| blob | 5ec9a2cc2a98a0a648109f8089021fad4721bcbc |
1 .TH VSFTPD.CONF 5
2 .SH NAME
3 vsftpd.conf \- config file for vsftpd
4 .SH DESCRIPTION
5 vsftpd.conf may be used to control various aspects of vsftpd's behaviour. By
6 default, vsftpd looks for this file at the location
7 .BR /etc/vsftpd.conf .
8 However, you may override this by specifying a command line argument to
9 vsftpd. The command line argument is the pathname of the configuration file
10 for vsftpd. This behaviour is useful because you may wish to use an advanced
11 inetd such as
12 .BR xinetd
13 to launch vsftpd with different configuration files on a per virtual host
14 basis.
16 .SH FORMAT
17 The format of vsftpd.conf is very simple. Each line is either a comment or
18 a directive. Comment lines start with a # and are ignored. A directive line
19 has the format:
21 option=value
23 It is important to note that it is an error to put any space between the
24 option, = and value.
26 Each setting has a compiled in default which may be modified in the
27 configuration file.
29 .SH BOOLEAN OPTIONS
30 Below is a list of boolean options. The value for a boolean option may be set
31 to
32 .BR YES
33 or
34 .BR NO .
36 .TP
37 .B allow_anon_ssl
38 Only applies if
39 .BR ssl_enable
40 is active. If set to YES, anonymous users will be allowed to use secured SSL
41 connections.
43 Default: NO
44 .TP
45 .B anon_mkdir_write_enable
46 If set to YES, anonymous users will be permitted to create new directories
47 under certain conditions. For this to work, the option
48 .BR write_enable
49 must be activated, and the anonymous ftp user must have write permission on
50 the parent directory.
52 Default: NO
53 .TP
54 .B anon_other_write_enable
55 If set to YES, anonymous users will be permitted to perform write operations
56 other than upload and create directory, such as deletion and renaming. This
57 is generally not recommended but included for completeness.
59 Default: NO
60 .TP
61 .B anon_upload_enable
62 If set to YES, anonymous users will be permitted to upload files under certain
63 conditions. For this to work, the option
64 .BR write_enable
65 must be activated, and the anonymous ftp user must have write permission on
66 desired upload locations. This setting is also required for virtual users to
67 upload; by default, virtual users are treated with anonymous (i.e. maximally
68 restricted) privilege.
70 Default: NO
71 .TP
72 .B anon_world_readable_only
73 When enabled, anonymous users will only be allowed to download files which
74 are world readable. This is recognising that the ftp user may own files,
75 especially in the presence of uploads.
77 Default: YES
78 .TP
79 .B anonymous_enable
80 Controls whether anonymous logins are permitted or not. If enabled,
81 both the usernames
82 .BR ftp
83 and
84 .BR anonymous
85 are recognised as anonymous logins.
87 Default: YES
88 .TP
89 .B ascii_download_enable
90 When enabled, ASCII mode data transfers will be honoured on downloads.
92 Default: NO
93 .TP
94 .B ascii_upload_enable
95 When enabled, ASCII mode data transfers will be honoured on uploads.
97 Default: NO
98 .TP
99 .B async_abor_enable
100 When enabled, a special FTP command known as "async ABOR" will be enabled.
101 Only ill advised FTP clients will use this feature. Additionally, this feature
102 is awkward to handle, so it is disabled by default. Unfortunately, some FTP
103 clients will hang when cancelling a transfer unless this feature is available,
104 so you may wish to enable it.
106 Default: NO
107 .TP
108 .B background
109 When enabled, and vsftpd is started in "listen" mode, vsftpd will background
110 the listener process. i.e. control will immediately be returned to the shell
111 which launched vsftpd.
113 Default: NO
114 .TP
115 .B check_shell
116 Note! This option only has an effect for non-PAM builds of vsftpd. If disabled,
117 vsftpd will not check /etc/shells for a valid user shell for local logins.
119 Default: YES
120 .TP
121 .B chmod_enable
122 When enables, allows use of the SITE CHMOD command. NOTE! This only applies
123 to local users. Anonymous users never get to use SITE CHMOD.
125 Default: YES
126 .TP
127 .B chown_uploads
128 If enabled, all anonymously uploaded files will have the ownership changed
129 to the user specified in the setting
130 .BR chown_username .
