I now have sftp working

Am Dienstag, 03. Mai 2022, um 13:46:30 Uhr schrieb Rick:

I now have sftp working

That is something completely different to ftp or ftps (FTP over
SSL/TLS).

I now have sftp working

Even with the security settings used here to set up vsftpd, you may want to consider sftp instead. sftp will encrypt the entire connection stream and is more secure for this reason. We've created a document here that deals with setting up sftp and the locking down SSH.

Am Dienstag, 03. Mai 2022, um 10:53:06 Uhr schrieb Carlos E.R.:

I tried to connect. Initially I got connection refused. True enough,
both the systemd service and sockets are disabled. Starting the
service complained that "vsftpd: not configured for standalone, must
be started from inetd". Okay, so disable service and start socket.
Then I could login instantly, and list my home directory.

There are 2 possibilities to run an ftp server:
With or without inetd.

inetd listens on port 21, does the TCP handshake and then starts
vsftpd. There is no vsftp service needed.

Without inetd, you need a service that runs all the time and listens on
port 21. IIRC this is the normal behavior of vsftpd.

I inserted this into the working .conf:

rsa_cert_file=/etc/ssl/private/vsftpd.pem
ssl_enable=YES
ssl_tlsv1=YES
ssl_sslv2=NO
ssl_sslv3=NO

And agson started getting login incorrect.

I inserted this into the working .conf:

rsa_cert_file=/etc/ssl/private/vsftpd.pem
ssl_enable=YES
ssl_tlsv1=YES
ssl_sslv2=NO
ssl_sslv3=NO

And agson started getting login incorrect.

On Tue, 3 May 2022 15:10:32 +0200, Marco Moock wrote:

Am Dienstag, 03. Mai 2022, um 06:23:13 Uhr schrieb Rick:

On Tue, 3 May 2022 10:43:05 +0200, Carlos E.R. wrote:

On 2022-05-03 01:32, Rick wrote:

On Tue, 3 May 2022 00:09:32 +0200, Carlos E.R. wrote:
  

On 2022-05-02 20:14, Rick wrote:

On Mon, 2 May 2022 19:57:34 +0200, Marco Moock wrote:
 

Am Montag, 02. Mai 2022, um 12:50:42 Uhr schrieb Rick:
 

I do not know what use database OpensSuse uses. I have no idea
how to find out.

Check the /etc/vsftpd.conf. Post the content here, but without
commented lines please.

anon_mkdir_write_enable=NO anon_root=/srv/ftp
anon_upload_enable=NO anonymous_enable=NO chroot_local_user=NO
ftpd_banner=No matter where you go, there you are.
idle_session_timeout=900 local_enable=YES local_root=/public_ftp
log_ftp_protocol=YES max_clients=10 max_per_ip=3 pasv_enable=YES
pasv_max_port=40500 pasv_min_port=40000
rsa_cert_file=/etc/ssl/private/vsftpd.pem ssl_enable=YES
ssl_tlsv1=YES ssl_sslv2=NO ssl_sslv3=NO write_enable=YES
xferlog_enable=YES

local_enable=YES local_root=/public_ftp

is a bit of a contradiction. With the first, a local user would go
to /home/username, but with "local_root" defined, it goes instead
to /public_ftp which must exist and be populated, I understand.

I have commented out /public_ftp

And you are using your normal user/password pair? Try with anonymous.

What release of openSUSE are you using?

Anonymous:
Status: Logged in Status: Retrieving directory listing...
Status: Server sent passive reply with unroutable address.
Using server address instead.

Command: LIST Error: Connection timed out after 20 seconds of
inactivity Error: Failed to retrieve directory listing

Use Wireshark to check the reply for the unroutable address. To which
address did you connect?

I have removed and reinstalled vsftpd.
I am using the stock vsftpd.conf file that came with the package.
I am not using ssl.
I configured vsftpd using YAST and manually.
vsftpd is set to start manually as a service.
Anonymous is enabled.
Anonymous is enabled to /srv/ftp

I did have passive ports listed in the router for forwarding, but they
weren't enabled. Now they are.

Changes made to the stock conf file:

syslog_enable=YES commented out
log_ftp_protocol=YES
xferlog_enable=YES
vsftpd_log_file=/var/log/vsftpd.log

I can now login as anonymous, with anonymous directory, and my user in my
home.
I can upload using anonymous.
I have created a user just for ftp. I can upload using that.

I'm going to backup the .conf file and then try to again use ssl, and
disable anonymous.
I'll report back.
Thanks for the help so far.

