vsftpd 500 OOPS: cannot change directory

SUSE Product Topics SLES Networking
1

hi

i create ftp server on suse enterprise and i’ve join my domain, but i’ve a problem with vsftpd when i try to connect with filezila

i’ve this message 500 OOPS: cannot change directory:/home/cola/toto

i want to connect at server ftp with my logs windows AD not user local

i’ve tests so much soluce for this error but change nothing.

for exemple : command setenforce 0 or getenforce or setbool etc… command-not-found setenforce

and i can authenticate me only with port 22 on FileZila

SUSE Linux Enterprise Server 11 SP2 (x86_64)
vsftpd: version 2.0.7
my config :

General Settings

Uncomment this to enable any form of FTP write command.

write_enable=YES

Activate directory messages - messages given to remote users when they

go into a certain directory.

#dirmessage_enable=YES

It is recommended that you define on your system a unique user which the

ftp server can use as a totally isolated and unprivileged user.

#nopriv_user=ftpsecure

You may activate the “-R” option to the builtin ls. This is disabled by

default to avoid remote users being able to cause excessive I/O on large

sites. However, some broken FTP clients such as “ncftp” and “mirror” assume

the presence of the “-R” option, so there is a strong case for enabling it.

#ls_recurse_enable=YES

You may specify a file of disallowed anonymous e-mail addresses. Apparently

useful for combatting certain DoS attacks.

#deny_email_enable=YES

(default follows)

#banned_email_file=/etc/vsftpd.banned_emails

If enabled, all user and group information in

directory listings will be displayed as “ftp”.

hide_ids=YES

Default umask for local users is 077. You may wish to change this to 022,

if your users expect that (022 is used by most other ftpd’s)

local_umask=022

You may specify an explicit list of local users to chroot() to their home

directory. If chroot_local_user is YES, then this list becomes a list of

users to NOT chroot().

chroot_list_enable=NO

(default follows)

#chroot_list_file=/etc/vsftpd.chroot_list

The maximum data transfer rate permitted, in bytes per second, for

local authenticated users. The default is 0 (unlimited).

local_max_rate=7168

Anonymous users will only be allowed to download files which are

world readable.

#anon_world_readable_only=YES

Uncomment this to allow the anonymous FTP user to upload files. This only

has an effect if the above global write enable is activated. Also, you will

obviously need to create a directory writable by the FTP user.

anon_upload_enable=NO

Default umask for anonymus users is 077. You may wish to change this to 022,

if your users expect that (022 is used by most other ftpd’s)

#anon_umask=022

Uncomment this if you want the anonymous FTP user to be able to create

new directories.

anon_mkdir_write_enable=NO

Uncomment this to enable anonymus FTP users to perform other write operations

like deletion and renaming.

#anon_other_write_enable=YES

If you want, you can arrange for uploaded anonymous files to be owned by

a different user. Note! Using “root” for uploaded files is not

recommended!

#chown_uploads=YES
#chown_username=whoever

The maximum data transfer rate permitted, in bytes per second, for anonymous

authenticated users. The default is 0 (unlimited).

#anon_max_rate=7168

Log Settings

Log to the syslog daemon instead of using an logfile.

#syslog_enable=YES

Activate logging of uploads/downloads.

xferlog_enable=YES

You may override where the log file goes if you like. The default is shown

below.

#vsftpd_log_file=/var/log/vsftpd.log

If you want, you can have your log file in standard ftpd xferlog format.

Note: This disables the normal logging unless you enable dual_log_enable below.

#xferlog_std_format=NO

You may override where the log file goes if you like. The default is shown

below.

xferlog_file=/var/log/xferlog

Enable this to have booth logfiles. Standard xferlog and vsftpd’s own style log.

#dual_log_enable=YES

Uncomment this to enable session status information in the system process listing.

#setproctitle_enable=YES

Transfer Settings

Make sure PORT transfer connections originate from port 20 (ftp-data).

connect_from_port_20=YES

You may change the default value for timing out a data connection.

data_connection_timeout=120

Enable this and the server will recognise asynchronous ABOR requests. Not

recommended for security (the code is non-trivial). Not enabling it,

however, may confuse older FTP clients.

async_abor_enable=NO

By default the server will pretend to allow ASCII mode but in fact ignore

the request. Turn on the below options to have the server actually do ASCII

mangling on files when in ASCII mode.

