vsftp Question

[jazzer386]

1. marcrblevins:

i) Thanks for demonstrating that 'root' point.

ii) What is a "hardened" password?




2. # cd /etc/pki/tls





...# make vsftpd.pem
make: *** No rule to make target `vsftpd.pem'. Stop.





...# mv vsftpd.pem /etc/vsftpd/
mv: cannot stat `vsftpd.pem': No such file or directory




3. # Example config file /etc/vsftpd/vsftpd.conf
#
# The default compiled in settings are fairly paranoid. This sample file
# loosens things up a bit, to make the ftp daemon more usable.
# Please see vsftpd.conf.5 for all compiled in defaults.
#
# READ THIS: This example file is NOT an exhaustive list of vsftpd options.
# Please read the vsftpd.conf.5 manual page to get a full idea of vsftpd's
# capabilities.
#
# Allow anonymous FTP? (Beware - allowed by default if you comment this out).
anonymous_enable=NO
#
# Uncomment this to allow local users to log in.
local_enable=YES
#
# Uncomment this to enable any form of FTP write command.
write_enable=YES
#
# Default umask for local users is 077. You may wish to change this to 022,
# if your users expect that (022 is used by most other ftpd's)
local_umask=022
#
# Uncomment this to allow the anonymous FTP user to upload files. This only
# has an effect if the above global write enable is activated. Also, you will
# obviously need to create a directory writable by the FTP user.
#anon_upload_enable=YES
#
# Uncomment this if you want the anonymous FTP user to be able to create
# new directories.
#anon_mkdir_write_enable=YES
#
# Activate directory messages - messages given to remote users when they
# go into a certain directory.
dirmessage_enable=YES
#
# Activate logging of uploads/downloads.
xferlog_enable=YES
#
# Make sure PORT transfer connections originate from port 20 (ftp-data).
connect_from_port_20=YES
#
# If you want, you can arrange for uploaded anonymous files to be owned by
# a different user. Note! Using "root" for uploaded files is not
# recommended!
#chown_uploads=YES
#chown_username=whoever
#
# You may override where the log file goes if you like. The default is shown
# below.
#xferlog_file=/var/log/vsftpd.log
#
# If you want, you can have your log file in standard ftpd xferlog format.
# Note that the default log file location is /var/log/xferlog in this case.
xferlog_std_format=YES
#
# You may change the default value for timing out an idle session.
#idle_session_timeout=600
#
# You may change the default value for timing out a data connection.
#data_connection_timeout=120
#
# It is recommended that you define on your system a unique user which the
# ftp server can use as a totally isolated and unprivileged user.
#nopriv_user=ftpsecure
#
# Enable this and the server will recognise asynchronous ABOR requests. Not
# recommended for security (the code is non-trivial). Not enabling it,
# however, may confuse older FTP clients.
#async_abor_enable=YES
#
# By default the server will pretend to allow ASCII mode but in fact ignore
# the request. Turn on the below options to have the server actually do ASCII
# mangling on files when in ASCII mode.
# Beware that on some FTP servers, ASCII support allows a denial of service
# attack (DoS) via the command "SIZE /big/file" in ASCII mode. vsftpd
# predicted this attack and has always been safe, reporting the size of the
# raw file.
# ASCII mangling is a horrible feature of the protocol.
#ascii_upload_enable=YES
#ascii_download_enable=YES
#
# You may fully customise the login banner string:
#ftpd_banner=Welcome to DDDPL's FTP service.
#
# You may specify a file of disallowed anonymous e-mail addresses. Apparently
# useful for combatting certain DoS attacks.
#deny_email_enable=YES
# (default follows)
#banned_email_file=/etc/vsftpd/banned_emails
#
# You may specify an explicit list of local users to chroot() to their home
# directory. If chroot_local_user is YES, then this list becomes a list of
# users to NOT chroot().
chroot_list_enable=YES
# (default follows)
chroot_list_file=/etc/vsftpd/chroot_list
#
# You may activate the "-R" option to the builtin ls. This is disabled by
# default to avoid remote users being able to cause excessive I/O on large
# sites. However, some broken FTP clients such as "ncftp" and "mirror" assume
# the presence of the "-R" option, so there is a strong case for enabling it.
#ls_recurse_enable=YES
#
# When "listen" directive is enabled, vsftpd runs in standalone mode and
# listens on IPv4 sockets. This directive cannot be used in conjunction
# with the listen_ipv6 directive.
listen=YES
#
# This directive enables listening on IPv6 sockets. To listen on IPv4 and IPv6
# sockets, you must run two copies of vsftpd whith two configuration files.
# Make sure, that one of the listen options is commented !!
#listen_ipv6=YES


