I'm not very literate with Linux, so my terminology isn't great.
I purchased an offshore server I'm using to hold my files, it has Linux - Debian 6 32bit on it and I have installed and setup Samba.
I can access the Guest Share dir.
However, for operations I wanted to make it so I required a username and password, so I tried to manipulate it.
I have tried:
useradd samba-user -m -G users - Nothing happened
I'm unsure of the creation steps behind this and do not understand any of the guides (Due to me not following the terminology of it).
Any help would be much appreciated
Solution:
Setup
Apt-get upgrade
sudo apt-get install samba smbfs
sudo mkdir –m 0777 /pathofdrive
Editing the samba config
sudo vi /etc/samba/smb.conf
Copy this:
# Global parameters
[global]
workgroup = HOME
netbios name = SAMBA
server string = Samba Server %v
map to guest = Bad User
log file = /var/log/samba/log.%m
max log size = 50
socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192
preferred master = No
local master = No
dns proxy = No
security = User
# Share
[Data]
path = /disk2/data
valid users = joel
read only = No
create mask = 0777
directory mask = 0777
Adding a user:
# useradd -c "Joel Nahrgang" joel
# smbpasswd -a joel
New SMB password: secret
Reenter SMB password: secret
Added user joel
Restarting Samba:
sudo /etc/init.d/samba restart
Related
I'm struggling in creating an FTP user on a Linux server using the command line.
I installed vsftpd
Then i created a user using multiple commands for multiple times like
sudo adduser --home /home/testuser testuser --no-create-home
Added password to it,
Edited etc/vsftpd.conf file,
enabled chroot_local_user=YES,
Added user name to config files, etc etc. But none seems to work.
They are getting created as SFTP users. I disabled the SSH access and then it stopped for FTP too.
What all I need is to do is simply set up an FTP user and jail them to a path without SSH access.
Can anyone help?
I had gone through a lot of posts. But still no solution.
There are lot more FTP serves like vsftpd, ProFTP, and PureFTP.
But with vsftpd there are known issues. That's right. You can use ProFTP and I followed the same method using ProFTP. It worked.
Instead of trying vsftpd,
I used ProFTP and it worked. I followed the below steps and it worked.
ProFTP Setup in Linux:
Document Link
https://www.digitalocean.com/community/tutorials/how-to-set-up-proftpd-on-ubuntu-12-04
sudo apt-get install proftpd (to install)
sudo apt-get remove proftpd (to uninstall)
Edit the ProFTP configuration file located at /etc/proftpd/proftpd.conf to update specific settings
sudo vi /etc/proftpd/proftpd.conf
Make sure the ServerName and MasqueradeAddress are set to the current machine’s Public or Elastic IP Address.
Set RequireValidShell to false. Set DefaultRoot to ~ to jail users to their home directories only.
ServerName "54.187.75.250"
ServerType standalone
MasqueradeAddress 54.187.75.250
RequireValidShell off
DefaultRoot ~
PassivePorts 50000 51000
<IfModule mod_facts.c>
FactsAdvertise off
</IfModule>
Creating an ftp user
Add a ftp user to the system
sudo useradd -m ftpuser (the -m option is to create a home directory for the user)
Set user’s password
sudo passwd ftpuser
At a later time, you may delete the user by executing
sudo deluser ftpuser
Test if FTP server is up and running from a remote machine, login using the id/pwd of the newly created ftpuser
Transfer files back and forth.
Restart FTP server
sudo service proftpd restart
sudo /etc/init.d/proftpd start
I'm attempting to deploy and run an Ubuntu 16.04 VM via Vagrant 1.9.1.
The Vagrantfile I'm using is from Atlas:
Ubuntu Xenial 16.04 Vagrantfile
I'm using Debian Stretch as the host OS. Vagrant was installed via a .deb available from Vagrant's website.
The Vagrantfile does run and deploy correctly. I can ssh into the VM via both my host OS and using 'vagrant ssh'. However, I have one minor blocker when attempting to ssh in from outside.
The default user in this VM is named 'ubuntu', and looks to have a password set. However, I have no idea what the password is at all, and no docs seem to have the information that I'm looking for. Attempting to set a password via 'passwd' within the VM asks for a current password. Anyone see where this is going?
So my big question is this: has anyone else deployed this same Vagrantfile, and if so, does anyone know what the default user's password is?
As of writing this answer: no one ever publicly shared the password for user ubuntu on ubuntu/xenial64 Vagrant box (see #1569237).
It's not necessary. You can:
login using SSH key authentication
change the password using sudo passwd ubuntu (by default ubuntu user has sudo-permissions with NOPASSWD set)
Actually, not only you can, but you should change the password.
The password is located in the ~/.vagrant.d/ubuntu-VAGRANTSLASH-xenial64/20161221.0.0/virtualbox/Vagrantfile as mention by user #prometee in this launchpad discussion #1569237.
Here is mine (line 8):
# Front load the includes
include_vagrantfile = File.expand_path("../include/_Vagrantfile", __FILE__)
load include_vagrantfile if File.exist?(include_vagrantfile)
Vagrant.configure("2") do |config|
config.vm.base_mac = "022999D56C03"
config.ssh.username = "ubuntu"
config.ssh.password = "fbcd1ed4fe8c83b157dc6e0f"
config.vm.provider "virtualbox" do |vb|
vb.customize [ "modifyvm", :id, "--uart1", "0x3F8", "4" ]
vb.customize [ "modifyvm", :id, "--uartmode1", "file", File.join(Dir.pwd, "ubuntu-xenial-16.04-cloudimg-console.log") ]
end
end
FYI, user #racb mention in the same discusison that the this bug report having been filed to ubuntu and so far no [...] decision has been made yet about it.
The default user and password is:
user: vagrant
password: vagrant
The new ubuntu/xenial64 image doesn't come with a default username and password. However you can ssh using an ssh-key generated in your vagrant folder.
Let's say your Vagrantfile is at /vagrant/vm01/Vagrantfile, the ssh-key would be in /vagrant/vm01/.vagrant/machines/..../private_key
You can login to your vagrant vm using this private_key. If the guest machine ask for the key's passphrase, just hit ENTER (specifying a blank passphrase). For example, on my Mac:
ssh -i /vagrant/vm01/.vagrant/..../private_key <your vm user>#<your vm ip>:<your vm port>
If you still want to log in using username and password, after logging in using the private_key, you can add your own user for logging in later:
# create a user for log in
sudo useradd yourusername
# specify a password
sudo passwd yourusername
# then type your password when prompted
# add the user to sudo group
sudo adduser yourusername sudo
# create a home folder for your user
sudo mkdir /home/yourusername
# add a shell command for your user (normally /bin/bash)
sudo vim /etc/passwd
# find yourusername line, and add /bin/bash to the end.
# the end result would look like this:
yourusername:x:1020:1021::/home/yourusername:/bin/bash
Now you can ssh using the new username and password.
Not sure about the ubuntu 16.X password when you install through vagrant, but you can change that by your own by following below steps -
[~/from-vagrant-project]vagrant ssh
[ubuntu#hostname]sudo -i
root#hostname:~# passwd ubuntu
Enter new UNIX password:XXXXX
Retype new UNIX password:XXXXX
passwd: password updated successfully`
if this can help:
I solved the custom packaging issue by creating a normal VM (in my case ubuntu/xenial), then copying the Identify file found with vagrant ssh-config and using that file for config.sshprivate_key_path, plus also setting config.ssh.username to ubuntu.
(see also https://github.com/hashicorp/vagrant/issues/5186#issuecomment-355012068)
Issue
I have been tasked with creating a Debian imaging server for our company. Unfortunately my knowledge with, both Linux and servers is very limited, (this is part of an up-skilling program).
Steps
Currently I have tried to follow the below tutorials on creating a PXEBoot server and a ProxyDHCP:
ProxyDHCP:help.ubuntu.com/community/UbuntuLTSP/ProxyDHCP
PXE Boot : https://help.ubuntu.com/community/PXEInstallMultiDistro
PXE Boot : https://wiki.debian.org/PXEBootInstall#Installing_Debian_using_network_booting
Originally I had tried to used a configured DHCP server on the Linux server which I had gotten working, however my manager advised that they would prefer the DHCP to come from the router instead.
