Your vsftpd guide

[nesta...@gmail.com]

I just spent a few hours trying to get this server to work.

1. It hasn't been tested externally yet.
2. I'm using Alt-F 0.1RC3
3. The version of the server 2.3.5-1
4. The user list for your server is populated by your Alt-F user list. If you want more users, create them as you did when you initially installed the firmware.
5. The rest of this guide only makes complete sense with the attached pictures
6. I WANT TO THANK THAT KIND SOUL WHO DEVELOPED ALT-F. Hopefully this will give him time to focus on other things, as most folks want ftp.

Installing it is as easy as going to Alt-F WebUi Packages>Alt-F
Then on the WebUi go to: Services>Network and you will see this:

inetd         Running             ssh, telnet, rsync, ftp, http, swat, lpd...Don't disable unless you have a serial port!
Click on the "Configure" button.
See picture in this post called for what you should see: inetd Setup.png
Click on Configure.
See picture in this post called for what you should see: vsftpd server Setup.png
Login using the CLI. Use putty.
Your login details are the same are you WebUi.
At the CLI, type: cd /etc
And then nano(you must have it installed) vsftpd.conf
Enter the following, this was pulled from this forum as posted by our ever so wonderful developer:

• listen=yes

• background=yes

And this:

• anon_root=/mnt/(I can't be sure if you must manually enter here the location of your hd/partition from which you'd serve files. If you must, look for it in the status page as a guide to what you need to enter.)
  

• chroot_local_user=yes

• allow_writeable_chroot=yes

• anonymous_enable=yes

• anon_upload_enable=yes

• ssl_enable=yes

• force_local_logins_ssl=no

• force_local_data_ssl=no

• userlist_enable=no

Save the file by hitting Cntrl+O, and exist with Cntrl+X

in the terminal still open, issue:
rcinetd disable ftp (I don't know why I did this, but I tend to do anything the owner of this wonderful firmware says. And so I did)

We're about done. Be patient.

Next we want to solve the problem to force users to log directly into their folders. I think the right phrase is "jail" them. But I find use of that word to be a bit too violent. We're free social beings who spend a lifetime removing that vital essence of our beings: freedom. Anyway, moving on, lest I loose you.

So to force users to log directly into their folders, go back to the commandline and do this:

login

cd /etc

nano vsftpd.user_list
and now add the user (s) one per line, keeping in mind you will add the nickname of the user you want confined to a folder

Save as you did earlier.

I just said "to a folder." And you wonder, what folder. This will be the one you'd put files that that user can use.

Thanks again to our wonderful, sometimes, amusing developer (read his posts and you can tell when he's frustrated and when he's not)

Anyway, go to Setup>Folders in the WebUi. See picture titled "Folders Browse.png" for what you will find.

Click on "Users," click on the user you want to work on. And up where it says "Selected" on your browser, enter: "/XXXXXXXX) and click "create."

Next go to permission and ensure it looks like the picture titled Access Permissions.png attached in this post.

And we're done. As far as I can recall. If anyone finds any issue with this, please let me know or update.

______________________________________

Just as a side note, I'm running mt_daapd and mediatomb, at the same time, without any problems. I could not get  forked_daapd to work as such, something about another server is running.

It will be nice if I can write-up a similar HowTo for owncloud. But I don't even know where to start, or how. 

In about two hours, I will test externally and disable it completely. I did this to help. I don't need a server.

[João Cardoso]

I don't know what motivated you, as vsftpd is builtin in the base firmware and should work out of the box.

In the default setup, the ftp server runs in inetd mode, i.e., it only runs when some client connects to the box, conserving memory. The only downside is that it only takes a few more milliseconds to start.

The same happens for ssh, telnet, rsync, the webUI httpd server... but not samba.

Your guide is intended to have the ftp server always running, even when nobody is using it...

You can find more highlight on this topic by going to Services->network->inetd->httpd and reading the tooltips on the ports/alternative ports and server/inetd mode.

Some more comments intermixed below:

On Saturday, January 18, 2014 9:30:44 PM UTC, nesta...@gmail.com wrote:

I just spent a few hours trying to get this server to work.

1. It hasn't been tested externally yet.
2. I'm using Alt-F 0.1RC3
3. The version of the server 2.3.5-1
4. The user list for your server is populated by your Alt-F user list. If you want more users, create them as you did when you initially installed the firmware.
5. The rest of this guide only makes complete sense with the attached pictures
6. I WANT TO THANK THAT KIND SOUL WHO DEVELOPED ALT-F. Hopefully this will give him time to focus on other things, as most folks want ftp.