listen_port=nnnnn
pam_service_name=vsftpd
userlist_enable=NO
tcp_wrappers=NO
ssl_enable=YES
allow_anon_ssl=NO
force_local_data_ssl=YES
force_local_logins_ssl=YES
ssl_tlsv1=YES
ssl_sslv2=NO
ssl_sslv3=NO
rsa_cert_file=/etc/vsftpd/vsftpd.pem




[Note: "nnnnn"=port #.]




- j

[briantan]

Originally Posted by jazzer386

2. # cd /etc/pki/tls

Should be

# cd /etc/pki/tls/certs
# make vsftpd.pem
# mv /etc/vsftpd/vsftpd.pem{,.old}
# mv vsftpd.pem /etc/vsftpd/
# /sbin/service vsftpd restart

Originally Posted by jazzer386

listen_port=nnnnn

Forget about ddddd, ttttt..... Use your real userid (jazzer or whatever it is) to try login.

If you don't know your userid, use #system-config-users to find out. It's in the first column (username), not full name.

# lftp -u jazzer -p nnnnn localhost
Password: {your usual password to login to fedora, not root password}
lftp jazzer@localhost:~> ls
drwxr-xr-x    2 500      500          4096 Jun 29 14:24 Desktop
drwxr-xr-x    2 500      500          4096 Jun 28 17:22 Documents
drwxr-xr-x    2 500      500          4096 Jun 28 17:22 Download
drwxr-xr-x    2 500      500          4096 Jun 28 17:22 Music
drwxr-xr-x    2 500      500          4096 Jun 28 17:22 Pictures
drwxr-xr-x    2 500      500          4096 Jun 28 17:22 Public
drwxr-xr-x    2 500      500          4096 Jun 28 17:22 Templates
drwxr-xr-x    2 500      500          4096 Jun 28 17:22 Videos
.......
lftp jazzer@localhost:~> quit
#

EDIT: I'll not answer any more of your post until I see you test with your real userid, and not ddddd....

[jazzer386]

1. For security reasons, I cannot post my actual userid, ip, plus post #, etc., for the world to see.

I just can't.

Also, I fail so see the relevance in posting them, anyway; when I enter commands, in Terminal, I'm using the real values, instead of ddddd, etc.

Adding to my problems, by creating a security risk, is not going to make vsftp work.

In addition, I'm not doing this, for the fun of it; about 99% of the rest of my business is on hold until I get this server problem solved and that, among other things, is money out of my pocket - at a time when I have already lost a lot and really can't afford to lose any more.

...And then, while my server sits idle, I'm paying another company to host my website.

So, that is another annoying drain on my finances.

So, believe me, I'm not trying to waste your's or my time.

I would greatly appreciate if we could just get through this as quickly and reasonably as possible.






2. # lftp -u ddddd -p nnnnn fffff
Password:
lftp ddddd@fffff:~> ls
ls: Fatal error: SSL_read: wrong version number
lftp ddddd@fffff:~>





[Note: "ddddd" = user id; nnnnn = port #; and, fffff = ip.]




- j

[marcrblevins]

ii) What is a "hardened" password?