131 This is useful from an administrative, and perhaps security, standpoint.
133 Default: NO
134 .TP
135 .B chroot_list_enable
136 If activated, you may provide a list of local users who are placed in a
137 chroot() jail in their home directory upon login. The meaning is slightly
138 different if chroot_local_user is set to YES. In this case, the list becomes
139 a list of users which are NOT to be placed in a chroot() jail.
140 By default, the file containing this list is
141 /etc/vsftpd.chroot_list, but you may override this with the
142 .BR chroot_list_file
143 setting.
145 Default: NO
146 .TP
147 .B chroot_local_user
148 If set to YES, local users will be (by default) placed in a chroot() jail in
149 their home directory after login.
150 .BR Warning:
151 This option has security implications, especially if the users have upload
152 permission, or shell access. Only enable if you know what you are doing.
153 Note that these security implications are not vsftpd specific. They apply to
154 all FTP daemons which offer to put local users in chroot() jails.
156 Default: NO
157 .TP
158 .B connect_from_port_20
159 This controls whether PORT style data connections use port 20 (ftp-data) on
160 the server machine. For security reasons, some clients may insist that this
161 is the case. Conversely, disabling this option enables vsftpd to run with
162 slightly less privilege.
164 Default: NO (but the sample config file enables it)
165 .TP
166 .B debug_ssl
167 If true, OpenSSL connection diagnostics are dumped to the vsftpd log file.
168 (Added in v2.0.6).
170 Default: NO
171 .TP
172 .B delete_failed_uploads
173 If true, any failed upload files are deleted. (Added in v2.0.7).
175 Default: NO
176 .TP
177 .B deny_email_enable
178 If activated, you may provide a list of anonymous password e-mail responses
179 which cause login to be denied. By default, the file containing this list is
180 /etc/vsftpd.banned_emails, but you may override this with the
181 .BR banned_email_file
182 setting.
184 Default: NO
185 .TP
186 .B dirlist_enable
187 If set to NO, all directory list commands will give permission denied.
189 Default: YES
190 .TP
191 .B dirmessage_enable
192 If enabled, users of the FTP server can be shown messages when they first
193 enter a new directory. By default, a directory is scanned for the
194 file .message, but that may be overridden with the configuration setting
195 .BR message_file .
197 Default: NO (but the sample config file enables it)
198 .TP
199 .B download_enable
200 If set to NO, all download requests will give permission denied.
202 Default: YES
203 .TP
204 .B dual_log_enable
205 If enabled, two log files are generated in parallel, going by default to
206 .BR /var/log/xferlog
207 and
208 .BR /var/log/vsftpd.log .
209 The former is a wu-ftpd style transfer log, parseable by standard tools. The
210 latter is vsftpd's own style log.
212 Default: NO
213 .TP
214 .B force_dot_files
215 If activated, files and directories starting with . will be shown in directory
216 listings even if the "a" flag was not used by the client. This override
217 excludes the "." and ".." entries.
219 Default: NO
220 .TP
221 .B force_anon_data_ssl
222 Only applies if
223 .BR ssl_enable
224 is activated. If activated, all anonymous logins are forced to use a secure
225 SSL connection in order to send and receive data on data connections.
227 Default: NO
228 .TP
229 .B force_anon_logins_ssl
230 Only applies if
231 .BR ssl_enable
232 is activated. If activated, all anonymous logins are forced to use a secure
233 SSL connection in order to send the password.
235 Default: NO
236 .TP
237 .B force_local_data_ssl
238 Only applies if
239 .BR ssl_enable
240 is activated. If activated, all non-anonymous logins are forced to use a secure
241 SSL connection in order to send and receive data on data connections.
243 Default: YES
244 .TP
245 .B force_local_logins_ssl
246 Only applies if
247 .BR ssl_enable
248 is activated. If activated, all non-anonymous logins are forced to use a secure
249 SSL connection in order to send the password.
251 Default: YES
252 .TP
253 .B guest_enable
254 If enabled, all non-anonymous logins are classed as "guest" logins. A guest
255 login is remapped to the user specified in the
256 .BR guest_username
257 setting.
259 Default: NO
260 .TP
261 .B hide_ids
262 If enabled, all user and group information in directory listings will be
263 displayed as "ftp".
265 Default: NO
266 .TP
267 .B listen
268 If enabled, vsftpd will run in standalone mode. This means that vsftpd must
269 not be run from an inetd of some kind. Instead, the vsftpd executable is
270 run once directly. vsftpd itself will then take care of listening for and
271 handling incoming connections.
