FTP Server Configuration

FTP server configuration (/etc/vsftp/)

Reference 1: Active FTP vs. Passive FTP, a Definitive Explanation
Reference 2: Manpage of VSFTPD.CONF
Reference 3: Setting up an anonymous ftp site
Reference 4: Red Hat Enterprise Reference guide: FTP
Reference 5: FTP mirror

It is important to note that it is an error to put any space between the option, = and value or at the end of every line.

Original file (vsftp.conf): 
# Example config file /etc/vsftpd/vsftpd.conf
anonymous_enable=YES
local_enable=YES
write_enable=YES
local_umask=022
connect_from_port_20=YES
dirmessage_enable=YES
xferlog_enable=YES
xferlog_std_format=YES
listen=YES
userlist_enable=YES
tcp_wrappers=YES
pam_service_name=vsftpd


Original file (user_list):
# vsftpd userlist
# If userlist_deny=YES (default), never allow users in this file, and
# do not even prompt for a password.
# Note that the default vsftpd pam config also checks /etc/vsftpd/ftpusers for users that are denied.
root
bin
daemon
adm
lp
sync
shutdown
halt
mail
news
uucp
operator
games
nobody


Original file (ftpusers):
# Users that are not allowed to login via ftp
root
bin
daemon
adm
lp
sync
shutdown
halt
mail
news
uucp
operator
games
nobody


Simple test setup: allowing anonymous user download from /var/ftp/pub, upload to /var/ftp/incoming. Everything in the ftp server is world readable.

anonymous_enable=YES
anon_upload_enable=YES
write_enable=YES
download_enable=YES
local_enable=YES
write_enable=YES
local_umask=022
connect_from_port_20=YES
dirmessage_enable=YES                                       # when a new directory is entered, the  .message will display.
xferlog_enable=YES
xferlog_std_format=YES
listen=YES
userlist_enable=YES
tcp_wrappers=YES
pam_service_name=vsftpd
log_ftp_protocol=YES                     #Useful for debugging
ftpd_banner=Hi welcome to FTP server web1

#End of vsftp.conf.

We need to change the security context. Using the following:
# chcon -R -t public_content_t /var/ftp/pub
# chcon -R -t public_content_rw_t /var/ftp/incoming
# setsebool -P allow_ftpd_anon_write=1
# chmod og=rw * (for files)
# chmod -R a+wx (for folders)
Comments