2

I'm working on a new FTP server with Very Simple FTP (vsftp) and wondering how exactly the anonymous user works in vsftp. The Archwiki doesn't seem to give a good explanation of what it is, only that it can be used for login. Similarly, man vsftpd.conf doesn't explain it. Both seem to assume a working knowledge of this "anonymous user."

I got the FTP server working with the anonymous login (and had to guess username/password until I found out that the username is "anonymous" and password is arbitrary -- is this documented somewhere?), so my question is not about how to set it up (which the manuals explain well) but rather what the anonymous user is.

It doesn't seem to the ftp user (and not in the ftp group) which was my initial guess, because changing the permissions of the ftp directory to something like 550 doesn't allow the anonymous user to view it anymore. Similarly, options like anon_other_write_enable can change its permissions.

Is it a true Linux user? vsftp doesn't show up in /etc/passwd, so I would guess not. If not, what is it and how does it work?

1 Answer 1

3

All file access goes through some "Linux user"; there is no such thing as an anonymous UID as far as process credentials go.

In vsftpd, the FTP users 'anonymous' and 'ftp' are mapped to the Unix account specified in the ftp_username config option, which is by default set to 'ftp' as well. (It's in the manual page under "String options".)

Note also the option anon_world_readable_only, which defaults to 'TRUE' – if enabled, vsftpd only allows the anonymous account to access files having o+r, regardless of any permission bits or ACLs allowing access to 'ftp' specifically.

The FTP username 'anonymous' itself is documented under the config option anonymous_enable.

1
  • This is great! Thanks for covering all the details. I didn't understand the anon_world_readable_only property when I read it in the manpage, and I guess I missed the description in anonymous_enable. Jul 30, 2019 at 18:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .