Issue running vsftpd on OpenBSD 6.0 and 6.1

[dash1747]

I've been running vsftpd on OpenBSD for a number of years. It's been working fine on 5.7, 5.8, and 5.9. My vsftpd.conf file is very simple (minimal changes).

Here are the uncommented bits in vsftpd.conf

local_enable=YES
write_enable=YES
local_umask=006
dirmessage_enable=YES
xferlog_enable=YES
connect_from_port_20=YES
idle_session_timeout=420
nopriv_user=_vsftpd
chroot_local_user=YES
secure_chroot_dir=/var/empty
pasv_min_port=49152
pasv_max_port=65535
text_userdb_names=YES
listen=YES

I have a single user account tuser01 with the shell set to /sbin/nologin
The tuser01 account is a member of group ftpusers. The home folder is for tuser is /storage01/ftpudata/tuser01 which is owned by root:ftpusers with permissions set to 750

I have added /sbin/nologin to /etc/shells

The above configuration works on all of my OpenBSD boxes except 6.0 and 6.1. On 5.9 boxes I run some with ftp and others with ftps with no issues.

The vsftpd daemon runs but at login I receive "500 OOPS: priv_sock_get_result" Connection closed by remote host.


Any insight would be helpful.

[jggimi]

Hello, and welcome!

The vsftpd package has been at version 3.0.3 since OpenBSD 5.8, which indicates to me that your problem is not necessarily a problem with vsftpd itself. I would guess -- never having used the application -- that your PF configuration may be interfering with communication.

If you don't receive any real help here in the next fiew days, I recommmend you reach out to Benoit, the maintainer. You'll find his Email address with $ pkg_info vsftpd.

[dash1747]

Thanks for the reply.

I don't think PF is involved. I eliminated that early on by disabling PF completely 'pfctl -d'.

As I said I can take this same config and put it on 5.9 and it works every time. It's pretty spooky.

I will take your advice and give it a bit and see if others weigh in.

I did reach out to Benoit a few months back via email but I didn't get a reply.

I decided to wait until 6.1 came out and see if the behavior changed.

I could try him again if need be.

Thanks for taking the time to reply. Very appreciated.

[jggimi]

I did reach out to Benoit a few months back via email but I didn't get a reply.

Sorry you had trouble reaching him. Perhaps your Email didn't reach him, or ended up filtered as spam. Should you fail to reach him a second time, try via the ports@ mailing list.