Really hard password, lower case, uppercase, & numbers, up to 8 alphanumeric.
Example:
4dK5srOX

[marcrblevins]

I Googled for "vsftp SSL_read: wrong version number", Jazzer, you are FAMOUS! Top two spot. :eek

I found:
http://www.sfr-fresh.com/unix/misc/v....0.7/Changelog
If you search for SSL on that changelog, there are many.

[marcrblevins]

http://vsftpd.beasts.org/
Jul 2008 - vsftpd-2.0.7 released
* vsftpd-2.0.7 is released - with minor fixes and enhanced SSL support. SSL interoperability with FileZilla was fixed. Some build errors introduced in 2.0.6 were corrected. A race causing PASV connection drops under extreme load was fixed. Options to more aggressively check proper SSL data transfer were added, but unfortunately buggy clients mean it is not on by default. The option to delete failed uploads was added. Look for a blog post ranting about some of the SSL issues shortly: http://scarybeastsecurity.blogspot.com/ . Please refer to the v2.0.7 Changelog and vsftpd FAQ (frequently asked questions) for a list of common questions!

[marcrblevins]

Jazzer,
Your vsftpd.conf looks good.

Just try Briantan's piece:

# cd /etc/pki/tls/certs
# make vsftpd.pem
# mv /etc/vsftpd/vsftpd.pem{,.old}
# mv vsftpd.pem /etc/vsftpd/
# /sbin/service vsftpd restart

And let us know how it went.

[jazzer386]

marcrblevins:

1. Thanks for the def. Looks like I am using "hardened" passwords.




2. According to my "Download" directory, I downloaded vsftpd 2.0.7, on August 21, 2008. I can't remember, though, if I installed it and I don't know how to tell.




3. ]# cd /etc/pki/tls/certs

...# make vsftpd.pem
umask 77 ; \
PEM1=`/bin/mktemp /tmp/openssl.XXXXXX` ; \
PEM2=`/bin/mktemp /tmp/openssl.XXXXXX` ; \
/usr/bin/openssl req -utf8 -newkey rsa:1024 -keyout $PEM1 -nodes -x509 -days 365 -out $PEM2 -set_serial 0 ; \
cat $PEM1 > vsftpd.pem ; \
echo "" >> vsftpd.pem ; \
cat $PEM2 >> vsftpd.pem ; \
rm -f $PEM1 $PEM2
Generating a 1024 bit RSA private key
.............................................+++++ +
...............................................+++ +++
writing new private key to '/tmp/openssl.tj7msj'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----


[Several Questions Asked Here.]




...# mv vsftpd.pem /etc/vsftpd/




...# /sbin/service vsftpd restart
Shutting down vsftpd: [ OK ]
Starting vsftpd for vsftpd: [ OK ]




...# lftp -u ddddd -p nnnnn fffff
Password:
lftp ddddd@fffff:~> ls
ls: Fatal error: SSL_read: wrong version number




[Note: "ddddd" = user id; nnnnn = port #; and, fffff = ip.]




- j

[briantan]

Originally Posted by marcrblevins

http://vsftpd.beasts.org/
Jul 2008 - vsftpd-2.0.7 released
* vsftpd-2.0.7 is released - with minor fixes and enhanced SSL support. SSL interoperability with FileZilla was fixed. Some build errors introduced in 2.0.6 were corrected. A race causing PASV connection drops under extreme load was fixed. Options to more aggressively check proper SSL data transfer were added, but unfortunately buggy clients mean it is not on by default. The option to delete failed uploads was added. Look for a blog post ranting about some of the SSL issues shortly: http://scarybeastsecurity.blogspot.com/ . Please refer to the v2.0.7 Changelog and vsftpd FAQ (frequently asked questions) for a list of common questions!

Thanks marcrblevins.

Too bad latest fedora updates still at vsftpd-2.0.6-4.fc9. Too lazy to compile 2.0.7. Will wait.

Also find that for lftp to work with vsftpd force_local_data_ssl=YES, you need this in lftp.conf or set interactively.

set ftp:ssl-protect-data on

[briantan]

Originally Posted by marcrblevins

I Googled for "vsftp SSL_read: wrong version number", Jazzer, you are FAMOUS! Top two spot. :eek

I found:
http://www.sfr-fresh.com/unix/misc/v....0.7/Changelog
If you search for SSL on that changelog, there are many.