So I have used apt-get to install below applications and followed sources to get the configs correctly. However it still doesn't seem 100% correct (see latest)
Task
So currently the task I have been set is per below:
Has to be in Debian
Has to be console based server only (no gui interface)
DHCP has to come from router
Server should deploy windows images
Images taken need to bee compacted (all blank space removed)
I can only find Ubuntu guides for these PXEBoot and ProxyDHCP creations, and the problem with this is that the locations they refer to do not always exist in Debian.
So I am stuck with half the options available to me, and because I have a limited knowledge here, I cannot identify where I am going wrong, or if these locations are elsewhere.
Can anyone provide me with a tutorial, or a set of command lines to help?
I would really appreciate this.
Using
I am currently using (on Debian console):
TFTPD-HPA
DNSMASQ
iPXE
SysLinux
Latest
I have been able to get the dnsmaq and tftp-hpa service "working". This is to say when I run them they start. However I still don't seem to be able to boot into an installation with this up and running.
I have another thread on forums.debian.net/viewtopic.php?f=5&t=118315
I have been able to fix my issue using 3 applications and a lot of research.
The applications I have used are; DNSMASQ, TFTPD-HPA and SAMBA
These applications have been configured as per below:
TFTPD-HPA
`apt-get install tftpd-hpa
nano /etc/default/tftpd-hpa
TFTP_USERNAME="tftp"
TFTP_DIRECTORY="/tftpboot/"
TFTP_ADDRESS="<server address>:69"
TFTP_OPTIONS="-4 –secure --create"
RUN_DAEMON=”yes”
OPTIONS="-l -s /tftpboot"
mk dir /tftpboot
mk dir /tftpboot/pxelinux.cfg`
DNSMASQ
apt-get install dnsmasq
nano /etc/dnsmasq.conf
Interface=eth0
port=0
log-dhcp
log-queries
log-facility=/var/log/dnsmasq.log
tftp-root=/tftpboot
dhcp-boot=pxelinux.0,<server name>,<server address>
dhcp-range=192.168.1.10,proxy,255.255.255.0
dhcp-no-override
pxe-prompt="Press F8 for boot menu", 2
pxe-service=X86PC, "comment", pxelinux
SAMBA
apt-get install samba
nano /etc/samba/smb.conf
[global]
Workgroup = workgroup
Server role = standalone server
Dns proxy = no
Wins support = yes
Passwd program = /usr/bin/passwd %u
Passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *Password\supdated\ssuccessfully*
Syslog = 0
Log file = /var/log/smb.log.%m
Max log size = 1000
Map to guest = bad user
Usershare allow guests = yes
Security = user
[images]
Comment = Network SAMBA share
Path = tftpboot
Create mask = 0775
Guest ok = yes
Browseable = yes
Read only = no
Writeable = yes
I created a shared folder using samba in ubuntu to enable windows machines can access it with the following command:
$ sudo net usershare add documents /home/developer/documents "Developer documents" everyone:F guest_ok=y
I give 777 permissions to the folder:
$ sudo chmod 0777 /home/developer/documents
And then I check what I've done
$ sudo net usershare info --long
When I want to see if the folder is visible from all windows machine, you can see. However, you cann't access that folder and get error of: "Permission Denied"
The message in: /var/log/samba/log.ip-domain is:
process_usershare_file: stat of /var/lib/samba/usershares/backuparsac failed. Permission denied
Then, I try to add some rules to my smb.conf
[documents]
comment = Documents for Developers
path = /home/developer/documents
browseable = yes
writable = yes
read only = yes
guest ok = yes
directory mask = 0777
but the error of Permission denied keeps coming. Is there anything else I need to do? I need this folder can be accessed by all windows machines.
NOTE: I use Ubuntu 14.04
The cause is that Samba does not synchronize its users with the system.
