Vsftpd is a popular FTP server for Unix/Linux systems. For thoes unaware of the vsftpd ftp server, note that this is not just another ftp server, but a mature product that has been around for over 12 years in the Unix world. While Vsftpd it is found as an installation option on many Linux distributions, it is not often Linux system administrators are seeking for installation and configuration instructions for it, which is the reason we decide to cover it on Firewall.cx.
This article focuses on the installation and setup of the Vsftpd service on Linux Redhat Enterprise, Fedora and CentOS, however it is applicable to almost all other Linux distributions. We'll also take a look at a number of great tips which include setting quotas, restricting access to anonymous users, disabling uploads, setting a dedicated partition for the FTP service, configuring the system's IPTable firewall and much more.
Following is a list of vsftpd's features which confirms this small FTP package is capable of delivering a lot more than most FTP servers out there:
To initiate the installation of the vsftpd package, simply open your CLI prompt and use the yum command (you need root privileges) as shown below:
Yum will automatically locate, download and install the latest vsftpd version.
To open the configuration file, type:
Turn off standard ftpd xferlog log format and turn on verbose vsftpd log format by making the following changes in the vsftpd.conf file:
Above two directives will enable logging of all FTP transactions.
To lock down users to their home directories:
You can create warning banners for all FTP users, by defining the path:
Now you can create the /etc/vsftpd/issue file with a message compliant with the local site policy or a legal disclaimer:
Turn on vsftpd on boot:
Start the service:
You can verify the service is running and listening on the correct port using the following command:
Here's the expected output:
In case IPTables are configured on the system, it will be necessary to edit the iptables file and open the ports used by FTP to ensure the service's operation.
To open file /etc/sysconfig/iptables, enter:
Add the following lines, ensuring that they appear before the final LOG and DROP lines for the RH-Firewall-1-INPUT:
Next, open file /etc/sysconfig/iptables-config, and enter:
Ensure that the space-separated list of modules contains the FTP connection-tracking module:
Save and close the file and finally restart the firewall using the following commands:
Type the following command:
Edit the vsftpd configuration file /etc/vsftpd/vsftpd.conf and add the following:
Edit the vsftpd configuration file /etc/vsftpd/vsftpd.conf and add the following:
Disk quota must be enabled to prevent users from filling a disk used by FTP upload services. Edit the vsftpd configuration file. Add or correct the following configuration options to represents a directory which vsftpd will try to change into after an anonymous login:
The ftp users are the same users as those on the hosting machine.
You could have a separate group for ftp users, to help keep their privileges down (for example 'anonftpusers'). Knowing that, your script should do:
Be extremely careful with your scripts, as they will have to be run as root.
However, for this to work you will have to have the following options enabled in /etc/vsftpd/vsftpd.conf:
Separation of the operating system files from FTP users files may result into a better and secure system. Restricting the growth of certain file systems is possible using various techniques. For example, use /ftp partition to store all ftp home directories and mount ftp with nosuid, nodev and noexec options. A sample /etc/fstab entry:
Following is an example for vsftpd.conf. It allows the users listed in the user_list file to log in, no anonymous users, and quite tight restrictions on what users can do:
With this config, uploaded files are not readable or executable by anyone, so the server is acting as a 'dropbox'. Change the file_open_modeoption to change that.
Lastly, it is also advised to have a look at 'man vsftpd.conf' for a full list and description of all options.
Decrypt Cisco Type-7 Passwords on the fly!
