VSFTPD install Problem

Starting from inetd

[nadsab]

Hi,

I just installed VSFTPD 2.0.1 under RH 8 2.4.x kernel using the readme files at [vsftpd.beasts.org...] and I can't connect via cuteftp; when I run the command /usr/local/sbin/vsftpd & to test the install, I get the error:

[root@www root]# 500 OOPS: vsftpd: not configured for standalone, must be started from inetd

However when I ran the above command before, it tested out OK. But I was never able to get cuteftp pro to connect via ssh2 so I started tinkering around with my vsftpd config files, nothing seems to work.

How would I start from inetd? Also I configured vsftpd to run under xinetd. Could this be a conflict somewhere in my config files? Or do I also need to config it to run under ssh? I am able to get an SCP connection via WINSCP.

Also, when I run kill -HUP `pidof xinetd` , I'm getting a

# 500 OOPS: could not bind listening IPv4 socket
error after trying to start via the Command
# /usr/local/sbin/vsftpd &

Thanks anyone for any suggestions.

[MattyMoose]

[root@www root]# 500 OOPS: vsftpd: not configured for standalone, must be started from inetd

This means that the config file for the app is telling it to run out of inetd.

From the docs [vsftpd.beasts.org]:

listen
 If enabled, vsftpd will run in standalone mode. This means that vsftpd must not be run from an inetd of some kind. Instead, the vsftpd executable is run once directly. vsftpd itself will then take care of listening for and handling incoming connections.
 Default: NO 

However when I ran the above command before, it tested out OK. But I was never able to get cuteftp pro to connect via ssh2 so I started tinkering around with my vsftpd config files, nothing seems to work.

So is it a replacement for sftp or scp? If you're trying to do that, it may be conflicting with your existing SSH setup. I was always under the impression that you had to connect through standard SSH, which then spawns an sftp-server process, which communicates through the existing ssh tunnel/connection.

How would I start from inetd? Also I configured vsftpd to run under xinetd. Could this be a conflict somewhere in my config files? Or do I also need to config it to run under ssh? I am able to get an SCP connection via WINSCP.

If you're running xinetd, then you shouldn't run inetd, since then you'll have conflicts between the two. (ie: inetd and xinetd are both trying to listen at port 23 or something)

Also, when I run kill -HUP `pidof xinetd` , I'm getting a

# 500 OOPS: could not bind listening IPv4 socket
error after trying to start via the Command
# /usr/local/sbin/vsftpd &

So are you getting the error "500 OOPS" after restarting xinetd AND trying to run it from the command line? At any rate, the "500 OOPS" is telling you that there's already a process that's listening at the specified ports (ie: port 21 for FTP), and it can't bind to it a listen for incoming connections

I'd say get rid of the xinetd and inetd settings for it for the moment, try it from the command line with the "listen" option, and try connecting. If it works, move on to setting it up in xinetd (without the listen option), but remember to kill the existing process before you re-HUP xinetd, otherwise it will conflict again.

-MM

[nadsab]

Hi Matty,

That was the problem, I had xinetd running, shut it down and was able to connect via FTP and SFTP too, THANKS!

By the way, do you know how I would now limit all ftp connections, so that the only way someone could get an ftp connection would by by SFTP - port 22 and block all port 21 regular FTP connection requests? So I can keep server secure?

Thanks much!

[nadsab]

Actually, revisiting a post from last year, Sean suggested that I:

If you don't want any connections into port 21 then it would be more efficient to just not run the daemon, ie disable=yes in /etc/xinetd.d/vsftpd (then restart xinetd)

The iptables way is

iptables -A INPUT -p tcp --dport 21 -j REJECT

If you selectively wanted to allow access by IP address, you could precede it with

iptables -A INPUT -p tcp -s 192.168.0.0/16 --dport 21 -j ACCEPT

which would allow anything from the 192.168.0.0/16 space.

Sean

I'd like to try this, I think I'd like to try the IP tables way instead of xinetd, since I had trouble with xinetd.

My question is, how would I "undo" the "iptables -A INPUT -p tcp --dport 21 -j REJECT" command, in case it breaks my existing functioning VSFTP setup and I want to go back to both 21 and 22 open ports?

This is a Red Hat 8 box by the way.

[py9jmas]

VSFTPD is a FTP server, not a SFTP server. SFTP is provided as a subsystem to OpenSSH, over the SSH port (port 22). You don't need VSFTPD to use SFTP. SFTP is different to FTP over SSL, which VSFTPD does support.

[nadsab]

Thanks py9jmas,

How would I "undo" or "reverse" the "iptables -A INPUT -p tcp --dport 21 -j REJECT" command?

[MattyMoose]

something along the lines of "iptables -F". If you do a "man iptables", and look for "flush", you'll see the arguments to delete all of the entries.
Mind you, if you have other entries that you need, you'll have to look at deleting just the one, which I can't remember how to do. The manpage will show you though.

-MM