This solved the issue in my case, on Kubuntu 14.10:
sudo apt-get install libpam-smbpass
sudo service samba restart
If you don't want to synchronize users with PAM, simply add a user to Samba's password database:
sudo smbpasswd -a <user>
After that, the user will be able to open shared folders on the Samba machine.
Your configuration file seems to be fine.
I reckon there might be a permission issue in your parent folder.
I suggest you check /home and /home/developer both have 755 rather than 750 permission.
Then check sudo -u nobody ls /home/developer/documents.
If ls is successful, the samba is likely to work as you expected as well
Closed. This question does not meet Stack Overflow guidelines. It is not currently accepting answers.
This question does not appear to be about a specific programming problem, a software algorithm, or software tools primarily used by programmers. If you believe the question would be on-topic on another Stack Exchange site, you can leave a comment to explain where the question may be able to be answered.
Closed 4 years ago.
Improve this question
I am trying to set up FTP on Amazon Cloud Server, but without luck.
I search over net and there is no concrete steps how to do it.
I found those commands to run:
$ yum install vsftpd
$ ec2-authorize default -p 20-21
$ ec2-authorize default -p 1024-1048
$ vi /etc/vsftpd/vsftpd.conf
#<em>---Add following lines at the end of file---</em>
pasv_enable=YES
pasv_min_port=1024
pasv_max_port=1048
pasv_address=<Public IP of your instance>
$ /etc/init.d/vsftpd restart
But I don't know where to write them.
Jaminto did a great job of answering the question, but I recently went through the process myself and wanted to expand on Jaminto's answer.
I'm assuming that you already have an EC2 instance created and have associated an Elastic IP Address to it.
Step #1: Install vsftpd
SSH to your EC2 server. Type:
> sudo yum install vsftpd
This should install vsftpd.
Step #2: Open up the FTP ports on your EC2 instance
Next, you'll need to open up the FTP ports on your EC2 server. Log in to the AWS EC2 Management Console and select Security Groups from the navigation tree on the left. Select the security group assigned to your EC2 instance. Then select the Inbound tab, then click Edit:
Add two Custom TCP Rules with port ranges 20-21 and 1024-1048. For Source, you can select 'Anywhere'. If you decide to set Source to your own IP address, be aware that your IP address might change if it is being assigned via DHCP.
Step #3: Make updates to the vsftpd.conf file
Edit your vsftpd conf file by typing:
> sudo vi /etc/vsftpd/vsftpd.conf
Disable anonymous FTP by changing this line:
anonymous_enable=YES
to
anonymous_enable=NO
Then add the following lines to the bottom of the vsftpd.conf file:
pasv_enable=YES
pasv_min_port=1024
pasv_max_port=1048
pasv_address=<Public IP of your instance>
Your vsftpd.conf file should look something like the following - except make sure to replace the pasv_address with your public facing IP address:
To save changes, press escape, then type :wq, then hit enter.
Step #4: Restart vsftpd
Restart vsftpd by typing:
> sudo /etc/init.d/vsftpd restart
You should see a message that looks like:
If this doesn't work, try:
> sudo /sbin/service vsftpd restart
Step #5: Create an FTP user
If you take a peek at /etc/vsftpd/user_list, you'll see the following:
# vsftpd userlist
# If userlist_deny=NO, only allow users in this file
# If userlist_deny=YES (default), never allow users in this file, and
# do not even prompt for a password.
# Note that the default vsftpd pam config also checks /etc/vsftpd/ftpusers
# for users that are denied.
root
bin
daemon
adm
lp
sync
shutdown
halt
mail
news
uucp
operator
games
nobody
This is basically saying, "Don't allow these users FTP access." vsftpd will allow FTP access to any user not on this list.
So, in order to create a new FTP account, you may need to create a new user on your server. (Or, if you already have a user account that's not listed in /etc/vsftpd/user_list, you can skip to the next step.)
Creating a new user on an EC2 instance is pretty simple. For example, to create the user 'bret', type:
> sudo adduser bret
> sudo passwd bret
Here's what it will look like:
Step #6: Restricting users to their home directories
At this point, your FTP users are not restricted to their home directories. That's not very secure, but we can fix it pretty easily.
