Vsftpd FTP Server With Virtual Users ( Berkeley DB + PAM )

Vsftpd supports virtual users with PAM (pluggable authentication modules). A virtual user is a user login which does not exist as a real login on the system in /etc/passwd and /etc/shadow file. Virtual users can therefore be more secure than real users, because a compromised account can only use the FTP server but cannot login to system to use other services such as ssh or smtp.

Required software

• Berkeley DB (version 4) databases
• pam_userdb.so

Install Berkeley DB And Utilities Under RHEL / CentOS

Type the following command:
# yum install db4-utils db4

Create the Virtual Users Database

To create a "db4" format file, first create a plain text files with the usernames and password on alternating lines. For e.g. create user called "shah" with password called "shahpass" and saif with password "saifpass":

# cd /etc/vsftpd
# cat > vusers.txt

Sample output:

shah

shahpass

saif

saifpass

Next, create the actual database file like this:

# db_load -T -t hash -f vusers.txt vsftpd-virtual-user.db
# chmod 600 vsftpd-virtual-user.db
# rm vusers.txt

Configure VSFTPD for virtual user

Edit the vsftpd configuration file. Add or correct the following configuration options:

anonymous_enable=NO
local_enable=YES
# Virtual users will use the same privileges as local users.
# It will grant write access to virtual users. Virtual users will use the
# same privileges as anonymous users, which tends to be more restrictive
# (especially in terms of write access).
virtual_use_local_privs=YES
write_enable=YES

# Set the name of the PAM service vsftpd will use
# RHEL / centos user should use /etc/pam.d/vsftpd
pam_service_name=vsftpd.virtual

# Activates virtual users
guest_enable=YES

# Automatically generate a home directory for each virtual user, based on a template.
# For example, if the home directory of the real user specified via guest_username is
# /home/virtual/$USER, and user_sub_token is set to $USER, then when virtual user shah
# logs in, he will end up (usually chroot()'ed) in the directory /home/virtual/shah.
# This option also takes affect if local_root contains user_sub_token.
user_sub_token=$USER

# Usually this is mapped to Apache virtual hosting docroot, so that
# Users can upload files
local_root=/home/vftp/$USER

# Chroot user and lock down to their home dirs
chroot_local_user=YES

# Hide ids from user
hide_ids=YES

Save and close the file.

Create a PAM File Which Uses Your New Database

The following PAM is used to authenticate users using your new database. Create /etc/pam.d/vsftpd.virtual:

# cat > /etc/pam.d/vsftpd.virtual

Append the following:

#%PAM-1.0

auth required pam_userdb.so db=/etc/vsftpd/vsftpd-virtual-user

account required pam_userdb.so db=/etc/vsftpd/vsftpd-virtual-user

session required pam_loginuid.so

Create The Location Of The Files

You need to set up the location of the files / dirs for the virtual users. Type the following command:

# mkdir /home/vftp
# mkdir -p /home/vftp/{shah,saif}
# chown -R ftp:ftp /home/vftp

Restart The FTP Server

Type the following command

# service vsftpd restart

Test Your Setup

Open another shell session and type:

$ ftp ftp.example.com

Sample output:

Connected to ftp.example.com.
Name (localhost:root): shah
331 Please specify the password.
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp>

Sample log from /var/log/secure:

# tail -f /var/log/secure

Apr 07 14:54:28 xentest vsftpd: pam_userdb(vsftpd.virtual:auth): user 'shah' granted access