Installing it is as easy as going to Alt-F WebUi Packages>Alt-F

Only needed to upgrade the shipped vsftpd to the last version. Yes, the updated version fixes some issues when "jailing"

 

Then on the WebUi go to: Services>Network and you will see this:

inetd         Running             ssh, telnet, rsync, ftp, http, swat, lpd...Don't disable unless you have a serial port!
Click on the "Configure" button.
See picture in this post called for what you should see: inetd Setup.png
Click on Configure.
See picture in this post called for what you should see: vsftpd server Setup.png
Login using the CLI. Use putty.
Your login details are the same are you WebUi.
At the CLI, type: cd /etc
And then nano(you must have it installed) vsftpd.conf
Enter the following, this was pulled from this forum as posted by our ever so wonderful developer:

• listen=yes

• background=yes

This is what is needed to run vsftpd in standalone mode, i.e. always, out of inetd mode.

And this:

• anon_root=/mnt/(I can't be sure if you must manually enter here the location of your hd/partition from which you'd serve files. If you must, look for it in the status page as a guide to what you need to enter.)
  

• chroot_local_user=yes

• allow_writeable_chroot=yes

• anonymous_enable=yes

• anon_upload_enable=yes

• ssl_enable=yes

• force_local_logins_ssl=no

• force_local_data_ssl=no

• userlist_enable=no

 

Save the file by hitting Cntrl+O, and exist with Cntrl+X

in the terminal still open, issue:
rcinetd disable ftp (I don't know why I did this,

because you want vsftpd to run in standalone mode, not under inetd control. You can't have both. (incidentally this explains why below you say that you aren't able to run forked-daapd when mt-daapd is already running -- both use the same "ports", so the first to be launched excludes the other)

 

but I tend to do anything the owner of this wonderful firmware says. And so I did)

We're about done. Be patient.

Next we want to solve the problem to force users to log directly into their folders. I think the right phrase is "jail" them.

Not exactly.

By default, when users login (not as guest/ftp) they will be in their home folders, but they can browse ('cd', change directory) other folders. "jailing" means that they can't do that, they will be restricted to use only his home folder.

If users login as "guest" (using the "ftp" or "anonymous" username), they will be restricted to use the "anon_root" folder.

 

But I find use of that word to be a bit too violent. We're free social beings who spend a lifetime removing that vital essence of our beings: freedom. Anyway, moving on, lest I loose you.

So to force users to log directly into their folders, go back to the commandline and do this:

login

cd /etc

nano vsftpd.user_list
and now add the user (s) one per line, keeping in mind you will add the nickname of the user you want confined to a folder

hmmm, not certain about this.

What makes users be jailed is the 'chroot_local_user' directive.

       chroot_local_user

              If set to YES, local users will be (by default) placed in a chroot() jail in  their

              home  directory after login.  Warning: This option has security implications, espe-

              cially if the users have upload permission, or shell access.  Only  enable  if  you

              know what you are doing.  Note that these security implications are not vsftpd spe-

              cific. They apply to all FTP daemons which offer to put  local  users  in  chroot()

              jails.

              Default: NO

The vsftpd.user_list file is intended to be used to (accordingly to the vsftpd.conf manual page):

       userlist_enable

              If enabled, vsftpd will load a list  of  usernames,  from  the  filename  given  by

              userlist_file.   If  a user tries to log in using a name in this file, they will be

              denied before they are asked for a password.  This  may  be  useful  in  preventing

              cleartext passwords being transmitted. See also userlist_deny.

              Default: NO

       userlist_deny

              This option is examined if userlist_enable is activated. If you set this setting to

              NO, then users will be denied login unless they are explicitly listed in  the  file

              specified  by userlist_file.  When login is denied, the denial is issued before the

              user is asked for a password.

              Default: YES

      userlist_file

              This option is the name of the file  loaded  when  the  userlist_enable  option  is

              active.

              Default: /etc/vsftpd.user_list

and you have set 'userlist_enable=no' above.

Yes, there are so many available options, and some interfere with others

 

Save as you did earlier.

I just said "to a folder." And you wonder, what folder. This will be the one you'd put files that that user can use.

Thanks again to our wonderful, sometimes, amusing developer (read his posts and you can tell when he's frustrated and when he's not)

Yes, I know that I'm a bit harsh sometimes, most often I'm not running in "moody blue" mode :-)

Thanks for summarizing, anyway. After you fix it you could write a wiki on setting ftp in standalone mode.

Anyway, go to Setup>Folders in the WebUi. See picture titled "Folders Browse.png" for what you will find.

Click on "Users," click on the user you want to work on. And up where it says "Selected" on your browser, enter: "/XXXXXXXX) and click "create."

Next go to permission and ensure it looks like the picture titled Access Permissions.png attached in this post.

And we're done. As far as I can recall. If anyone finds any issue with this, please let me know or update.

______________________________________

Just as a side note, I'm running mt_daapd and mediatomb, at the same time, without any problems. I could not get  forked_daapd to work as such, something about another server is running.

As I "explained" at the top you can't have two programs using the same port. Ports are listed in /etc/services, e.g., ftp uses port 21, daap uses port 3689.