More than top two spots. You'll be famous too, marcrblevins.

I'd check version of openssl "#rpm -q openssl"

Latest updates for F9 is openssl-0.9.8g-9.fc9.

vsftpd-2.0.6-4.fc9, openssl-0.9.8g-9.fc9 and lftp-3.6.3-2.fc9 works well, provided that I set that lftp parameter "set ftp:ssl-protect-data on"

Cheers.

[jazzer386]

1. # rpm -q openssl
openssl-0.9.8g-9.fc9.i686

...# rpm -q vsftpd
vsftpd-2.0.6-4.fc9.i386

...# rpm -q lftp
lftp-3.6.3-2.fc9.i386




2. # lftp -u ddddd -p nnnnn fffff
Unknown command `force_local_data_ssl=YES'.
Password:
lftp ddddd@fffff:~> ls
ls: Fatal error: SSL_read: wrong version number
lftp ddddd@fffff:~> exit




...# gedit /etc/lftp.conf




...# lftp -u ddddd -p nnnnn fffff
Password:
lftp ddddd@fffff:~> ls
ls: Fatal error: SSL_read: wrong version number
lftp ddddd@fffff:~>





[Note: "ddddd" = user id; nnnnn = port #; and, fffff = ip.]




3. gedit /etc/lftp.conf




## some useful aliases
alias dir ls
alias less more
alias zless zmore
alias bzless bzmore
alias reconnect "close; cache flush; cd ."
alias edit "eval -f \"get $0 -o ~/.lftp/edit.tmp.$$ && shell \\\"cp -p ~/.lftp/edit.tmp.$$ ~/.lftp/edit.tmp.$$.orig && $EDITOR ~/.lftp/edit.tmp.$$ && test ~/.lftp/edit.tmp.$$ -nt ~/.lftp/edit.tmp.$$.orig\\\" && put ~/.lftp/edit.tmp.$$ -o $0; shell rm -f ~/.lftp/edit.tmp.$$*\""
gedit /etc/lftp.conf
## make prompt look better
set prompt "lftp \S\? \u\@\h:\w> "
## some may prefer colors (contributed by Matthew <mwormald@optusnet.com.au>)
#set prompt "\[\e[1;30m\][\[\e[0;34m\]f\[\e[1m\]t\[\e[37m\]p\[\e[30m\]] \[\e[34m\]\u\[\e[0;34m\]\@\[\e[1m\]\h\[\e[1;30m\]:\[\e[1;34m\]\w\[\e[1;30m\]>\[\e[0m\] "
## Uncomment the following two lines to make switch cls and ls, making
## cls the default.
#alias ls command cls
#alias hostls command ls

## default protocol selection
#set default-protocol/ftp.* ftp
#set default-protocol/www.* http
#set default-protocol/localhost file

## this makes lftp faster but doesn't work with some sites/routers
#set ftp:sync-mode off

## synchronous mode for broken servers and/or routers
set sync-mode/ftp.idsoftware.com on
set sync-mode/ftp.microsoft.com on
set sync-mode/sunsolve.sun.com on
## extended regex to match first server message for automatic sync-mode.
set auto-sync-mode "icrosoft FTP Service|MadGoat"

