VSFTPD – Kerberos authentication

Would you like to learn how to configure the VSFTPD service Kerberos authentication on Active Directory? In this tutorial, we are going to show you how to authenticate VSFTPD users using the Active Directory from Microsoft Windows and the Kerberos protocol.

• Ubuntu 20.04
• Ubuntu 19.10
• Ubuntu 18.04
• VSFTPD 3.0.3

In our example, the domain controller IP address is 192.168.15.10.

In our example, the FTP server IP address is 192.168.0.200.

Tutorial Windows – Domain Account Creation

• IP – 192.168.15.10
• Operacional System – WINDOWS 2012 R2
• Hostname – TECH-DC01

We need to create at least 1 account on the Active Directory database.

The ADMIN account will be used to login on the VSFTPD server.

On the domain controller, open the application named: Active Directory Users and Computers

Create a new account inside the Users container.

Create a new account named: admin

Password configured to the ADMIN user: kamisama123

This account will be used to authenticate on the VSFTPD server.

Repeat this process and create a new account named TEST01.

Congratulations, you have created the required Active Directory account.

VSFTPD – Kerberos authentication on the Active Directory

• IP – 192.168.15.11
• Operational System – Ubuntu 20
• Hostname – VSFTPD

Set a hostname using the HOSTNAMECTL command.

Edit the HOSTS configuration file.

Add the domain controller IP address and hostname.

Install the list of required packages to enable the Kerberos authentication.

On the Graphic installation, perform the following configuration:

• Kerberos realm – TECH.LOCAL
• Kerberos server – TECH-DC01.TECH.LOCAL
• Administrative server – TECH-DC01.TECH.LOCAL

You need to change the domain information to reflect your Network environment.

Edit the Kerberos configuration file.

Here is the file, before our configuration.

Here is the file, after our configuration.

You need to change the domain information to reflect your Network environment.

You have finished the required Kerberos configuration.

Tutorial Ubuntu – Installing VSFTPD

Install the required packages.

Edit the PAM configuration file.

Here is the file content, before our configuration.

Here is the file content, after our configuration.

Search for the VSFTPD service configuration file

Edit the VSFTPD service configuration file

Add the following lines at the end of this file.

Here is the file content, before our configuration.

Here is the file content, after our configuration.

The CHROOT feature will prevent users from getting out of their HOME directory.

To exclude a user from the CHROOT feature, add its username into the list file.

Here is the file content.

In our example, we excluded the account named TEST01.

Restart the FTP service.

Enable the VSFTPD service to start automatically during boot.

Keep in mind that we are performing only the authentication using the Kerberos protocol.

The user account must exist locally.

Use the following command to create a user account locally on the FTP server.

Congratulations! You have finished the VSFTP server authentication using Kerberos.

Tutorial Ubuntu – Testing the VSFTPD installation

Create 2 local accounts.

In our example, the user account named TEST01 was excluded from the CHROOT feature.

We excluded this account by adding the username to the CHROOT list file.

On a remote computer, download the WINSCP software and try to connect to the FTP server.

Use the Active Directory password to authenticate the FTP users.

The Account named TEST01 will be able to access directories outside its HOME directory.

The Account named ADMIN will not be able to access directories outside its HOME directory.

Congratulations! You successfully tested the VSFTPD installation on Ubuntu Linux.