273 Default: NO
274 .TP
275 .B listen_ipv6
276 Like the listen parameter, except vsftpd will listen on an IPv6 socket instead
277 of an IPv4 one. This parameter and the listen parameter are mutually
278 exclusive.
280 Default: NO
281 .TP
282 .B local_enable
283 Controls whether local logins are permitted or not. If enabled, normal
284 user accounts in /etc/passwd (or wherever your PAM config references) may be
285 used to log in. This must be enable for any non-anonymous login to work,
286 including virtual users.
288 Default: NO
289 .TP
290 .B lock_upload_files
291 When enabled, all uploads proceed with a write lock on the upload file. All
292 downloads proceed with a shared read lock on the download file. WARNING!
293 Before enabling this, be aware that malicious readers could starve a writer
294 wanting to e.g. append a file.
296 Default: YES
297 .TP
298 .B log_ftp_protocol
299 When enabled, all FTP requests and responses are logged, providing the option
300 xferlog_std_format is not enabled. Useful for debugging.
302 Default: NO
303 .TP
304 .B ls_recurse_enable
305 When enabled, this setting will allow the use of "ls -R". This is a minor
306 security risk, because a ls -R at the top level of a large site may consume
307 a lot of resources.
309 Default: NO
310 .TP
311 .B mdtm_write
312 When enabled, this setting will allow MDTM to set file modification times
313 (subject to the usual access checks).
315 Default: YES
316 .TP
317 .B no_anon_password
318 When enabled, this prevents vsftpd from asking for an anonymous password -
319 the anonymous user will log straight in.
321 Default: NO
322 .TP
323 .B no_log_lock
324 When enabled, this prevents vsftpd from taking a file lock when writing to log
325 files. This option should generally not be enabled. It exists to workaround
326 operating system bugs such as the Solaris / Veritas filesystem combination
327 which has been observed to sometimes exhibit hangs trying to lock log files.
329 Default: NO
330 .TP
331 .B one_process_model
332 If you have a Linux 2.4 kernel, it is possible to use a different security
333 model which only uses one process per connection. It is a less pure security
334 model, but gains you performance. You really don't want to enable this unless
335 you know what you are doing, and your site supports huge numbers of
336 simultaneously connected users.
338 Default: NO
339 .TP
340 .B passwd_chroot_enable
341 If enabled, along with
342 .BR chroot_local_user
343 , then a chroot() jail location may be specified on a per-user basis. Each
344 user's jail is derived from their home directory string in /etc/passwd. The
345 occurrence of /./ in the home directory string denotes that the jail is at that
346 particular location in the path.
348 Default: NO
349 .TP
350 .B pasv_addr_resolve
351 Set to YES if you want to use a hostname (as opposed to IP address) in the
352 .BR pasv_address
353 option.
355 Default: NO
356 .TP
357 .B pasv_enable
358 Set to NO if you want to disallow the PASV method of obtaining a data
359 connection.
361 Default: YES
362 .TP
363 .B pasv_promiscuous
364 Set to YES if you want to disable the PASV security check that ensures the
365 data connection originates from the same IP address as the control connection.
366 Only enable if you know what you are doing! The only legitimate use for this
367 is in some form of secure tunnelling scheme, or perhaps to facilitate FXP
368 support.
370 Default: NO
371 .TP
372 .B port_enable
373 Set to NO if you want to disallow the PORT method of obtaining a data
374 connection.
376 Default: YES
377 .TP
378 .B port_promiscuous
379 Set to YES if you want to disable the PORT security check that ensures that
380 outgoing data connections can only connect to the client. Only enable if
381 you know what you are doing!
383 Default: NO
384 .TP
385 .B require_cert
386 If set to yes, all SSL client connections are required to present a client
387 certificate. The degree of validation applied to this certificate is
388 controlled by
389 .BR validate_cert
390 (Added in v2.0.6).
392 Default: NO
393 .TP
394 .B run_as_launching_user
395 Set to YES if you want vsftpd to run as the user which launched vsftpd. This is
396 useful where root access is not available. MASSIVE WARNING! Do NOT enable this
397 option unless you totally know what you are doing, as naive use of this option
398 can create massive security problems. Specifically, vsftpd does not / cannot
399 use chroot technology to restrict file access when this option is set (even if
400 launched by root). A poor substitute could be to use a
401 .BR deny_file
402 setting such as {/*,*..*}, but the reliability of this cannot compare to
403 chroot, and should not be relied on.
