Setting up a Quick and Secure FTP Server

This guide will show you how to setup an FTP server on CentOS using VSFTPd which is available via yum. besides being available directly via yum, VSFTPd is also very easily configurable and secure. There are a few tradeoffs including no support for quotas. If you need these, take a look at PureFTP, which is slightly more complex to setup and must be build from source.

This tutorial requires some proficiency with using the shell and text editors.

Installation

Installing VSFTP is done by simply grabbing it through yum: 

yum -y install vsftpd

Configuration

To configure VSFTP for a single user access, follow these steps below; more can be added by repeating steps 2-7:

  1. Create an FTP user group 
    groupadd ftp
  2. Modify the command below to suit your desires. We used “ftp” as the group, “user” as the username, and “/home/user” as the home directory for the account 
    useradd -g ftp -d /home/user/ -c "user" user
  3. Set the user's password 
    passwd user
  4. Create a fake shell for the ftp service 
    touch /bin/ftp
  5. Edit /etc/shells and add that fake shell (/bin/ftp) to the last line.
  6. Next edit /etc/passwd and add the fake shell to the user 
    user:x:500:50: user :/home/user:/bin/ftp
  7. Check the user is listed in /etc/vsftpd.chroot_list but not in /etc/vsftpd/user_list or /etc/vsftpd/ftpusers as they will be unable to access the server if so.
  8. In the VSFTP config file /etc/vsftpd/vsftpd.conf activate the following in order to jail users: 
    chroot_list_enable=YES

Finalize

Start the FTP service: 

/etc/init.d/vsftpd start

We also do not recommend running SELinux with VSFTP: 

echo 0 > /selinux/disable

Also if you are running a firewall via iptables, you will need to poke a hole for the service: 

iptables -A INPUT -p tcp -s 0/0 --sport 1024:65535 --dport 21 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --sport 21 -d 0/0 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
iptables -A INPUT -p tcp -s 0/0 --sport 1024:65535 --dport 1024:65535 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -p tcp --sport 1024:65535 -d 0/0 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --sport 20 -d 0/0 --dport 1024:65535 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p tcp -s 0/0 --sport 1024:65535 --dport 20 -m state --state ESTABLISHED -j ACCEPT

That's it! You now have a working and secure FTP server that can be accessed from anywhere!

, ,