Ubuntu - FTP - VSFTP - Virtual users in VsFtpd

Virtual users are users that do not exist on the system - they are not in /etc/passwd, do not have a home directory on the system, can not login but in vsftpd - or if they do exist, they can login in vsftpd with a non system password - security.

You can set different definitions to each virtual user, granting to each of these users different permissions. If TLS/SSL/FTPS and virtual users are enabled, the level of security of your vsftpd server is increased: encrypted passwords, with passwords that are not used on the system, and users that can't access directly to their home directory (if you want).

The following example is based and adapted on the example for virtual users in vsftpd site, on documentation and the very good examples.

Currently there is a restriction that with guest_enable enabled, local users also get mapped to guest_username. This is a polite way to say that if the default vsftpd PAM file is used, the system users will be guests too. To avoid confusions change the PAM file used by vsftpd to authenticate only virtual users, make all vsftpd users as virtual users and set their passwords, home and permissions based on this example.

Create The Virtual Users Database

To create a “db4” format file to store usernames (another option here would be an apache htpasswd style file, not discussed), first create a plain text files with the usernames and password on alternating lines. For e.g. create user named “john” with password called “johnpass” and another user named “mark” with password “markpass”:

mkdir /etc/vsftpd # if necessary.
cd /etc/vsftpd
sudo vi vusers.txt

and populate the file:

john
johnpass
mark
markpass

Create the actual database file

NOTE: This may require the db_util package to be installed first.

db_load -T -t hash -f vusers.txt vsftpd-virtual-user.db 
chmod 600 vsftpd-virtual-user.db # make it not global readable.
rm vusers.txt

Configure VsFtpd for virtual user

Edit the VsFtpd configuration file (/etc/vsftpd.conf).

/etc/vsftpd.conf

vi /etc/vsftpd.conf

and add or modify as:

/etc/vsftpd.conf

anonymous_enable=NO
local_enable=YES
# Virtual users will use the same privileges as local users.
# It will grant write access to virtual users. Virtual users will use the
# same privileges as anonymous users, which tends to be more restrictive
# (especially in terms of write access).
virtual_use_local_privs=YES
write_enable=YES
 
# Set the name of the PAM service vsftpd will use
pam_service_name=vsftpd.virtual
 
# Activates virtual users
guest_enable=YES
 
# Automatically generate a home directory for each virtual user, based on a template.
# For example, if the home directory of the real user specified via guest_username is
# /home/virtual/$USER, and user_sub_token is set to $USER, then when virtual user vivek
# logs in, he will end up (usually chroot()'ed) in the directory /home/virtual/vivek.
# This option also takes affect if local_root contains user_sub_token.
user_sub_token=$USER
 
# Usually this is mapped to Apache virtual hosting docroot, so that
# Users can upload files
local_root=/home/vftp/$USER
 
# Chroot user and lock down to their home dirs
chroot_local_user=YES
 
# Hide ids from user
hide_ids=YES

Save and close the file.

Create a PAM File Which Uses Your New Database

The following PAM is used to authenticate users using your new database.

Create /etc/pam.d/vsftpd.virtual.

sudo vi /etc/pam.d/vsftpd.virtual

and add or modify as:

/etc/pam.d/vsftpd.virtual

#%PAM-1.0
auth       required     pam_userdb.so db=/etc/vsftpd/vsftpd-virtual-user
account    required     pam_userdb.so db=/etc/vsftpd/vsftpd-virtual-user
session    required     pam_loginuid.so

Create The Location Of The Files

You need to set up the location of the files / dirs for the virtual users. Type the following command:

mkdir /home/vftp

and then create sub-directories for each virtual user.

# mkdir -p /home/vftp/{john,mark}
# chown -R ftp:ftp /home/vftp

Restart The FTP Server

Type the following command:

service vsftpd restart

Test Your Setup

Open another shell session and type:

ftp localhost

Sample success output:

Connected to ftp.sharewiz.net.
Name (localhost:root): john
331 Please specify the password.[user now types in johnpass]
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp>

Troubleshooting

The official Vsftpd documentation at ftp://vsftpd.beasts.org/users/cevans/untar/vsftpd-3.0.2/EXAMPLE/VIRTUAL_USERS may be helpful.

By default files are created with permissions like -rw.

(and owned by the ftp user if using virtual users). To change this to something less restrictive (it defaults to 077, the above) then set local_umask=022 (for -rw-r–r– type permissions) in your vsftp.conf file and restart the service.

References

http://j.mp/YunkHV - vsftpd - Secure, fast FTP server for UNIX-like systems security.appspot.com Secure, fast FTP server for UNIX systems
http://j.mp/Yunor2 - vsftpd - Wikipedia, the free encyclopedia: en.wikipedia.org vsftpd, which stands for “Very Secure FTPDaemon”, is an FTP server for Unix-like systems, including Linux. It is licensed under the GNU General Public License. It supports IPv6 and SSL.

Table of Contents