Beware that turning on ascii_download_enable enables malicious remote parties

to consume your I/O resources, by issuing the command “SIZE /big/file” in

ASCII mode.

These ASCII options are split into upload and download because you may wish

to enable ASCII uploads (to prevent uploaded scripts etc. from breaking),

without the DoS risk of SIZE and ASCII downloads. ASCII mangling should be

on the client anyway…

ascii_upload_enable=NO
ascii_download_enable=NO

PAM setting. Do NOT change this unless you know what you do!

pam_service_name=vsftpd

Set listen=YES if you want vsftpd to run standalone

listen=YES

Set to ssl_enable=YES if you want to enable SSL

ssl_enable=NO

Limit passive ports to this range to assis firewalling

pasv_min_port=30000
pasv_max_port=30100
anon_mkdir_write_enable=NO
anon_root=/home
anon_upload_enable=NO
chroot_local_user=YES
ftpd_banner=Welcome message
idle_session_timeout=900
local_enable=YES
log_ftp_protocol=YES
max_clients=15
max_per_ip=3
pasv_enable=YES
ssl_sslv2=NO
ssl_sslv3=NO
ssl_tlsv1=NO
write_enable=YES
local_root=/home/cola
anonymous_enable=NO

On windows

CUsers\toto>ftp 10.xx.xx.xx
Connecté à 10.xx.xx.xx.
220 Welcome message
Utilisateur (10.xx.xx.xxnone)) : cola\toto
331 Please specify the password.
Mot de passe :
500 OOPS: cannot change directory:/home/cola/toto
500 OOPS: child died
Connexion fermée par l’hôte distant.

tell me if my config its ok or not any criticism is good

help me pls ^^

2

Hi rize27,

any more details in the vsftpd and/or system logs?

Judging from the message, you were logged in correctly, but either the home directory is non-local to the ftd server and could not be attached, or some other setting prevented vsftpd from entering that directory.

How have you set up the server system with regards to providing the home directories? Is /home/cola/toto available at all times (static mount) or is it some automounted user directory?

To further debug, check “/var/log/vsftpd.log” to see if the user was logged in successfully and as which (Linux) user the process acts. Then check if that Linux user can access the directory /home/cola/toto on the ftp server system (check this locally on the server, I’m not talking FTP here).

Regards,
Jens

3

hi jens,

ftpext:/home # ls -l
total 12
drwxrwxr-x 2 root cola\domain users 4096 Oct 13 17:44 cola
drwxr-xr-x 19 admin users 4096 Oct 6 16:53 admin

i can have to access with logs AD in local with graphic interface and user home directory is created

How have you set up the server system with regards to providing the home directories? Is /home/cola/toto available at all times (static mount) or is it some automounted user directory? automounted user directory i think no static
I would like that users’ home directories be created when they connect to the ftp the first time

i’ve solved the problem 500 OOPS: cannot change directory with the command set sebool -P ftp_home_dir on but now i’ve error 500 permission dernied, i can’t create a new folder and always not user home directory

4

Hi rize27,

[QUOTE=rize27;24153]hi jens,

ftpext:/home # ls -l
total 12
drwxrwxr-x 2 root cola\domain users 4096 Oct 13 17:44 cola
drwxr-xr-x 19 admin users 4096 Oct 6 16:53 admin

i can have to access with logs AD in local with graphic interface and user home directory is created

How have you set up the server system with regards to providing the home directories? Is /home/cola/toto available at all times (static mount) or is it some automounted user directory? automounted user directory i think no static
I would like that users’ home directories be created when they connect to the ftp the first time

i’ve solved the problem 500 OOPS: cannot change directory with the command set sebool -P ftp_home_dir on but now i’ve error 500 permission dernied, i can’t create a new folder and always not user home directory[/QUOTE]

sounds to me like an improper mapping of the AD user to the local user id. I haven’t toyed with such a scenario yet, so all I can recommend is to check the logs to find out as which user vsftpd tries to act, once the login is completed, and to correct that so that the right user mapping is used.