404 If using this option, many restrictions on other options
405 apply. For example, options requiring privilege such as non-anonymous logins,
406 upload ownership changing, connecting from port 20 and listen ports less than
407 1024 are not expected to work. Other options may be impacted.
409 Default: NO
410 .TP
411 .B secure_email_list_enable
412 Set to YES if you want only a specified list of e-mail passwords for anonymous
413 logins to be accepted. This is useful as a low-hassle way of restricting
414 access to low-security content without needing virtual users. When enabled,
415 anonymous logins are prevented unless the password provided is listed in the
416 file specified by the
417 .BR email_password_file
418 setting. The file format is one password per line, no extra whitespace. The
419 default filename is /etc/vsftpd.email_passwords.
421 Default: NO
422 .TP
423 .B session_support
424 This controls whether vsftpd attempts to maintain sessions for logins. If
425 vsftpd is maintaining sessions, it will try and update utmp and wtmp. It
426 will also open a pam_session if using PAM to authenticate, and only close
427 this upon logout. You may wish to disable this if you do not need session
428 logging, and you wish to give vsftpd more opportunity to run with less
429 processes and / or less privilege. NOTE - utmp and wtmp support is only
430 provided with PAM enabled builds.
432 Default: NO
433 .TP
434 .B setproctitle_enable
435 If enabled, vsftpd will try and show session status information in the system
436 process listing. In other words, the reported name of the process will change
437 to reflect what a vsftpd session is doing (idle, downloading etc). You
438 probably want to leave this off for security purposes.
440 Default: NO
441 .TP
442 .B ssl_enable
443 If enabled, and vsftpd was compiled against OpenSSL, vsftpd will support secure
444 connections via SSL. This applies to the control connection (including login)
445 and also data connections. You'll need a client with SSL support too. NOTE!!
446 Beware enabling this option. Only enable it if you need it. vsftpd can make no
447 guarantees about the security of the OpenSSL libraries. By enabling this
448 option, you are declaring that you trust the security of your installed
449 OpenSSL library.
451 Default: NO
452 .TP
453 .B ssl_request_cert
454 If enabled, vsftpd will request (but not necessarily require; see
455 .BR require_cert) a certificate on incoming SSL connections. Normally this
456 should not cause any trouble at all, but IBM zOS seems to have issues.
457 (New in v2.0.7).
459 Default: YES
460 .TP
461 .B ssl_sslv2
462 Only applies if
463 .BR ssl_enable
464 is activated. If enabled, this option will permit SSL v2 protocol connections.
465 TLS v1 connections are preferred.
467 Default: NO
468 .TP
469 .B ssl_sslv3
470 Only applies if
471 .BR ssl_enable
472 is activated. If enabled, this option will permit SSL v3 protocol connections.
473 TLS v1 connections are preferred.
475 Default: NO
476 .TP
477 .B ssl_tlsv1
478 Only applies if
479 .BR ssl_enable
480 is activated. If enabled, this option will permit TLS v1 protocol connections.
481 TLS v1 connections are preferred.
483 Default: YES
484 .TP
485 .B strict_ssl_read_eof
486 If enabled, SSL data uploads are required to terminate via SSL, not an
487 EOF on the socket. This option is required to be sure that an attacker did
488 not terminate an upload prematurely with a faked TCP FIN. Unfortunately, it
489 is not enabled by default because so few clients get it right. (New in v2.0.7).
491 Default: NO
492 .TP
493 .B strict_ssl_write_shutdown
494 If enabled, SSL data downloads are required to terminate via SSL, not an
495 EOF on the socket. This is off by default as I was unable to find a single
496 FTP client that does this. It is minor. All it affects is our ability to tell
497 whether the client confirmed full receipt of the file. Even without this option,
498 the client is able to check the integrity of the download. (New in v2.0.7).
500 Default: NO
501 .TP
502 .B syslog_enable
503 If enabled, then any log output which would have gone to /var/log/vsftpd.log
504 goes to the system log instead. Logging is done under the FTPD facility.
