# When "listen" directive is enabled, vsftpd runs in standalone mode and
# listens on IPv4 sockets. This directive cannot be used in conjunction
# with the listen_ipv6 directive.
listen=YES
#
# This directive enables listening on IPv6 sockets. To listen on IPv4 and IPv6
# sockets, you must run two copies of vsftpd whith two configuration files.
# Make sure, that one of the listen options is commented !!
#listen_ipv6=YES

# Make sure PORT transfer connections originate from port 20 (ftp-data).
connect_from_port_20=YES

# If vsftpd is in standalone mode, this is the port it will listen on for incoming FTP connections.
listen_port=21
# The minimum port to allocate for PASV style data connections.  Can be used to specify a narrow port range to assist firewalling.
pasv_min_port=32768
# The maximum port to allocate for PASV style data connections.  Can be used to specify a narrow port range to assist firewalling.
pasv_max_port=65535

# The timeout, in seconds, for a remote client to establish connection with a PASV style data connection.
accept_timeout=30
# The timeout, in seconds, for a remote client to respond to our PORT style data connection.
connect_timeout=30
# The timeout, in seconds, which is roughly the maximum time we permit data transfers to stall
# for with no progress. If the timeout triggers, the remote client is kicked off.
data_connection_timeout=30
# The timeout, in seconds, which is the maximum time a remote client may spend between FTP commands.
# If the timeout triggers, the remote client is kicked off.
idle_session_timeout=30

# You may override where the log file goes if you like. The default is shown
# below.
#xferlog_file=/var/log/vsftpd.log
vsftpd_log_file=/var/log/vsftpd/vsftpd.log
xferlog_file=/var/log/vsftpd/vsftpd-xfer.log
#
# If you want, you can have your log file in standard ftpd xferlog format
#xferlog_std_format=YES
dual_log_enable=YES

# You may override where the log file goes if you like. The default is shown
# below.
log_ftp_protocol=YES
#
# If you want, you can have your log file in standard ftpd xferlog format
#xferlog_std_format=YES
xferlog_std_format=YES

# Allow anonymous FTP? (Beware - allowed by default if you comment this out).
anonymous_enable=YES

# Uncomment this to allow local users to log in.
local_enable=YES

#%PAM-1.0
session optional pam_keyinit.so force revoke
auth    required pam_mysql.so host=10.41.0.35 user=vsftpd passwd=vsftpd db=virtual table=vsftpd_users usercolumn=username passwdcolumn=password crypt=3
account required pam_mysql.so host=10.41.0.35 user=vsftpd passwd=vsftpd db=virtual table=vsftpd_users usercolumn=username passwdcolumn=password crypt=3

# Allow anonymous FTP? (Beware - allowed by default if you comment this out).
anonymous_enable=YES
#
# Uncomment this to allow local users to log in.
local_enable=YES
#
# Uncomment this to enable any form of FTP write command.
write_enable=YES
[...]
chroot_local_user=YES

# here we use the authentication module for vsftpd to check username and password
pam_service_name=vsftpd
userlist_enable=YES
tcp_wrappers=YES
# vsftpd allow 'vmail' user to login into the '/home/vmail/cen05dev.xen.wbcd.pl/$USER' directory
guest_enable=YES
guest_username=vmail
local_root=/home/vmail/cen05dev.xen.wbcd.pl/$USER
user_sub_token=$USER
virtual_use_local_privs=YES
user_config_dir=/etc/vsftpd/vsftpd_user_conf

#dirlist_enable=YES
#download_enable=YES
# full path to the user home directory
#local_root=/home/vmail/cen05dev.xen.wbcd.pl/ola

#
# TLS/SSL
#
# If enabled, and vsftpd was compiled against OpenSSL, vsftpd will support secure connections via SSL.
# This applies to the control connection (including login) and also data connections.
ssl_enable=YES
# Only applies if ssl_enable is active. If set to YES, anonymous users will be allowed to use secured SSL connections.
allow_anon_ssl=YES

# This option specifies the location of the RSA certificate to use for SSL encrypted connections.
rsa_cert_file=/etc/pki/tls/certs/vsftpd.pem
# This option specifies the location of the RSA private key to use for SSL encrypted connections.
# If this option is not set, the private key is expected to be in the same file as the certificate.
#rsa_private_key_file=/etc/pki/tls/certs/vsftpd.pem
# Only applies if ssl_enable is active. If set to YES, anonymous users will be allowed to use secured SSL connections.

# Only applies if ssl_enable is activated. If enabled, this option will permit SSL v2 protocol connections. TLS v1 connections are preferred.
ssl_sslv2=NO
# Only applies if ssl_enable is activated. If enabled, this option will permit SSL v3 protocol connections. TLS v1 connections are preferred.
ssl_sslv3=NO
# Only applies if ssl_enable is activated. If enabled, this option will permit TLS v1 protocol connections. TLS v1 connections are preferred.
ssl_tlsv1=YES

ssl_ciphers=HIGH