One thing comes to mind, though: As you’re using some sort of automounting and local logins work for you - is the mounting done via PAM? That code path has access to the login password, maybe your current setup forr PAM/vsftp doesn’t include the configuration to mount the user’s home directory or does not/cannot provide the user’s password to smbmount the directory from the external server?

Regards,
Jens

5

i show you my conf to pam.d/vsftpd and smb.conf

#%PAM-1.0

Uncomment this to achieve what used to be ftpd -A.

auth required pam_listfile.so item=user sense=allow file=/etc/ftpchroot onerr=fail

auth required pam_listfile.so item=user sense=deny file=/etc/ftpusers onerr=succeed

Uncomment the following line for anonymous ftp.

auth sufficient pam_ftp.so
auth required pam_shells.so
auth include common-auth
account include common-account
password include common-password
session required pam_loginuid.so
session include common-session

/etc/smb.conf

[global]
passdb backend = tdbsam
printing = cups
printcap name = cups
printcap cache time = 750
cups options = raw
map to guest = Bad User
include = /etc/samba/dhcp.conf
logon path = \\%L\profiles\.msprofile
logon home = \\%L\%U\.9xprofile
logon drive = P:
usershare allow guests = No
idmap gid = 10000-20000
idmap uid = 10000-20000
security = ADS
workgroup = cola
wins support = No
kerberos method = secrets and keytab
realm = cola.com
template homedir = /home/cola
template shell = /bin/bash
winbind offline logon = yes
winbind refresh tickets = yes

[homes]
comment = Home Directories
valid users = %S, %D%w%S
browseable = no
read only = no
inherit acls = Yes
directory mask = 777
[profiles]
comment = Network Profiles Service
path = %H
read only = No
store dos attributes = Yes
create mask = 0600
directory mask = 0755

[profiles]
comment = Network Profiles Service
path = %H
read only = No
store dos attributes = Yes
create mask = 0600
directory mask = 0755
[users]
comment = All users
path = /home
read only = No
inherit acls = Yes
veto files = /aquota.user/groups/shares/
[groups]
comment = All groups
path = /home/groups
read only = No
inherit acls = Yes
[printers]
comment = All Printers
path = /var/tmp
printable = Yes
create mask = 0600
browseable = No
[print$]
comment = Printer Drivers
path = /var/lib/samba/drivers
write list = @ntadmin root
force group = ntadmin
create mask = 0664
directory mask = 0775