506 Default: NO
507 .TP
508 .B tcp_wrappers
509 If enabled, and vsftpd was compiled with tcp_wrappers support, incoming
510 connections will be fed through tcp_wrappers access control. Furthermore,
511 there is a mechanism for per-IP based configuration. If tcp_wrappers sets
512 the VSFTPD_LOAD_CONF environment variable, then the vsftpd session will try
513 and load the vsftpd configuration file specified in this variable.
515 Default: NO
516 .TP
517 .B text_userdb_names
518 By default, numeric IDs are shown in the user and group fields of directory
519 listings. You can get textual names by enabling this parameter. It is off
520 by default for performance reasons.
522 Default: NO
523 .TP
524 .B tilde_user_enable
525 If enabled, vsftpd will try and resolve pathnames such as ~chris/pics, i.e. a
526 tilde followed by a username. Note that vsftpd will always resolve the
527 pathnames ~ and ~/something (in this case the ~ resolves to the initial
528 login directory). Note that ~user paths will only resolve if the file
529 .BR /etc/passwd
530 may be found within the _current_ chroot() jail.
532 Default: NO
533 .TP
534 .B use_localtime
535 If enabled, vsftpd will display directory listings with the time in your
536 local time zone. The default is to display GMT. The times returned by the
537 MDTM FTP command are also affected by this option.
539 Default: NO
540 .TP
541 .B use_sendfile
542 An internal setting used for testing the relative benefit of using the
543 sendfile() system call on your platform.
545 Default: YES
546 .TP
547 .B userlist_deny
548 This option is examined if
549 .B userlist_enable
550 is activated. If you set this setting to NO, then users will be denied login
551 unless they are explicitly listed in the file specified by
552 .BR userlist_file .
553 When login is denied, the denial is issued before the user is asked for a
554 password.
556 Default: YES
557 .TP
558 .B userlist_enable
559 If enabled, vsftpd will load a list of usernames, from the filename given by
560 .BR userlist_file .
561 If a user tries to log in using a name in this file, they will be denied
562 before they are asked for a password. This may be useful in preventing
563 cleartext passwords being transmitted. See also
564 .BR userlist_deny .
566 Default: NO
567 .TP
568 .B validate_cert
569 If set to yes, all SSL client certificates received must validate OK.
570 Self-signed certs do not constitute OK validation. (New in v2.0.6).
572 Default: NO
573 .TP
574 .B virtual_use_local_privs
575 If enabled, virtual users will use the same privileges as local users. By
576 default, virtual users will use the same privileges as anonymous users, which
577 tends to be more restrictive (especially in terms of write access).
579 Default: NO
580 .TP
581 .B write_enable
582 This controls whether any FTP commands which change the filesystem are allowed
583 or not. These commands are: STOR, DELE, RNFR, RNTO, MKD, RMD, APPE and SITE.
585 Default: NO
586 .TP
587 .B xferlog_enable
588 If enabled, a log file will be maintained detailling uploads and downloads.
589 By default, this file will be placed at /var/log/vsftpd.log, but this location
590 may be overridden using the configuration setting
591 .BR vsftpd_log_file .
593 Default: NO (but the sample config file enables it)
594 .TP
595 .B xferlog_std_format
596 If enabled, the transfer log file will be written in standard xferlog format,
597 as used by wu-ftpd. This is useful because you can reuse existing transfer
598 statistics generators. The default format is more readable, however. The
599 default location for this style of log file is /var/log/xferlog, but you may
600 change it with the setting
601 .BR xferlog_file .
603 Default: NO
605 .SH NUMERIC OPTIONS
606 Below is a list of numeric options. A numeric option must be set to a non
607 negative integer. Octal numbers are supported, for convenience of the umask
608 options. To specify an octal number, use 0 as the first digit of the number.
610 .TP
611 .B accept_timeout
612 The timeout, in seconds, for a remote client to establish connection with
613 a PASV style data connection.
615 Default: 60
616 .TP
617 .B anon_max_rate
618 The maximum data transfer rate permitted, in bytes per second, for anonymous
619 clients.
621 Default: 0 (unlimited)
622 .TP
623 .B anon_umask
624 The value that the umask for file creation is set to for anonymous users. NOTE! If you want to specify octal values, remember the "0" prefix otherwise the
625 value will be treated as a base 10 integer!
627 Default: 077
628 .TP
629 .B chown_upload_mode
630 The file mode to force for chown()ed anonymous uploads. (Added in v2.0.6).
632 Default: 0600
633 .TP
634 .B connect_timeout
635 The timeout, in seconds, for a remote client to respond to our PORT style
636 data connection.
