Vsftpd Configuration
  • Create file /etc/vsftpd.passwd with the following format:
    USER
    PASSWORD
    USER2
    PASSWORD2
    [..etc..]
    
  • Create the DB3 database:
    db_load -T -t hash -f /etc/vsftpd.passwd /etc/vsftpd.passwd.db
  • Secure the two files from prying eyes:
    chmod 600 vsftpd.passwd*
  • Teach pam about our database by creating /etc/pam.d/ftp with the following:
    auth required /lib/security/pam_userdb.so db=/etc/vsftpd.passwd
    account required /lib/security/pam_userdb.so db=/etc/vsftpd.passwd
    
  • Create virtual user to run sessions as:
    useradd -d /home/ftpsite vsftpd
  • Move the /etc/vsftpd.conf out of the way
  • Create a new /etc/vsftpd.conf with the following:
    ## Prep things to ensure that logging and virtual users are enabled. This is 
    ## linked with a set of fake PAM password entries
    anon_world_readable_only=YES
    download_enable=NO
    anonymous_enable=NO
    local_enable=YES
    write_enable=YES
    hide_ids=YES
    anon_upload_enable=YES
    anon_mkdir_write_enable=NO
    anon_other_write_enable=NO
    chroot_local_user=YES
    guest_enable=YES
    guest_username=vsftpd
    xferlog_enable=YES
    ## Hiding files should work, but some suse versions doesn't support it.
    hide_file={*,.*}
    
    ## This allows use to manage passive ftp better for firewall security.  Make 
    ## sure these ports are not filtered.
    pasv_min_port=30000
    pasv_max_port=50000
    
    ## This shouldn't be "root" for chown_username, but frankly I don't know what 
    ## user name to use at this point.
    chown_uploads=YES
    chown_username=root
    
    ## We should use local_root/user_sub_token, but some suse version doesn't 
    ## support it.  Thus we do "user_config_dir" with the following command to set 
    ## local_root per user: echo "local_root=/h/site/USER" > /etc/vfstpd-user/USER
    #local_root=/home/ftpsite/$USER
    #user_sub_token=$USER
    user_config_dir=/etc/vsftpd-user/
    

Adding New Users
  • Add to /etc/vsftpd.passwd as per the first step above.
  • Rerun the db_load command per the second step above.
  • Make home directory:
    mkdir /home/ftpsite/USER
  • Set vsftpd as owner:
    chown vsftpd /home/ftpsite/USER
  • Set $HOME via vsftpd:
    echo "local_root=/home/ftpsite/USER" > /etc/vsftpd-user/USER

If You are seeing this, it is broken. =(