What is the anonymous user in vsftp?

Question

I'm working on a new FTP server with Very Simple FTP (vsftp) and wondering how exactly the anonymous user works in vsftp. The Archwiki doesn't seem to give a good explanation of what it is, only that it can be used for login. Similarly, man vsftpd.conf doesn't explain it. Both seem to assume a working knowledge of this "anonymous user."

I got the FTP server working with the anonymous login (and had to guess username/password until I found out that the username is "anonymous" and password is arbitrary -- is this documented somewhere?), so my question is not about how to set it up (which the manuals explain well) but rather what the anonymous user is.

It doesn't seem to the ftp user (and not in the ftp group) which was my initial guess, because changing the permissions of the ftp directory to something like 550 doesn't allow the anonymous user to view it anymore. Similarly, options like anon_other_write_enable can change its permissions.

Is it a true Linux user? vsftp doesn't show up in /etc/passwd, so I would guess not. If not, what is it and how does it work?

Answer 1

All file access goes through some "Linux user"; there is no such thing as an anonymous UID as far as process credentials go.

In vsftpd, the FTP users 'anonymous' and 'ftp' are mapped to the Unix account specified in the ftp_username config option, which is by default set to 'ftp' as well. (It's in the manual page under "String options".)

Note also the option anon_world_readable_only, which defaults to 'TRUE' – if enabled, vsftpd only allows the anonymous account to access files having o+r, regardless of any permission bits or ACLs allowing access to 'ftp' specifically.

The FTP username 'anonymous' itself is documented under the config option anonymous_enable.