## if default ftp passive mode does not work, try this:
# set ftpassive-mode off

## Set this to follow http redirections
set xfer:max-redirections 10

## Proxy can help to pass a firewall
## Environment variables ftp_proxy, http_proxy and no_proxy are used to
## initialize the below variables automatically. You can set them here too.
##
## ftproxy must communicate with client over ftp protocol, squid won't do.
## This can be e.g. TIS-FWTK or rftpd. User and password are optional.
# set ftproxy ftp://[userass@]your_ftp_proxyort
## ...but squid still can be used to access ftp servers, using hftp protocol:
# set ftproxy http://your.squid.addressort
## ...if squid allows CONNECT to arbitrary ports, then you can use CONNECT
## instead of hftp:
# set ftp:use-hftp no
##
## no proxy for host
# set ftproxy/local_host ""
## or domain
# set ftproxy/*.domain.com ...
##
## httproxy must communicate with client over http protocol, e.g. squid.
## Default port is 3128.
# set httproxy your_http_proxy[ort]
## hftproxy must also be an http proxy. It is used for FTP over HTTP access.
# set hftproxy your_http_proxy[ort]
##
## net:no-proxy disables proxy usage for list of domains.
# set net:no-proxy .domain.com,.otherdom.net

## If you don't have direct ftp access, this setting can be useful to select
## hftp instead of ftp automatically.
# set ftproxy http://your.http.proxyort

## This can be used for automatic saving of configuration
# set at-exit "set > ~/.lftp/settings"
# source ~/.lftp/settings

## and this is for remembring last site
## (combine with previous rule if you want)
# set at-exit "bo a last"
# open last

## Terminal strings to set titlebars for terminals that don't
## properly specify tsl and fsl capabilities.
## Use cmd:set-term-status to enable this.
set cmd:term-status/*screen* "\e_\T\e\\"
set cmd:term-status/*xterm* "\e[11;0]\e]2;\T\007\e[11]"
set cmd:term-status/*rxvt* "\e[11;0]\e]2;\T\007\e[11]"
# set cmd:set-term-status on

## If you don't like advertising lftp or servers hate it, set this:
# set ftp:anon-pass "mozilla@"
# set ftp:client ""
# set http:user-agent "Mozilla/4.7 [en] (WinNT; I)"




set ftp:ssl-protect-data on




4. # Example config file /etc/vsftpd/vsftpd.conf
#
# The default compiled in settings are fairly paranoid. This sample file
# loosens things up a bit, to make the ftp daemon more usable.
# Please see vsftpd.conf.5 for all compiled in defaults.
#
# READ THIS: This example file is NOT an exhaustive list of vsftpd options.
# Please read the vsftpd.conf.5 manual page to get a full idea of vsftpd's
# capabilities.
#
# Allow anonymous FTP? (Beware - allowed by default if you comment this out).
anonymous_enable=NO
#
# Uncomment this to allow local users to log in.
local_enable=YES
#
# Uncomment this to enable any form of FTP write command.
write_enable=YES
#
# Default umask for local users is 077. You may wish to change this to 022,
# if your users expect that (022 is used by most other ftpd's)
local_umask=022
#
# Uncomment this to allow the anonymous FTP user to upload files. This only
# has an effect if the above global write enable is activated. Also, you will
# obviously need to create a directory writable by the FTP user.
#anon_upload_enable=YES
#
# Uncomment this if you want the anonymous FTP user to be able to create
# new directories.
#anon_mkdir_write_enable=YES
#
# Activate directory messages - messages given to remote users when they
# go into a certain directory.
dirmessage_enable=YES
#
# Activate logging of uploads/downloads.
xferlog_enable=YES
#
# Make sure PORT transfer connections originate from port 20 (ftp-data).
connect_from_port_20=YES
#
# If you want, you can arrange for uploaded anonymous files to be owned by
# a different user. Note! Using "root" for uploaded files is not
# recommended!
#chown_uploads=YES
#chown_username=whoever
#
# You may override where the log file goes if you like. The default is shown
# below.
#xferlog_file=/var/log/vsftpd.log
#
# If you want, you can have your log file in standard ftpd xferlog format.
# Note that the default log file location is /var/log/xferlog in this case.
xferlog_std_format=YES
#
# You may change the default value for timing out an idle session.
#idle_session_timeout=600
#
# You may change the default value for timing out a data connection.
#data_connection_timeout=120
#
# It is recommended that you define on your system a unique user which the
# ftp server can use as a totally isolated and unprivileged user.
#nopriv_user=ftpsecure
#
# Enable this and the server will recognise asynchronous ABOR requests. Not
# recommended for security (the code is non-trivial). Not enabling it,
# however, may confuse older FTP clients.
#async_abor_enable=YES
#
# By default the server will pretend to allow ASCII mode but in fact ignore
# the request. Turn on the below options to have the server actually do ASCII
# mangling on files when in ASCII mode.
# Beware that on some FTP servers, ASCII support allows a denial of service
# attack (DoS) via the command "SIZE /big/file" in ASCII mode. vsftpd
# predicted this attack and has always been safe, reporting the size of the
# raw file.
# ASCII mangling is a horrible feature of the protocol.
#ascii_upload_enable=YES
#ascii_download_enable=YES
#
# You may fully customise the login banner string:
#ftpd_banner=Welcome to DDDPL's FTP service.
#
# You may specify a file of disallowed anonymous e-mail addresses. Apparently
# useful for combatting certain DoS attacks.
#deny_email_enable=YES
# (default follows)
#banned_email_file=/etc/vsftpd/banned_emails
#
# You may specify an explicit list of local users to chroot() to their home
# directory. If chroot_local_user is YES, then this list becomes a list of
# users to NOT chroot().
chroot_list_enable=YES
# (default follows)
chroot_list_file=/etc/vsftpd/chroot_list
#
# You may activate the "-R" option to the builtin ls. This is disabled by
# default to avoid remote users being able to cause excessive I/O on large
# sites. However, some broken FTP clients such as "ncftp" and "mirror" assume
# the presence of the "-R" option, so there is a strong case for enabling it.
#ls_recurse_enable=YES
#
# When "listen" directive is enabled, vsftpd runs in standalone mode and
# listens on IPv4 sockets. This directive cannot be used in conjunction
# with the listen_ipv6 directive.
listen=YES
#
# This directive enables listening on IPv6 sockets. To listen on IPv4 and IPv6
# sockets, you must run two copies of vsftpd whith two configuration files.
# Make sure, that one of the listen options is commented !!
#listen_ipv6=YES