Edit your vsftpd conf file again by typing:
> sudo vi /etc/vsftpd/vsftpd.conf
Un-comment out the line:
chroot_local_user=YES
It should look like this once you're done:
Restart the vsftpd server again like so:
> sudo /etc/init.d/vsftpd restart
All done!
Appendix A: Surviving a reboot
vsftpd doesn't automatically start when your server boots. If you're like me, that means that after rebooting your EC2 instance, you'll feel a moment of terror when FTP seems to be broken - but in reality, it's just not running!. Here's a handy way to fix that:
> sudo chkconfig --level 345 vsftpd on
Alternatively, if you are using redhat, another way to manage your services is by using this nifty graphic user interface to control which services should automatically start:
> sudo ntsysv
Now vsftpd will automatically start up when your server boots up.
Appendix B: Changing a user's FTP home directory
* NOTE: Iman Sedighi has posted a more elegant solution for restricting users access to a specific directory. Please refer to his excellent solution posted as an answer *
You might want to create a user and restrict their FTP access to a specific folder, such as /var/www. In order to do this, you'll need to change the user's default home directory:
> sudo usermod -d /var/www/ username
In this specific example, it's typical to give the user permissions to the 'www' group, which is often associated with the /var/www folder:
> sudo usermod -a -G www username
To enable passive ftp on an EC2 server, you need to configure the ports that your ftp server should use for inbound connections, then open a list of available ports for the ftp client data connections.
I'm not that familiar with linux, but the commands you posted are the steps to install the ftp server, configure the ec2 firewall rules (through the AWS API), then configure the ftp server to use the ports you allowed on the ec2 firewall.
So this step installs the ftp client (VSFTP)
> yum install vsftpd
These steps configure the ftp client
> vi /etc/vsftpd/vsftpd.conf
-- Add following lines at the end of file --
pasv_enable=YES
pasv_min_port=1024
pasv_max_port=1048
pasv_address=<Public IP of your instance>
> /etc/init.d/vsftpd restart
but the other two steps are easier done through the amazon console under EC2 Security groups. There you need to configure the security group that is assigned to your server to allow connections on ports 20,21, and 1024-1048
Thanks #clone45 for the nice solution. But I had just one important problem with Appendix b of his solution. Immediately after I changed the home directory to var/www/html then I couldn't connect to server through ssh and sftp because it always shows following errors
permission denied (public key)
or in FileZilla I received this error:
No supported authentication methods available (server: public key)
But I could access the server through normal FTP connection.
If you encountered to the same error then just undo the appendix b of #clone45 solution by set the default home directory for the user:
sudo usermod -d /home/username/ username
But when you set user's default home directory then the user have access to many other folders outside /var/www/http. So to secure your server then follow these steps:
1- Make sftponly group
Make a group for all users you want to restrict their access to only ftp and sftp access to var/www/html. to make the group:
sudo groupadd sftponly
2- Jail the chroot
To restrict access of this group to the server via sftp you must jail the chroot to not to let group's users to access any folder except html folder inside its home directory. to do this open /etc/ssh/sshd.config in the vim with sudo.
At the end of the file please comment this line:
Subsystem sftp /usr/libexec/openssh/sftp-server
And then add this line below that:
Subsystem sftp internal-sftp
So we replaced subsystem with internal-sftp. Then add following lines below it:
Match Group sftponly
ChrootDirectory /var/www
ForceCommand internal-sftp
AllowTcpForwarding no
After adding this line I saved my changes and then restart ssh service by:
sudo service sshd restart
3- Add the user to sftponly group
Any user you want to restrict their access must be a member of sftponly group. Therefore we join it to sftponly by:
sudo usermod -G sftponly username
4- Restrict user access to just var/www/html
To restrict user access to just var/www/html folder we need to make a directory in the home directory (with name of 'html') of that user and then mount /var/www to /home/username/html as follow:
sudo mkdir /home/username/html
sudo mount --bind /var/www /home/username/html
5- Set write access
If the user needs write access to /var/www/html, then you must jail the user at /var/www which must have root:root ownership and permissions of 755. You then need to give /var/www/html ownership of root:sftponly and permissions of 775 by adding following lines:
sudo chmod 755 /var/www
sudo chown root:root /var/www
sudo chmod 775 /var/www/html
sudo chown root:www /var/www/html
6- Block shell access
If you want restrict access to not access to shell to make it more secure then just change the default shell to bin/false as follow:
sudo usermod -s /bin/false username
Great Article... worked like a breeze on Amazon Linux AMI.
