topic Re: Secure FTP configuration in Operating System - Linux

Secure FTP configuration

Carlos Munoz Lopez — Wed, 14 Jan 2004 09:10:20 GMT

I have wu-ftp installed on my server running Linux 7.2, and I want to configure sftp but I don't know how, I would like some help on this. I already installed OpenSSH. Every time I try to access via ftp to the server it displays the following:

Connected to 10.20.30.40.
220 abc123 FTP server (Version wu-2.6.1-18) ready.
Name (10.20.30.40:root): root
331 Password required for root.
Password:
530 Login incorrect.
Login failed.

How can I solve this problem??

Re: Secure FTP configuration

Sergejs Svitnevs — Wed, 14 Jan 2004 09:16:51 GMT

check out the following wu-ftpd guide:
http://www.wu-ftpd.org/HOWTO/

Regards,
Sergejs

Re: Secure FTP configuration

Sunil Sharma_1 — Wed, 14 Jan 2004 09:17:30 GMT

Hi,

check /etc/ftpuser file it contains name of users who can not do ftp.

if root is listed there please # it.

have a look on this

http://www.die.net/doc/linux/man/man5/ftpusers.5.html

Sunil

Re: Secure FTP configuration

Steven E. Protter — Wed, 14 Jan 2004 09:33:06 GMT

wu-ftp is not secure.

It can not be made secure for one good reason: it does authenticiation in clear text. If you log into it remotely from halfway across the world, the root password is going to go back and forth in clear text.

Intercepting it is a trivial matter.

By default RH 7.2 disables root ftp access which lowers your exposure to potentially fatal problems. That configuration in wu-ftpd is in the ftpusers file, which you've already gotten some good posts on.

wu-ftpd has nothing to do with secure ftp(sftp)

That is part of openssh.

The Red Hat media you used to make that server 7.2 has openssh client and openssh server 3.0 or 3.1 on it.

Install those two apps and dependencies and you are in the scure ftp business. ssh uses encrypted authentication and root sftp access can be used safely.

See attached doc on password free access.

SEP

Re: Secure FTP configuration

Carlos Munoz Lopez — Wed, 14 Jan 2004 09:33:17 GMT

Thank you for the information, but I really want to use sftp, but I don't know how to configure it.

Re: Secure FTP configuration

Carlos Munoz Lopez — Wed, 14 Jan 2004 09:38:04 GMT

I have both openssh the client and the server installed. What do I have to do to use sftp instead of wu-ftp??

Re: Secure FTP configuration

Sergejs Svitnevs — Wed, 14 Jan 2004 10:11:18 GMT

Sftp uses ssh2 in data connections. The use of sftp is simple.
If you would connect via sftp to your account myname on host1, then use the command:
sftp myname@host1

Regards,
Sergejs

Re: Secure FTP configuration

Fugit Tempus — Wed, 14 Jan 2004 10:25:48 GMT

sftp is part of ssh. This will work right out of the box. As the person above noted just
"$ sftp name@host"

The one draw back to this is your giving them access to the server by giving them shell access. You can limit the access with a change root jail.

http://www.coding-zone.com/chroot-sftp.phtml
http://chrootssh.sourceforge.net/docs/chrootedsftp.html#Build

Hope this helps and good luck.

Re: Secure FTP configuration

Steven E. Protter — Wed, 14 Jan 2004 10:33:31 GMT

The best place to learn about configuration of openssh is:

http://www.openssh.org

There is some doc at http://www.tldp.org

HP-UX documentation on SEcure Shell(which is openssh) is also useful. search manuals for Secure Shell in the itrc search screen for more information.

SEP