Dealing with the Dinosaurs of IT: Setting up vsftpd on Ubuntu

By |Published On: May 14th, 2015|Tags: |

Although File Transfer Protocol (FTP) is easy to set up, fast, and a widely-used way to transmit files between two remote hosts, it has the downside of being an insecure protocol. Sometimes FTP is okay for files that aren’t as sensitive; however, there are going to be other times when you’re not going to want the possibility of eavesdroppers retrieving your confidential information.

This is where Secure File Transfer Protocol (SFTP) has the advantage of ensuring that file transmission will be secure and prevent unauthorized access. With SFTP, data is encrypted while being passed between client and server, which provides a layer of protection that FTP doesn’t have.

So, now that I’ve given you a little a refresher on FTP and SFTP, I want to share an interesting issue I ran into the other day.

I was working on setting up a new SFTP server with the following requirements:

  1. A particular legacy device, that was not capable of using SFTP, needed to connect to the server with FTP. (Sometimes older mainframe systems, also known as the “dinosaurs of information technology,” have environments that don’t understand SFTP.)
  2. All other users called for having their own SFTP directory access as before.
  3. The FTP user required access to one of the same directories that the SFTP user needed.

Alright, so, not a big deal. I decided I would just set up SFTP and FTP side-by-side and restrict who is allowed to FTP to the box. I figured I could do this with symlinks, but nope. Filezilla (the client of choice in this case) saw the symlink as a file and wouldn’t recognize it as a separate directory.

I then realized I would have to attack this from a slightly different angle, which was to set up Very Secure FTP Daemon (vsftpd).

Following these instructions from the article: “How to setup FTP server on ubuntu 14.04 (VSFTPD)”, I was able to setup vsftpd and ssh for SFTP.

Here are the steps:

Step 1 » Update repositories:

Copy to Clipboard

Step 2 » Install vsftpd package using the below command:

Copy to Clipboard

Step 3 » After installation open /etc/vsftpd.conf file and make changes as follows:

Uncomment the below lines (line no:29 and 33).

Copy to Clipboard

» Uncomment the below line (line no: 120 ) to prevent access to the other folders outside the Home Directory:

Copy to Clipboard

and add the following line at the end:

Copy to Clipboard

» Add the following lines to enable passive mode:

Copy to Clipboard

Step 4 » Restart vsftpd service using the command below:

Copy to Clipboard

Step 5 » Now ftp server will listen on Port 21. Create user with the below command. Use /usr/sbin/nologin shell to prevent access to the bash shell for the ftp users:

Copy to Clipboard

Step 6 » Allow login access for nologin shell. Open /etc/shells and add the following line at the end:

Copy to Clipboard

Now try to connect this ftp server with the username on Port 21 using winscp or filezilla client and make sure that user cannot access the other folders outside the Home Directory.

(Please note using FTP on Port 21 is a big security risk. It is highly recommended to use SFTP. Please continue for SFTP configuration) SFTP, also called “Secure FTP,” generally uses SSH File Transfer Protocol. So, we need OpenSSH-server package installed. Issue the command below, if it’s not already installed:

Copy to Clipboard

Step 7 » Create a new group ftpaccess for FTP users:

Copy to Clipboard

Step 8 » Now make changes in this /etc/ssh/sshd_config file.

» Find the below line:

Copy to Clipboard

and replace with:

Copy to Clipboard

» and comment the below line (Last line):

Copy to Clipboard

Step 9 » Restart SSHD service:

Copy to Clipboard

Step 10 » The below steps must be followed while creating Users for SFTP access:

Create user john with ftpaccess group and /usr/bin/nologin shell:

Copy to Clipboard

Change ownership for the home directory:

Copy to Clipboard

Create a folder inside Home Directory for writing, and change ownership of that folder:

Copy to Clipboard

After following those instructions I had two separate users. We’ll call them FTP and SFTP.

FTP and SFTP had their own home directories (for some reason writing this sounds like I’m explaining the birds and the bees).

I needed to make sure that FTP was the only user that could use that protocol. All other users when setup can SFTP, but only explicit accounts will be allowed to FTP.

  1. Create /etc/vsftpd.user_list and add the user you want to ONLY use FTP
  2. Add to /etc/vsftpd.conf
Copy to Clipboard

As I said, the symlinks to another shared directory wasn’t working. So, I added another group “SHAREDFILES” and added both of the users to it. I used:

Copy to Clipboard

See more here: “DefaultRoot, Symlinks and Chroot()”
Add that to your fstab (etc/fstab), so your mounts show up after reboot:

Copy to Clipboard

In a normal case, most people would just default back to allowing both accounts to FTP access, but I wanted to make sure I took the more secure route. So, ultimately, thanks to legacy systems that can’t SFTP, I was able do things a little differently and gain a new learning experience.

Share with your network!
Get monthly updates from Hurricane Labs
* indicates required

About Hurricane Labs

Hurricane Labs is a dynamic Managed Services Provider that unlocks the potential of Splunk and security for diverse enterprises across the United States. With a dedicated, Splunk-focused team and an emphasis on humanity and collaboration, we provide the skills, resources, and results to help make our customers’ lives easier.

For more information, visit www.hurricanelabs.com and follow us on Twitter @hurricanelabs.