Restricting Access to FTP

Once you've gotten vsftpd up and running, any known users (that is, not anonymous) who are not in the vsftpd blacklist file will be able to log in. If you have users who should not have access to FTP resources, open /etc/vsftpd.ftpusers and put their usernames in this file. You can also add system or new service accounts to this file to restrict FTP access for system accounts. In this sample/etc/vsftpd.ftpusers file, we have blocked FTP access for the user mike:

   # cat /etc/vsftpd.ftpusers
   #  Users that are not allowed to login via ftp
   root
   bin
   daemon
   adm
   lp
   sync
   shutdown
   halt
   mail
   news
   uucp
   operator
   games
   nobody

   #Non-FTP users
   mike

Another useful security-related vsftpd file is the /etc/vsftpd.user_list user password prompt file. If a user is listed in this file, he will not even be offered a password prompt if he attempts to FTP into the machine. As with /etc/vsftpd.ftpusers, /etc/vsftpd.user_list is filled with system accounts and root. It's a good way to protect passwords for accounts that have no business logging into FTP from even being queried for a password. If there is no password prompt given, there's no way to sniff the password string as it's sent. For some environments, simple login denial is not secure enough.

Configuring Environmental Variables

Once you've defined your user blacklist file, you can begin to configure vsftpd for your particular environment. Note that these settings create user-based restrictions only. In order to define restrictions for entire networks or hosts, see Chapter 11 to learn more about working with TCP-Wrappers and iptables.

The main vsftpd configuration file is /etc/vsftpd/vsftpd.conf. The first lines you should look for areas follows:

   anonymous_enable=YES
   local_enable=YES
   write_enable=YES
   local_umask=022
   #anon_upload_enable=YES
   #anon_mkdir_write_enable=YES

Note that anonymous FTP is turned on by default. Though it may seem unwise to have write access also turned on, note that anonymous upload, mkdir, and write are all commented out. This indicates that only valid system users will be able to write to the local file system(s).

As you continue to read through the configuration file, you'll notice entries for timeouts and other connection management details:

   dirmessage_enable=YES
   xferlog_enable=YES
   connect_from_port-20=YES
   #chown_uploads=YES
   #chown_username=whoever
   #xferlog_file=/var/log/vsftpd.log
   xferlog_std_format=YES
   #idle_session_timeout=600
   #data_connection_timeout=120
   #nopriv_user=ftpsecure
   #async_abor_enable=YES
   #ascii_upload_enable=YES
   #ascii_download_enable=YES
   #ftpd_banner=Welcome to blah FTP service.
   #deny_email_enable=YES
   #banned_email_file=/etc/vsftpd.banned_emails

Look for the following lines in the file:

   chroot_local_user=YES
   #chroot_list_enable=YES
   #chroot_list_file=/etc/vsftpd.chroot_list

This is a useful trick that allows you to chroot users into their own home directories when they FTP in. When you have this turned on, users can't get out of their home directories and go browsing around your file system. In the old days, setting this up was a bit complex, but vsftpd does it automatically.

Next, find this section in /etc/vsftpd/vsftpd.conf:

   #ls_recurse_enable=YES
   pam_service_name=vsftpd
   userlist_enable=YES
   #enable for standalone mode
   listen=YES
   tcp_wrappers=YES

If you want to use TCP-Wrappers with your FTP service, this final line must be turned on. For those who dislike iptables for securing system services against certain hosts, TCP-Wrappers is a more simple user space form of service/host blocking. We cover TCP-Wrappers in Chapter 11.

Passive FTP

Traditionally, most FTP problems have come from server firewall settings, client settings, or passwords. Over the past few years, however, there has been a rise in the number of problems related to passive versus nonpassive FTP. These problems appear when someone inside a local LAN or behind a firewall attempts to use a nonpassive (or just plain old) FTP server elsewhere on the Internet. The authentication goes smoothly on port 21, but when the FTP server attempts to open port 20 back to the client, the client's local firewall often blocks the connection. While this is logical, since an attempt from the outside to open an incoming port is indicative of cracker activity from the client's perspective, it's irritating to someone who just wants to get a file. More modern, intelligent, stateful, and protocol-savvy firewalls are aware of things like FTP session tracking (such as iptables or netfilter on Linux). However, many firewalls out there still do not have such awareness.

The best solution is to have the user try making the connection in passive FTP mode. In passive mode, the FTP client sets up both the authentication connection and the data connection, rather than having the remote FTP service open the data port back to them. Most modern FTP servers support passive-mode sessions, including the vsftpd daemon found on Fedora Core.

Passive FTP and iptables

Are you using iptables on Linux for your firewall? If so, good. Under iptables, you can use stateful packet inspection and protocol-aware session tracking, two features that make for smart firewall rules. The ip_conntrack kernel module examines packets to see whether they will need exceptions to regular firewall rules, such as those usually needed by nonpassive FTP. Learn more at www.sns.ias.edu/~jns/security/iptables/iptables_conntrack.html.

In order to use passive-mode FTP, the user will need to change settings in the user FTP client. Most modern user clients, whether GUI or command-line, have this option. (If your user's client does not, encourage an upgrade.) GUI users should check their configuration or preferences menu for the correct option, while those using command-line clients will need to invoke the proper command or set a variable. Those using the ncftp FTP client should log in and then use this command sequence to enable passive mode:

   ncftp / > passive
   passive                  on

while those using the lftp client should issue the command

   lftp bob@mydomain.com:~ >  set ftp:passive-mode on

after logging in to the remote server.