Installing and configuring FTP server vsftpd
This article aims to show in details the steps to set up an FTP (for File Transfer Protocol, witch is a network protocol that was once widely used for moving files between a client and server), using vsftpd (Very Secure FTP Daemon).
vsftpd is an FTP (file transfer protocole) server for UNIX systems, including Linux. It is probably the most secure system, lightweight and also extremely fast. It is stable.
Despite being small for purposes of speed and security, many more complicated FTP setups are achievable with vsftpd (Very Secure FTP Daemon), vsftpd will handle the following features:
- Per-source-IP configurability
- Per-source-IP limits
- Virtual IP configurations
- Virtual users
- Standalone or inetd operation
- Powerful per-user configurability
- Bandwidth throttling
- Encryption support through SSL integration
- and more.
the installation is very simple with apt-get or Aptitude. The commands in this tutorial require root privileges.:
aptitude install vsftpd
apt-get install vsftpd
After installing, the server starts automatically and listens on TCP port 21 by default.
You can check it within netstat:
# netstat -npl Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 0 0 0.0.0.0:21 0.0.0.0:* LISTEN 22468/vsftpd
If your host does not have a firewall, it is recommended to stop vsftpd before configuring.
You can also open up the configuration file using
The configuration file for this server is /etc/vsftpd.conf. You can find example configuration files in /usr/share/doc/vsftpd/example1.
If certain options are not present in the configuration file, the server will be use default parameters (see man vsftpd.conf).
The configuration file has three option types:
- NUMERIC OPTIONS – e.g. time in seconds, port number
- BOOLEAN OPTIONS – can be YES or NO;
STRING OPTIONS – path to directory or file /var/run/vsftpd/;
By default, anonymous connections are not allowed.
If you enable this, only access to directory /srv/ftp/ is allowed:
For enabling anonymous uploading, set:
anon_upload_enable – allow file uploads from anonymous users (under certain conditions).
anon_mkdir_write_enable – allow directory creation.
anon_root=/data/directory – allow to change the default directory.
For enabling changes to ownership, set:
User access control
Access is enabled for authorized local users by default. To disable:
To enable write access:
Save the file and close your text editor. Then, start vsftpd as a daemon:
service vsftpd start
At this point, you can log in your ftp server from your local computer.
If you want to prevent all local users from leaving their home directory, you need to uncomment this line from
As of vsftpd 2.3.5, the chroot directory must not be writable. You can change the permissions of this folder with the following command:
chmod a-w /home/user
Remember to restart the
vsftpd daemon after editing
service vsftpd restart
Containment of users
User accounts can access files of the whole system which is not always desirable and can help to compromise the machine, they can be confined by changing vsftpd.conf :
The root of their FTP will be their home directory.
Nevertheless, an account can be used to connect outside of ftp: ssh, getty (terminal login) are examples . It will then still have access to the rest of the system by the shell. You can configure the services given as examples to block the account or to contain it, but the main solution is to disable the shell for the user.
For that we assign the user’s shell to false , a simple binary which returns an error signal :
usermod -s /bin/false
Then, you need to add false to the shells list :
echo /bin/false >> /etc/shells
http://vsftpd.beasts.org/ – official site
http://vsftpd.beasts.org/vsftpd_conf.html – config file for vsftpd