Why do you disable 2 and 3? Maybe that's the problem.

I'd still like to get vsftp working with ssl.

On 2022-05-03 16:39, Rick wrote:

I inserted this into the working .conf:

rsa_cert_file=/etc/ssl/private/vsftpd.pem ssl_enable=YES ssl_tlsv1=YES
ssl_sslv2=NO ssl_sslv3=NO

And agson started getting login incorrect.

Why do you disable 2 and 3? Maybe that's the problem.

On Wed, 4 May 2022 12:13:52 +0200, Carlos E.R. wrote:

On 2022-05-03 16:39, Rick wrote:

I inserted this into the working .conf:

rsa_cert_file=/etc/ssl/private/vsftpd.pem ssl_enable=YES ssl_tlsv1=YES
ssl_sslv2=NO ssl_sslv3=NO

And agson started getting login incorrect.

Why do you disable 2 and 3? Maybe that's the problem.

directions on the interent

Rick wrote:

On Wed, 4 May 2022 12:13:52 +0200, Carlos E.R. wrote:

On 2022-05-03 16:39, Rick wrote:

I inserted this into the working .conf:

rsa_cert_file=/etc/ssl/private/vsftpd.pem ssl_enable=YES
ssl_tlsv1=YES ssl_sslv2=NO ssl_sslv3=NO

And agson started getting login incorrect.

Why do you disable 2 and 3? Maybe that's the problem.

directions on the interent

You could always enable 2 and 3, disabling them again if it works.
I assume you are restarting vsftp after config changes.

On 2022-05-03 16:39, Rick wrote:

I inserted this into the working .conf:

rsa_cert_file=/etc/ssl/private/vsftpd.pem ssl_enable=YES ssl_tlsv1=YES
ssl_sslv2=NO ssl_sslv3=NO

And agson started getting login incorrect.

Ok, then it is a problem with the certificate, not really with login.
Try a different client.

Rick wrote:

I now have sftp working

I posted a general guide on how to get vsftp running a couple of days
ago (the docs.rockylinux.org link) and one of the things they said was:

Even with the security settings used here to set up vsftpd, you may
want to consider sftp instead. sftp will encrypt the entire connection
stream and is more secure for this reason. We've created a document
here that deals with setting up sftp and the locking down SSH.

(there's a link where the word "here" is, but you obviously don't need
it)

Am Dienstag, 03. Mai 2022, um 14:52:25 Uhr schrieb Rick:

I'd still like to get vsftp working with ssl.

ok, did you try to disable FTPS and just use plain FTP (just for the
test)?

Am Mittwoch, 04. Mai 2022, um 12:13:52 Uhr schrieb Carlos E.R.:

Why do you disable 2 and 3? Maybe that's the problem.

These are really old versions that have known vulnerabilities.

Wouldn't version 1 be even older and more vulnerable?

I'm not sure how to disable FTPS... if you mean SFTP, I don't know
how to do that either.

I generated a new certificate. The system recognizes the certificate,
and then again says incorrect login.

Am Mittwoch, 04. Mai 2022, um 15:37:28 Uhr schrieb Rick:

I generated a new certificate. The system recognizes the certificate,
and then again says incorrect login.

Then please test without TLS. The normal FTP login does no require a
certificate nor a private key, they are only needed for SSL/TLS.

Am Mittwoch, 04. Mai 2022, um 15:50:19 Uhr schrieb Rick:

I'm not sure how to disable FTPS... if you mean SFTP, I don't know how
to do that either.

SFTP is via SSH and is not FTP.
FTPS is FTP inside an SSL or TLS tunnel.
This should be controllable via the ssl_enable setting.

On Thu, 5 May 2022 12:34:04 +0200, Marco Moock wrote:

Am Mittwoch, 04. Mai 2022, um 15:50:19 Uhr schrieb Rick:

I'm not sure how to disable FTPS... if you mean SFTP, I don't know how
to do that either.

SFTP is via SSH and is not FTP.
FTPS is FTP inside an SSL or TLS tunnel.
This should be controllable via the ssl_enable setting.

When I rmove the ssl from the .conf, and set filezill to use plain ftp, I
can login. I can also use "explicit ftp over TLS if available" without ssl
enable but get "Insecure server, it does not support FTP over TLS" and am
able to log in.
When I enable the ssl settings, and set FileZilla to use "explicit ftp
over TLS if available" I get login incorrect.

When I remove ssl from the .conf, no security, I can log in.