banner_file=/etc/vsftpd/ftp.msg
local_enable=YES
#
#
#
ssl_enable=YES
allow_anon_ssl=NO
force_local_data_ssl=YES
force_local_logins_ssl=YES
rsa_cert_file=/etc/ssl/certs/certificate_and_key.pem
rsa_private_key_file=/etc/ssl/private/mail.netkwik.com.pem
ssl_sslv2=YES
ssl_sslv3=YES
ssl_tlsv1=YES
ssl_ciphers=HIGH
rsa_cert_file=/etc/vsftpd/vsftpd.pem
rsa_private_key_file=/etc/vsftpd/vsftpd.key
allow_writeable_chroot=YES
anonymous_enable=NO
# 
#
pasv_min_port=11000
pasv_max_port=11010

#pasv_address=24.231.216.242
write_enable=YES
local_umask=022
dirmessage_enable=YES
connect_from_port_20=YES
chroot_local_user=YES
pam_service_name=vsftpd
require_ssl_reuse=NO
#userlist_enable=YES
xferlog_enable=YES
vsftpd_log_file=/var/log/vsftpd.log
tcp_wrappers=YES
listen=YES

Update – 2024

I have had crazy problems getting this thing set up, when I rebuild, for the following stupid reasons:

1. Copying and pasting instructions which contained an error – a typo, basically – cost me a ton of time every time I tried to set this up! I’d quickly scratched out some instructions, awhile back, which alternately said to add the group “sftpusers” and then continued with more copy and paste stuff in which – instead of using the group name “sftpusers” – I’d left off the letter “s” and was using “sftpuser”. Specfically, in an edit to the sshd_config file I believe I was using “sftpuser” which, of course, was referring to a non-existant group and causing things to not work.

   So, we’re going to be using “sftpusers” – with the s. It was an idiotic mistake that came with copying and pasting an error.

2. I had a variation on the following command but it would not work because it would always say that the user id was involved in a process – use the following, this is big:
   sudo usermod -aG sftpusers guy

   The above adds user guy to the sftpusers group. Now, let’s check and make sure that guy is a member of this group – run the following from a terminal:

   groupmems -g sftpusers -l

The Process Which Works

• sudo addgroup sftpusers
• sudo usermod -aG sftpusers guy
• mkdir /sftp
(chown root.root)
• mkdir /sftp/guy
(chown root.root)
• mkdir /sftp/guy/incoming
(chown guy.sftpusers)

Edit the bottom of the /etc/ssh/sshd_config file to look like this:

# override default of no subsystems
#Subsystem	sftp	/usr/lib/openssh/sftp-server
Subsystem       sftp    internal-sftp


# Example of overriding settings on a per-user basis
#Match User anoncvs
#       X11Forwarding no
#       AllowTcpForwarding no
#       PermitTTY no
#       ForceCommand cvs server

# tail /etc/ssh/sshd_config
Match Group sftpusers
ChrootDirectory /sftp/%u
ForceCommand internal-sftp

For archival purposes – shit which did not work

Below are the instructions I had, at one time, for editing the bottom of sshd_config. I had saved this, originally – which is significantly different than the above code which works.

#Subsystem      sftp    /usr/lib/openssh/sftp-server
Subsystem       sftp    internal-sftp


# Example of overriding settings on a per-user basis
#Match User anoncvs
#       X11Forwarding no
#       AllowTcpForwarding no
#       PermitTTY no
#       ForceCommand cvs server

# tail /etc/ssh/sshd_config

Match group sftpuser
ChrootDirectory /home
X11Forwarding no
AllowTcpForwarding no
ForceCommand internal-sftp

While similar to the above noted command (which worked) for adding a pre-existing user to a group my old instructions suggested the following – which did not work.. saying something about the user’s ID being held by a process. So, this is close but no cigar.

sudo usermod -a -G sftpuser guy