638 Default: 60
639 .TP
640 .B data_connection_timeout
641 The timeout, in seconds, which is roughly the maximum time we permit data
642 transfers to stall for with no progress. If the timeout triggers, the remote
643 client is kicked off.
645 Default: 300
646 .TP
647 .B delay_failed_login
648 The number of seconds to pause prior to reporting a failed login.
650 Default: 1
651 .TP
652 .B delay_successful_login
653 The number of seconds to pause prior to allowing a successful login.
655 Default: 0
656 .TP
657 .B file_open_mode
658 The permissions with which uploaded files are created. Umasks are applied
659 on top of this value. You may wish to change to 0777 if you want uploaded
660 files to be executable.
662 Default: 0666
663 .TP
664 .B ftp_data_port
665 The port from which PORT style connections originate (as long as the poorly
666 named
667 .BR connect_from_port_20
668 is enabled).
670 Default: 20
671 .TP
672 .B idle_session_timeout
673 The timeout, in seconds, which is the maximum time a remote client may spend
674 between FTP commands. If the timeout triggers, the remote client is kicked
675 off.
677 Default: 300
678 .TP
679 .B listen_port
680 If vsftpd is in standalone mode, this is the port it will listen on for
681 incoming FTP connections.
683 Default: 21
684 .TP
685 .B local_max_rate
686 The maximum data transfer rate permitted, in bytes per second, for local
687 authenticated users.
689 Default: 0 (unlimited)
690 .TP
691 .B local_umask
692 The value that the umask for file creation is set to for local users. NOTE! If
693 you want to specify octal values, remember the "0" prefix otherwise the value
694 will be treated as a base 10 integer!
696 Default: 077
697 .TP
698 .B max_clients
699 If vsftpd is in standalone mode, this is the maximum number of clients which
700 may be connected. Any additional clients connecting will get an error message.
702 Default: 0 (unlimited)
703 .TP
704 .B max_login_fails
705 After this many login failures, the session is killed.
707 Default: 3
708 .TP
709 .B max_per_ip
710 If vsftpd is in standalone mode, this is the maximum number of clients which
711 may be connected from the same source internet address. A client will get an
712 error message if they go over this limit.
714 Default: 0 (unlimited)
715 .TP
716 .B pasv_max_port
717 The maximum port to allocate for PASV style data connections. Can be used to
718 specify a narrow port range to assist firewalling.
720 Default: 0 (use any port)
721 .TP
722 .B pasv_min_port
723 The minimum port to allocate for PASV style data connections. Can be used to
724 specify a narrow port range to assist firewalling.
726 Default: 0 (use any port)
727 .TP
728 .B trans_chunk_size
729 You probably don't want to change this, but try setting it to something like
730 8192 for a much smoother bandwidth limiter.
732 Default: 0 (let vsftpd pick a sensible setting)
734 .SH STRING OPTIONS
735 Below is a list of string options.
737 .TP
738 .B anon_root
739 This option represents a directory which vsftpd will try to change into
740 after an anonymous login. Failure is silently ignored.
742 Default: (none)
743 .TP
744 .B banned_email_file
745 This option is the name of a file containing a list of anonymous e-mail
746 passwords which are not permitted. This file is consulted if the option
747 .BR deny_email_enable
748 is enabled.
750 Default: /etc/vsftpd.banned_emails
751 .TP
752 .B banner_file
753 This option is the name of a file containing text to display when someone
754 connects to the server. If set, it overrides the banner string provided by
755 the
756 .BR ftpd_banner
757 option.
759 Default: (none)
760 .TP
761 .B ca_certs_file
762 This option is the name of a file to load Certificate Authority certs from, for
763 the purpose of validating client certs. Regrettably, the default SSL CA cert
764 paths are not used, because of vsftpd's use of restricted filesystem spaces
765 (chroot). (Added in v2.0.6).
767 Default: (none)
768 .TP
769 .B chown_username
770 This is the name of the user who is given ownership of anonymously uploaded
771 files. This option is only relevant if another option,
772 .BR chown_uploads ,
773 is set.
775 Default: root
776 .TP
777 .B chroot_list_file
778 The option is the name of a file containing a list of local users which
779 will be placed in a chroot() jail in their home directory. This option is
780 only relevant if the option
781 .BR chroot_list_enable
782 is enabled. If the option
783 .BR chroot_local_user
784 is enabled, then the list file becomes a list of users to NOT place in a
785 chroot() jail.
787 Default: /etc/vsftpd.chroot_list
788 .TP
789 .B cmds_allowed
790 This options specifies a comma separated list of allowed FTP commands (post
791 login. USER, PASS and QUIT are always allowed pre-login). Other
792 commands are rejected. This is a powerful method of really locking down an
793 FTP server. Example: cmds_allowed=PASV,RETR,QUIT
795 Default: (none)
796 .TP
797 .B deny_file
798 This option can be used to set a pattern for filenames (and directory names
799 etc.) which should not be accessible in any way. The affected items are not
800 hidden, but any attempt to do anything to them (download, change into
801 directory, affect something within directory etc.) will be denied. This option
802 is very simple, and should not be used for serious access control - the
803 filesystem's permissions should be used in preference. However, this option
804 may be useful in certain virtual user setups. In particular aware that if
805 a filename is accessible by a variety of names (perhaps due to symbolic
806 links or hard links), then care must be taken to deny access to all the names.
807 Access will be denied to items if their name contains the string given by
808 hide_file, or if they match the regular expression specified by hide_file.
809 Note that vsftpd's regular expression matching code is a simple implementation
810 which is a subset of full regular expression functionality. Because of this,
811 you will need to carefully and exhaustively test any application of this
812 option. And you are recommended to use filesystem permissions for any
813 important security policies due to their greater reliability. Supported
814 regex syntax is any number of *, ? and unnested {,} operators. Regex
815 matching is only supported on the last component of a path, e.g. a/b/? is
816 supported but a/?/c is not.
817 Example: deny_file={*.mp3,*.mov,.private}
819 Default: (none)
820 .TP
821 .B dsa_cert_file
822 This option specifies the location of the DSA certificate to use for SSL
823 encrypted connections.
825 Default: (none - an RSA certificate suffices)
826 .TP
827 .B dsa_private_key_file
828 This option specifies the location of the DSA private key to use for SSL
829 encrypted connections. If this option is not set, the private key is expected
830 to be in the same file as the certificate.
832 Default: (none)
833 .TP
834 .B email_password_file
835 This option can be used to provide an alternate file for usage by the
836 .BR secure_email_list_enable
837 setting.
839 Default: /etc/vsftpd.email_passwords
840 .TP
841 .B ftp_username
842 This is the name of the user we use for handling anonymous FTP. The home
843 directory of this user is the root of the anonymous FTP area.
845 Default: ftp
846 .TP
847 .B ftpd_banner
848 This string option allows you to override the greeting banner displayed
849 by vsftpd when a connection first comes in.
851 Default: (none - default vsftpd banner is displayed)
852 .TP
853 .B guest_username
854 See the boolean setting
855 .BR guest_enable
856 for a description of what constitutes a guest login. This setting is the
857 real username which guest users are mapped to.
859 Default: ftp
860 .TP
861 .B hide_file
862 This option can be used to set a pattern for filenames (and directory names
863 etc.) which should be hidden from directory listings. Despite being hidden,
864 the files / directories etc. are fully accessible to clients who know what
865 names to actually use. Items will be hidden if their names contain the string
866 given by hide_file, or if they match the regular expression specified by
867 hide_file. Note that vsftpd's regular expression matching code is a simple
868 implementation which is a subset of full regular expression functionality.
869 See
870 .BR deny_file
871 for details of exactly what regex syntax is supported.
872 Example: hide_file={*.mp3,.hidden,hide*,h?}
874 Default: (none)
875 .TP
876 .B listen_address
877 If vsftpd is in standalone mode, the default listen address (of all local
878 interfaces) may be overridden by this setting. Provide a numeric IP address.
880 Default: (none)
881 .TP
882 .B listen_address6
883 Like listen_address, but specifies a default listen address for the IPv6
884 listener (which is used if listen_ipv6 is set). Format is standard IPv6
885 address format.
887 Default: (none)
888 .TP
889 .B local_root
890 This option represents a directory which vsftpd will try to change into
891 after a local (i.e. non-anonymous) login. Failure is silently ignored.
893 Default: (none)
894 .TP
895 .B message_file
896 This option is the name of the file we look for when a new directory is
897 entered. The contents are displayed to the remote user. This option is
898 only relevant if the option
899 .BR dirmessage_enable
900 is enabled.
902 Default: .message
903 .TP
904 .B nopriv_user
905 This is the name of the user that is used by vsftpd when it wants to be
906 totally unprivileged. Note that this should be a dedicated user, rather
907 than nobody. The user nobody tends to be used for rather a lot of important
908 things on most machines.
910 Default: nobody
911 .TP
912 .B pam_service_name
913 This string is the name of the PAM service vsftpd will use.
915 Default: ftp
916 .TP
917 .B pasv_address
918 Use this option to override the IP address that vsftpd will advertise in
919 response to the PASV command. Provide a numeric IP address, unless
920 .BR pasv_addr_resolve
921 is enabled, in which case you can provide a hostname which will be DNS
922 resolved for you at startup.
924 Default: (none - the address is taken from the incoming connected socket)
925 .TP
926 .B rsa_cert_file
927 This option specifies the location of the RSA certificate to use for SSL
928 encrypted connections.
930 Default: /usr/share/ssl/certs/vsftpd.pem
931 .TP
932 .B rsa_private_key_file
933 This option specifies the location of the RSA private key to use for SSL
934 encrypted connections. If this option is not set, the private key is expected
935 to be in the same file as the certificate.
937 Default: (none)
938 .TP
939 .B secure_chroot_dir
940 This option should be the name of a directory which is empty. Also, the
941 directory should not be writable by the ftp user. This directory is used
942 as a secure chroot() jail at times vsftpd does not require filesystem access.
944 Default: /usr/share/empty
945 .TP
946 .B ssl_ciphers
947 This option can be used to select which SSL ciphers vsftpd will allow for
948 encrypted SSL connections. See the
949 .BR ciphers
950 man page for further details. Note that restricting ciphers can be a useful
951 security precaution as it prevents malicious remote parties forcing a cipher
952 which they have found problems with.
954 Default: DES-CBC3-SHA
955 .TP
956 .B user_config_dir
957 This powerful option allows the override of any config option specified in
958 the manual page, on a per-user basis. Usage is simple, and is best illustrated
959 with an example. If you set
960 .BR user_config_dir
961 to be
962 .BR /etc/vsftpd_user_conf
963 and then log on as the user "chris", then vsftpd will apply the settings in
964 the file
965 .BR /etc/vsftpd_user_conf/chris
966 for the duration of the session. The format of this file is as detailed in
967 this manual page! PLEASE NOTE that not all settings are effective on a
968 per-user basis. For example, many settings only prior to the user's session
969 being started. Examples of settings which will not affect any behviour on
970 a per-user basis include listen_address, banner_file, max_per_ip, max_clients,
971 xferlog_file, etc.
973 Default: (none)
974 .TP
975 .B user_sub_token
976 This option is useful is conjunction with virtual users. It is used to
977 automatically generate a home directory for each virtual user, based on a
978 template. For example, if the home directory of the real user specified via
979 .BR guest_username
980 is
981 .BR /home/virtual/$USER ,
982 and
983 .BR user_sub_token
984 is set to
985 .BR $USER ,
986 then when virtual user fred logs in, he will end up (usually chroot()'ed) in
987 the directory
988 .BR /home/virtual/fred .
989 This option also takes affect if
990 .BR local_root
991 contains
992 .BR user_sub_token .
994 Default: (none)
995 .TP
996 .B userlist_file
997 This option is the name of the file loaded when the
998 .BR userlist_enable
999 option is active.
1001 Default: /etc/vsftpd.user_list
1002 .TP
1003 .B vsftpd_log_file
1004 This option is the name of the file to which we write the vsftpd style
1005 log file. This log is only written if the option
1006 .BR xferlog_enable
1007 is set, and
1008 .BR xferlog_std_format
1009 is NOT set. Alternatively, it is written if you have set the option
1010 .BR dual_log_enable .
1011 One further complication - if you have set
1012 .BR syslog_enable ,
1013 then this file is not written and output is sent to the system log instead.
1015 Default: /var/log/vsftpd.log
1016 .TP
1017 .B xferlog_file
1018 This option is the name of the file to which we write the wu-ftpd style
1019 transfer log. The transfer log is only written if the option
1020 .BR xferlog_enable
1021 is set, along with
1022 .BR xferlog_std_format .
1023 Alternatively, it is written if you have set the option
1024 .BR dual_log_enable .
1026 Default: /var/log/xferlog
1028 .SH AUTHOR
1029 scarybeasts@gmail.com