_enable=YES
local_umask=022
dirmessage_enable=YES
xferlog_enable=YES
connect_from_port_20=YES
nopriv_user=vsftpd
chroot_local_user=YES
secure_chroot_dir=/var/run/vsftpd
pam_service_name=vsftpd
rsa_cert_file=/etc/ssl/certs/vsftpd.pem
guest_enable=YES
guest_username=vsftpd
local_root=/home/vsftpd/$USER
user_sub_token=$USER
virtual_use_local_privs=YES
user_config_dir=/etc/vsftpd_user_conf

The configuration options are explained on http://vsftpd.beasts.org/vsftpd_conf.html. The important options for our virtual setup are chroot_local_user, guest_enable, guest_username, user_sub_token, local_root, and virtual_use_local_privs.

With the user_config_dir option you can specify a directory for per-user configuration files that override parts of the global settings. This is totally optional and up to you if you want to use this feature. However, we should create that directory now:

mkdir /etc/vsftpd_user_conf

Now we must configure PAM so that it uses the MySQL database to authenticate our virtual FTP users instead of /etc/passwd and /etc/shadow. The PAM configuration for vsftpd is in /etc/pam.d/vsftpd. We make a backup of the original file and create a new one like this:

cp /etc/pam.d/vsftpd /etc/pam.d/vsftpd_orig
cat /dev/null > /etc/pam.d/vsftpd
vi /etc/pam.d/vsftpd

auth required pam_mysql.so user=vsftpd passwd=ftpdpass host=localhost db=vsftpd table=accounts usercolumn=username passwdcolumn=pass crypt=2
account required pam_mysql.so user=vsftpd passwd=ftpdpass host=localhost db=vsftpd table=accounts usercolumn=username passwdcolumn=pass crypt=2

Please make sure that you replace the MySQL password with your own one!

Afterwards, we restart vsftpd:

/etc/init.d/vsftpd restart

5 Create The First Virtual User

To populate the database you can use the MySQL shell:

mysql -u root -p

USE vsftpd;

Now we create the virtual user testuser with the password secret (which will be stored encrypted using MySQL's PASSWORD function):

INSERT INTO accounts (username, pass) VALUES('testuser', PASSWORD('secret'));
quit;

testuser's homedir is /home/vsftpd/testuser; unfortunately vsftpd doesn't create that directory automatically if it doesn't exist. Therefore we create it manually now and make it owned by the vsftpd user and the nogroup group:

mkdir /home/vsftpd/testuser
chown vsftpd:nogroup /home/vsftpd/testuser

Now open your FTP client program on your work station (something like WS_FTP or SmartFTP if you are on a Windows system or gFTP on a Linux desktop) and try to connect. As hostname you use server1.example.com (or the IP address of the system), the username is testuser, and the password is secret.

If you are able to connect - congratulations! If not, something went wrong.

6 Database Administration

For most people it is easier if they have a graphical front-end to MySQL; therefore you can also use phpMyAdmin (in this example under http://server1.example.com/phpmyadmin/) to administrate the vsftpd database.

Whenever you create or modify a user, make sure that you use MySQL's PASSWORD function to encrypt that user's password. Also, when you create a new virtual user, please don't forget to create that user's homedir on the shell, as shown at the end of the previous chapter.

7 Links

vsftpd: http://vsftpd.beasts.org
Debian: http://www.debian.org

view as pdf | print

Share this page:

Sub pages

14 Comment(s)

Add comment

Comments

From: Alberto

sorry for my bad english.

i had the same problem, but a could fix it.

in /etc/pam.d/vsftpd, the encryption maybe be wrong, I use the crypt=0 and start to work.

again, sorry for my bad english.

Ó en español.

En el archivo /etc/pam.d/vsftpd, en vez de usar crypt=2, usa crypt=0, al parecer existe un error con la encriptacion de las contraseñas.

De igual forma, o en mi caso, tampoco utilize la funcion de "password" en la instruccion:

INSERT INTO accounts (username, pass) VALUES('testuser', PASSWORD('secret'));

quedando:

INSERT INTO accounts (username, pass) VALUES('testuser', 'secret');

Talvez por que se realiza una doble encriptacion: cuando se recive la contraseña y PAM la encripta y verifica con mysql, la cual ya se encuentra encriptada... solo una idea.

espero ayude a alguien, disculpen si no lo posteo en su totalidad en ingles, pero la verdad soy un poco malo para ello.

Excelente tutorial y saludos desde Monterrey, Mexico.

From: gunavara

Hi, i did everything exactly how it was written but i keep getting "login failed" when i try to log in with the testuser and the password secret.. any ideas ?

From:

You may want to change the following:

CREATE TABLE `accounts` (
`id` INT NOT NULL AUTO_INCREMENT PRIMARY KEY ,
`username` VARCHAR( 30 ) NOT NULL ,
`pass` VARCHAR( 50 ) NOT NULL ,
UNIQUE (
`username`
)
) ENGINE = MYISAM ;

To:

CREATE TABLE `accounts` (
`id` INT NOT NULL AUTO_INCREMENT PRIMARY KEY ,
`username` VARCHAR( 30 ) BINARY NOT NULL ,
`pass` VARCHAR( 50 ) NOT NULL ,
UNIQUE (
`username`
)
) ENGINE = MYISAM ;

To prevent this:

Connected to localhost (127.0.0.1).
220 (vsFTPd 2.0.5)
Name (localhost:nunya): testuser
331 Please specify the password.
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> quit
221 Goodbye.