and tail -f /var/log/message

Oct 14 13:42:37 ftpext vsftpd: Tue Oct 14 13:42:37 2014 [pid 4964] [cola\toto] FTP command: Client “xx.xx.176.15”, “PASS "
Oct 14 13:42:37 ftpext vsftpd: pam_winbind(vsftpd:auth): getting password (0x00000390)
Oct 14 13:42:37 ftpext vsftpd: pam_winbind(vsftpd:auth): pam_get_item returned a password
Oct 14 13:42:37 ftpext vsftpd: pam_winbind(vsftpd:auth): user ‘cola\toto’ granted access
Oct 14 13:42:37 ftpext vsftpd: pam_winbind(vsftpd:account): user ‘cola\toto’ granted access
Oct 14 13:42:37 ftpext vsftpd: Tue Oct 14 13:42:37 2014 [pid 4963] [cola\toto] OK LOGIN: Client"x.xx.176.15”
Oct 14 13:42:37 ftpext vsftpd: Tue Oct 14 13:42:37 2014 [pid 4965] [cola\toto] FTP response: Cli ent “xx.xx.176.15”, “230 Login successful.”
Oct 14 13:42:37 ftpext vsftpd: Tue Oct 14 13:42:37 2014 [pid 4965] [cola\toto] FTP command: Client “xx.xx.176.15”, “OPTS UTF8 ON”
Oct 14 13:42:37 ftpext vsftpd: Tue Oct 14 13:42:37 2014 [pid 4965] [cola\toto] FTP response: Client “xx.xx.176.15”, “200 Always in UTF8 mode.”
Oct 14 13:42:37 ftpext vsftpd: Tue Oct 14 13:42:37 2014 [pid 4965] [cola\toto] FTP command: Client “xx.xx.176.15”, “PWD”
Oct 14 13:42:37 ftpext vsftpd: Tue Oct 14 13:42:37 2014 [pid 4965] [cola\toto] FTP response: Client “xx.xx.176.15”, “257 “/””
Oct 14 13:42:37 ftpext vsftpd: Tue Oct 14 13:42:37 2014 [pid 4965] [cola\toto] FTP command: Client “xx.xx.176.15”, “TYPE I”
Oct 14 13:42:37 ftpext vsftpd: Tue Oct 14 13:42:37 2014 [pid 4965] [cola\toto] FTP response: Client “xx.xx.176.15”, “200 Switching to Binary mode.”
Oct 14 13:42:37 ftpext vsftpd: Tue Oct 14 13:42:37 2014 [pid 4965] [cola\toto] FTP command: Client “xx.xx.176.15”, “PASV”
Oct 14 13:42:37 ftpext vsftpd: Tue Oct 14 13:42:37 2014 [pid 4965] [cola\toto] FTP response: Client “xx.xx.176.15”, “227 Entering Passive Mode (xx,xx,2,148,117,121)”
Oct 14 13:42:37 ftpext vsftpd: Tue Oct 14 13:42:37 2014 [pid 4965] [cola\toto] FTP command: Client “xx.xx.176.15”, “LIST”
Oct 14 13:42:37 ftpext vsftpd: Tue Oct 14 13:42:37 2014 [pid 4965] [cola\toto] FTP response: Client “xx.xx.176.15”, “150 Here comes the directory listing.”
Oct 14 13:42:37 ftpext vsftpd: Tue Oct 14 13:42:37 2014 [pid 4965] [cola\toto] FTP response: Client “xx.xx.176.15”, “226 Directory send OK.”

6

Hi rize27,

some comments / questions:

  • “onerr=succeed” in pam profiles makes my stomach hurt, although it may have its use.
  • what’s in common-auth and common-session?
  • are the home directories on the same server as the FTP server? You have the “homes” share active in your smb.conf, OTOH you said you have automount active for domain user home directories.

To me it looks like vsftpd doesn’t know about the home dir. You need to investigate, perhaps by turning on debug mode of pam_winbind, and trace the according information flow.

Regards,
Jens

7

[QUOTE=jmozdzen;24160]Hi rize27,

some comments / questions:

  • “onerr=succeed” in pam profiles makes my stomach hurt, although it may have its use.
  • what’s in common-auth and common-session?
  • are the home directories on the same server as the FTP server? You have the “homes” share active in your smb.conf, OTOH you said you have automount active for domain user home directories.

To me it looks like vsftpd doesn’t know about the home dir. You need to investigate, perhaps by turning on debug mode of pam_winbind, and trace the according information flow.

Regards,
Jens[/QUOTE]

vi /etc/pam.d/common-auth
auth required pam_env.so
auth sufficient pam_unix2.so
auth required pam_winbind.so use_first_pass

vi /etc/pam.d/common-session

session optional pam_mkhomedir.so
session required pam_limits.so
session required pam_unix2.so
session required pam_winbind.so
session optional pam_umask.so

Yes the home directories is on FTP server
i’ve not understand the problem with automount ?

thank you for your help

8

Hi rize27,

[QUOTE=rize27;24196]
Yes the home directories is on FTP server
i’ve not understand the problem with automount ?[/QUOTE]

My automount comments are a reaction to your other answer:

[QUOTE=rize27;24153]> How have you set up the server system with regards to providing the home directories? Is /home/cola/toto available at all times (static mount) or is it some automounted user directory?
automounted user directory i think no static [/QUOTE]

If the home directory is on the ftp server, you’d usually not use automount to mount it to a second location on the same server. So your two answers seem to contradict each other. that confuses me :/.

What have you found out so far from the analysis of winbind and the FTP login steps?

Regards,
Jens