vsftpd: local users are pam users

Question

I'm a bit confused about the difference regarding vsftpd configuration between local users and virtual users. From the point of view of vsftpd, it doesn't know if a user is a local user or a virtual user, isn't? vsftpd just connect to the PAM module set in pam_service_name, and if the credentials are correct according to PAM, the login is accepted.

So, why does vsftpd documentation makes a difference between them?

For instance, I have got a personalized PAM module that takes login credentials from a database that doesn't use system local (/etc/passwd) users, and consequently, I cannot log using any system account, even when local_enable is set to YES in my documentation.

This confusion is what makes me not fully understand the purpose of virtual_user_local_privs. Under which circunstances does vsftpd treats a logged user as local or virtual? Does PAM notifies it to vsftpd in some way or what? O is there something that I've completely misunderstood?

Are this configuration options, maybe, still present because of legacy reasons?

All of this confusion comes from vsftp not providing actual documentation, but just a reference.

score 0 · Answer 1 · answered Mar 25 '19 at 18:41

0

It is all about the permissions. All files and directories in Linux have a standard set of access permissions. These access permissions control who can access what files, and provides a fundamental level of security to the files and directories in a system. The main difference between virtual and local users is that local users own their home dirs Virtual users by default have same as anonymous user permissions.

answered Mar 25 '19 at 18:41

badbuka

1
1

But what about `virtual_use_local_privs=[YES|NO]`? – MrCalvin Feb 04 '20 at 11:03

score 0 · Accepted Answer · answered Apr 03 '19 at 01:02

The difference I was looking for is extracted from one of the vsftpd configuration examples in this forked github repo:

guest_enable=YES

guest_username=virtual

The guest_enable is very important - it activates virtual users! And guest_username says that all virtual users are mapped to the real user "virtual" that we set up above.

So local users are just any user that can be logged-in according to the configured PAM service, and virtual users are local (PAM) users that acts (after being logged-in) as a same actual local (/etc/passwd) user. I guess that you can change your guest_username on a per-user basis to identify "virtual ftp user groups".

When you personalize your PAM service to create non-system users (a custom list of usernames and passwords that doesn't exists in /etc/passwd), vsftpd cannot work properly since these users don't really exists in the system, so permissions cannot be checked when uploading or reading directories or files.

So you need a system user acting on behalf of them. That's where guest_enable comes into play: every logged user will act as guest_username, that must exists as /etc/passwd user.

vsftpd: local users are pam users

2 Answers2