listen_port=nnnnn
pam_service_name=vsftpd
userlist_enable=NO
tcp_wrappers=NO
ssl_enable=YES
allow_anon_ssl=NO
force_local_data_ssl=YES
force_local_logins_ssl=YES
ssl_tlsv1=YES
ssl_sslv2=NO
ssl_sslv3=NO
rsa_cert_file=/etc/vsftpd/vsftpd.pem



[Note: "nnnnn" = port #.]




- j

[jazzer386]

Something is not right.

So, how about this: I re-install f9 and start from scratch, again?

Due to scheduling, I can't do it, today, but tomorrow looks good.

One way or another, I need to see some progress and if re-installing will lead to that, then fine!

It just seems to me that, at this point, everybody is stumped and doing something is a lot better than doing nothing.

Maybe one or some of my files is corrupt. Perhaps an unnecessary program is conflicting with something else, or the like.

Either way, doing something seems a lot better than doing nothing.

So, how about if, tomorrow morning, I just reinstall f9 and start fresh?

- j

[briantan]

# lftp -u brian,hardened_password -p nnnnn localhost
lftp brian@localhost:~> ls
ls: Fatal error: SSL_read: wrong version number
lftp brian@localhost:~> ls <-- read in a post that ls again may work.

If you installed any of the packages (vsftpd, openssl, lftp) by compiling from source, they could be interferring with fedora's packages.

Remove the source-installed version. And to be sure,

# yum reinstall openssl vsftpd lftp

[jazzer386]

What is the command for "remove"?

- j

[briantan]

That's the problem with compile from source. No easy way of removing.

Just run reinstall, EDIT: hopefully, it will override the source compiled version.

# yum reinstall openssl vsftpd lftp

Regenerate and copy vsftpd.pem, and restart vsftpd.

EDIT: sometimes there are "# make uninstall" or similar within Makefile in source tree, but most of the times you have to run "# make install" to see what is installed, and manually remove them.

Noob should stick to yum.