FTP
From Indie IT Wiki
This page explains how to allow FTP access to a server behind a NAT masquerading firewall using Passive mode.
Client --> Modem --> Firewall --> Server
Modem
Ports: TCP: 20,21,60000-60500
Firewall
Kernel Config: nf_conntrack_ftp,nf_nat_ftp
# Allow FTP access DNAT net:123.456.789.0 loc:192.168.0.201 tcp 20 DNAT net:123.456.789.0 loc:192.168.0.201 tcp 21 DNAT net:123.456.789.0 loc:192.168.0.201 tcp 60000:60500
Server
vsFTPd
sudo apt-get install vsftpd sudo nano /etc/vsftpd.conf anonymous_enable=NO local_enable=YES write_enable=YES local_umask=022 ftpd_banner=Hello chroot_local_user=YES pam_service_name=vsftpd allow_writeable_chroot=YES pasv_enable=YES pasv_address=xx.xxx.xx.xxx pasv_addr_resolve=NO pasv_min_port=40000 pasv_max_port=40100 port_enable=YES sudo nano /etc/pam.d/vsftpd # auth required pam_shells.so sudo service vsftpd restart telnet 127.0.0.1 21
https://help.ubuntu.com/community/vsftpd
Thanks - http://www.swhite.co/2012/05/how-to-set-up-wordpress-on-amazon-ec2_31.html
Security
Install SSL Certificate...
cat server.crt bundle.crt > vsftpd-domain_com.crt cat server.key > vsftpd-domain_com.key cp -av vsftpd-domain_com.crt /etc/ssl/certs/ cp -av vsftpd-domain_com.key /etc/ssl/private/
Configure SSL Certificate...
sudo nano /etc/vsftpd.conf ssl_enable=YES rsa_cert_file=/etc/ssl/certs/vsftpd-domain_com.crt rsa_private_key_file=/etc/ssl/private/vsftpd-domain_com.key allow_anon_ssl=NO force_local_logins_ssl=YES force_local_data_ssl=YES implicit_ssl=YES ssl_tlsv1=YES ssl_sslv2=NO ssl_sslv3=NO ssl_ciphers=HIGH
sudo service vsftpd restart
Test SSL Certificate...
openssl s_client -starttls ftp -connect 127.0.0.1:21 -showcerts -CApath /etc/ssl/certs
Thanks - http://www.neant.ro/2012/04/secure-ftp-with-vsftpd/
Fun
220 127.0.0.1 FTP server ready (press enter) 500 Invalid command: try being more creative
ProFTPd
sudo nano /etc/proftpd/proftpd.conf sudo nano /etc/proftpd.conf
Passive Mode tweaks
PassivePorts 60000 60500
Security tweaks
ServerIdent Off DefaultRoot ~ UseFtpUsers on <Limit LOGIN> # single ip address example Allow from 192.168.0.1 # multiple ip addresses example Allow from 192.168.0.1 10.30.124.6 # subnet example Allow from 192.168.0.0/16 # hostname example Allow from example.net # deny the rest DenyAll </Limit>
Remove all lines for the Anonymous sections...
<Anonymous /home/user/public_ftp>
UseFtpUsers on
RequireValidShell off
UseFtpUsers on
RequireValidShell off
User ftp
Group ftp
UserAlias anonymous ftp
DisplayLogin welcome.msg
DisplayChdir .message true
<Limit WRITE>
DenyAll
</Limit>
<Directory incoming>
<Limit STOR>
AllowAll
</Limit>
<Limit WRITE READ>
DenyAll
</Limit>
</Directory>
</Anonymous>
Create the file...
nano /etc/ftpusers
root
ftp
anonymous
Restart the server...
sudo service proftpd restart sudo /etc/init.d/proftpd restart
Thanks - http://www.the-art-of-web.com/system/block-ftp-hacking/
Software
ncFTP ncftp -u username -p password server ncftp> passive ncftp> ls ncftp> quit
FileZilla ProFTPd
Test with OpenSSL Client
openssl s_client -CApath /etc/ssl/certs -connect server.mydomain.com:21 -no_ssl3 -starttls ftp
HOWTO: Fix: VSFTPD: Error: FAIL LOGIN: Client
sudo nano /etc/pam.d/vsftpd # auth required pam_shells.so sudo service vsftpd restart
HOWTO: FIX: ERROR: proftpd: pam_env(ftp:setcred): Unable to open config file: /etc/security/pam_env.conf: No such file or directory
nano /etc/pam.d/ftp # session include system-auth /etc/init.d/proftpd restart
HOWTO: FIX: Error: proftpd: PAM adding faulty module: /lib/security/pam_listfile.so
If you are seeing this in your logs...
Apr 10 13:00:07 server proftpd: PAM unable to dlopen(/lib/security/pam_listfile.so) Apr 10 13:00:07 server proftpd: PAM [error: /lib/security/pam_listfile.so: wrong ELF class: ELFCLASS32] Apr 10 13:00:07 server proftpd: PAM adding faulty module: /lib/security/pam_listfile.so Apr 10 13:00:07 server proftpd: PAM unable to dlopen(/lib/security/pam_pwdb.so) Apr 10 13:00:07 server proftpd: PAM [error: /lib/security/pam_pwdb.so: cannot open shared object file: No such file or directory] Apr 10 13:00:07 server proftpd: PAM adding faulty module: /lib/security/pam_pwdb.so
..., and you are using FTP virtual users, then you can turn off PAM authentication and move the offending file to another directory.
mv /etc/pam.d/ftp /root/
...then restart ProFTPd...
/etc/init.d/proftpd restart
HOWTO: FIX: Error: unable to open TransferLog '/var/log/xferlog': Too many levels of symbolic links
ls -la /var/log/xferlog lrwxrwxrwx 1 root root 41 Dec 4 2011 /var/log/xferlog -> ../../usr/local/apache/domlogs/ftpxferlog
rm /var/log/xferlog
References
http://www.shorewall.net/FTP.html
http://www.proftpd.org/docs/howto/NAT.html
http://slacksite.com/other/ftp.html