Two more useful commands:
To change the default FTP upload folder
Step 1:
edit /etc/vsftpd/vsftpd.conf
Step 2: Create a new entry at the bottom of the page:
local_root=/var/www/html
To apply read, write, delete permission to the files under folder so that you can manage using a FTP device
find /var/www/html -type d -exec chmod 777 {} \;
In case you have ufw enabled, remember add ftp:
> sudo ufw allow ftp
It took me 2 days to realise that I enabled ufw.
It will not be ok until you add your user to the group www by the following commands:
sudo usermod -a -G www <USER>
This solves the permission problem.
Set the default path by adding this:
local_root=/var/www/html
Don't forget to update your iptables firewall if you have one to allow the 20-21 and 1024-1048 ranges in.
Do this from /etc/sysconfig/iptables
Adding lines like this:
-A INPUT -m state --state NEW -m tcp -p tcp --dport 20:21 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 1024:1048 -j ACCEPT
And restart iptables with the command:
sudo service iptables restart
I've simplified clone45 steps:
Open the ports as he mentioned
sudo su
sudo yum install vsftpd
echo -n "Public IP of your instance: " && read publicip
echo -e "anonymous_enable=NO\npasv_enable=YES\npasv_min_port=1024\npasv_max_port=1048\npasv_address=$publicip\nchroot_local_user=YES" >> /etc/vsftpd/vsftpd.conf
sudo /etc/init.d/vsftpd restart
I followed clone45's answer all the way to the end. A great article! Since I needed the FTP access to install plug-ins to one of my wordpress sites, I changed the home directory to /var/www/mysitename. Then I continued to add my ftp user to the apache(or www) group like this:
sudo usermod -a -G apache myftpuser
After this I still saw this error on WP's plugin installation page: "Unable to locate WordPress Content directory (wp-content)". Searched and found this solution on a wp.org Q&A session: https://wordpress.org/support/topic/unable-to-locate-wordpress-content-directory-wp-content and added the following to the end of wp-config.php:
if(is_admin()) {
add_filter('filesystem_method', create_function('$a', 'return "direct";' ));
define( 'FS_CHMOD_DIR', 0751 );
}
After this my WP plugin was installed successfully.
maybe worth mentioning in addition to clone45's answer:
Fixing Write Permissions for Chrooted FTP Users in vsftpd
The vsftpd version that comes with Ubuntu 12.04 Precise does not
permit chrooted local users to write by default. By default you will
have this in /etc/vsftpd.conf:
chroot_local_user=YES
write_enable=YES
In order to allow local users to write, you need to add the following parameter:
allow_writeable_chroot=YES
Note:
Issues with write permissions may show up as following FileZilla errors:
Error: GnuTLS error -15: An unexpected TLS packet was received.
Error: Could not connect to server
References:
Fixing Write Permissions for Chrooted FTP Users in vsftpd
VSFTPd stopped working after update
In case you are getting 530 password incorrect
1 more step needed
in file /etc/shells
Add the following line
/bin/false
FileZila is good FTP tool to setup with Amazon Cloud.
Download FileZila client from https://filezilla-project.org/
Click on File -> Site Manager - >
New Site
Provide Host Name IP address of your amazon cloud location (Port if any)
Protocol - SFTP (May change based on your requirement)
Login Type - Normal (So system will not ask for password each time)
Provide user name and password.
Connect.
You need to do these step only 1 time, later it will upload content to the same IP address and same site.