Set up vsftp

What is VSFTPD?

VSFTPD is FTP server software. The first two letters in VSFTPD stand for "very secure". The software was built around the vulnerabilities of the FTP protocol. Nevertheless, you should always remember that there are better solutions for secure transfer and management of files such as SFTP(uses openssh). The FTP protocol is particularly useful for sharing non-sensitive data and is very reliable at that.

Installing VSFTPD

You can quickly install VSFTPD on your server through the command line interface with:

sudo apt-get install vsftpd

Restarting the service

After configuring the server you need to restart the service in order for changes to take effect:

sudo /etc/init.d/vsftpd restart

Configuration

Most VSFTPD's configuration takes place in /etc/vsftpd.conf. The file itself is well-documented, so this section only highlights some important changes you may want to make. For all available options and basic documentation see the man pages:

man vsftpd.conf

Files are served by default from /srv/ftp as per the Filesystem Hierarchy Standard.

Enable Uploading

The "write_enable" flag must be set to YES in order to allow changes to the filesystem, such as uploading:

write_enable=YES

Allow Local Users to Login

In order to allow users in /etc/passwd to login, the "local_enable" directive must look like this:

local_enable=YES

Anonymous Login

The following lines control whether anonymous users can login:

# Allow anonymous login

anonymous_enable=YES

# No password is required for an anonymous login (Optional)

no_anon_password=YES

# Maximum transfer rate for an anonymous client in Bytes/second (Optional)

anon_max_rate=30000

# Directory to be used for an anonymous login (Optional)

anon_root=/example/directory/

Chroot Jail

It is possible to set up a chroot environment, which prevents the user from leaving his home directory. To enable this, add/change the following lines in the configuration file:

chroot_list_enable=YES chroot_list_file=/etc/vsftpd.chroot_list

The "chroot_list_file" variable specifies the file in which the jailed users are contained to.

For a more restrictive environment, you should make the following change:

chroot_local_user=YES

NOTE: This will make local users jailed by default. In this case, the file specified by "chroot_list_file" lists users that are not in a chroot jail.

Because of a recent VSFTPD update, the server will refuse to run the service with writable root inside the chroot folder. An easy way to address this issue is to do the following:

• Create a new directory within the user's home directory

mkdir /home/username/files

• Change the ownership of that file to root (the user logging in via FTP cannot have write permissions on this folder)

chown root:root /home/username

• Make all necessary changes within the "files" subdirectory

Using SSL to Secure FTP

Generate an SSL Cert

The following is just an example. You should read the OpenSSL's documentation so you can end up with a more appropriate configuration. You will be asked a lot of questions, these can be ignored, if you are not planning on having the certificate be part of an intricate chain (refer to the Documentation). This certificate will be used for encryption. If you need your certificate to be trusted with pre-existing software and other institutions, you must get one from a recognized Certificate Authority such as: Thawte, Verisign,...

cd /etc/ssl/certs openssl req -x509 -nodes -days 7300 -newkey rsa:2048 -keyout /etc/ssl/certs/vsftpd.pem -out /etc/ssl/certs/vsftpd.pem chmod 600 /etc/ssl/certs/vsftpd.pem

Configure VSFTPD

The following directives will allow clients to use SSL and how they will do it:

ssl_enable=YES

  # To accept anon connections when SSL is enabled on the server

allow_anon_ssl=NO

  # This option will improve performance on limited hardware

force_local_data_ssl=NO

  # To disallow normal FTP logins and only accept SSL encrypted connections

force_local_logins_ssl=YES

  # It is a good idea to enable one or multiple of these for security reasons (see documentation)

ssl_tlsv1=YES

# Choose what you prefer

ssl_sslv2=YES

# Choose what you prefer

ssl_sslv3=YES

# Include the path to your previously generated *.pem file

rsa_cert_file=/etc/ssl/certs/vsftpd.pem

# Include the path to the private key # The *.pem file contains both the key and cert if you used the command above

rsa_private_key_file=/etc/ssl/certs/vsftpd.pem