Connected to localhost (127.0.0.1).
220 (vsFTPd 2.0.5)
Name (localhost:bizniss): Testuser
331 Please specify the password.
Password:
500 OOPS: cannot change directory:/home/virtual/Testuser
Login failed.
ftp>

From: gniady

HI. I was also need do symbolic links to outside directory. I found solution on that link: http://www.ducea.com/2006/07/27/allowing-ftp-access-to-files-outside-the-home-directory-chroot/

Solution is mount external directory on home dir. sorry for my bad english :)

From: fuzionhead

This was a good tutorial. I got it working with Ubuntu 8.10 server. I also used kabewm's suggestion (in comments). No problem. I also added a couple more fields to the table: Lastname, Firstname, comments, and email. Just for user tracking purposes...

The one thing that I had hoped to do but so far have been unable, is to have the user default to their home dir or a folder off of their home dir (like /home/user/www). I tried symbolic links and that didn't work and I'm not seeing an option to follow sym links in the man page for vsftpd.conf. If I find the solution, I will post it here.

From: Sanjeev

Hi:

Thanks for the tutorial. I followed through the steps to setup a ftp server with virtual user support on my ubuntu desktop machine. After completing the steps, when I start/restart the server, it gives me

" * Starting FTP server: vsftpd [ OK ] "

message, but

"ps -ef | grep vsftpd | grep -v grep"

gives me no output. Also, I fail to login to the ftp server (obviously).

My guess is that vsftpd is not starting up due to some reason. Can someone please tell me which log to look into to see what might be the trouble? I have checked and rechecked my config, nothing seems to be wrong :-(.

Please help!

From: noqqe

if you like to use fail2ban, too, you got to change the standard vsftpd-fail2ban configuration.

jail.local:

[vsftpd]

enabled = true
port = ftp
filter = vsftpd
logpath = /var/log/vsftpd.log
maxretry = 3

and change the standard filter for vsftpd

/etc/fail2ban/filter.d/vsftpd:

# Old Entry for pam auth.log
# failregex = vsftpd: $pam_unix$ authentication failure; .* rhost=<HOST>(?:\s+user=\S*)?\s*$

# New failregex for mysqlauth in vsftpd.log
failregex = .* FAIL LOGIN: Client \"<HOST>\"$

From: Anonymous

Hello,

thank you for this how to. t's the first tath I create an ftp server and I use linux. I configured the ftp and work very well. My question is: if I want a user "pippo" can read only folder pippo, how can apply this?

From: Planet.Admon.org

As a famous ftp daemon, it's really a pity that it has poor logs generated, only show you lots of 530 error. Even with the help of strace, you cannot see more details errors as well ...

From: Fran Quero

Great HowTo. Tested and working in Debian Squeeze stable.

Regards

From:

Thank you for creating this great tutorial.

Generally everything written in this tutorial went smooth except that I was not able to logon with an ftp-client.

After studying some logfiles I found some entries in /var/log/auth.log:

vsftpd: PAM unable to dlopen(/lib/security/pam_mysql.so): /lib/security/pam_mysq
vsftpd: PAM adding faulty module: /lib/security/pam_mysql.so

Since my ftp machine (ubuntu 10.04) was actually set up from scratch the pam_mysql.so module was missing and I installed it using:

sudo aptitude install libpam-mysql

Finally I think I had to restart vsftpd - but I'm not sure if this was really necessary.

Maybe that could help other users to solve their problems.

From: Lilltonka

Hi, and thank's for a great guide, used it on my Squeeze installation successfully.

However, i'm having trouble getting TLS to work with this setup. Anyone know how would i go about to set it up with the above setup?

Thanks again!

From: KarolinaJ

First of all, thank you for great tutorial, but I have a problem and don't know how to solve it.

I finished installing my server, I checked everything and seems like there wasn't any mistakes, but when I try to connect to ftp via explorer, it can not connet to server.

It writes: "Windows can not acces this folder. Make sure that you typed the file name correctly and that you have permission to acces this folder. A connection with servr can not be estableshed."

My configuration file is exactly the same like in this tutorial. This problem appears only when vsftpd.conf command anonymous_enable is set to NO.

Do you have any ideas what could be wrong and what should I check??

From: Norbert Crettol

Thank you for this clear and complete instructions.

I've just run into a problem: if you've a # in your mysql user password, the rest of the line in /etc/pam.d/vsftpd will be ignored.

Example:

auth required pam_mysql.so user=vsftpd passwd=My#Passwd123 host=localhost db=ftpusers table=accounts usercolumn=username passwdcolumn=passwd crypt=2
account required pam_mysql.so user=vsftpd passwd=My#Passwd123 host=localhost db=ftpusers table=accounts usercolumn=username passwdcolumn=passwd crypt=2

will fail with

vsftpd: pam_mysql - required option "db" is not set

in /var/log/auth.log

Changing the [email protected] password in mysql with another without any # solves the problem.

Norbert

Log in or Sign up