Overview:

FTP relies on a pair of TCP ports to get the job done. It operates in two connection channels as

FTP Control Channel, TCP Port 21: All commands you send and the ftp server's responses to those commands will go over the control connection, but any data sent back (such as "ls" directory lists or actual file data in either direction) will go over the data connection.

FTP Data Channel, TCP Port 20: This port is used for all subsequent data transfers between the client and server.

In addition to these channels, there are several varieties of FTP.

Types of FTP

From a networking perspective, the two main types of FTP are active and passive. In active FTP, the FTP server initiates a data transfer connection back to the client. For passive FTP, the connection is initiated from the FTP client.

Active FTP

The sequence of events for active FTP is:

Your client connects to the FTP server by establishing an FTP control connection to port 21 of the server. Your commands such as 'ls' and 'get' are sent over this connection.
Whenever the client requests data over the control connection, the server initiates data transfer connections back to the client. The source port of these data transfer connections is always port 20 on the server, and the destination port is a high port (greater than 1024) on the client.
Thus the ls listing that you asked for comes back over the port 20 to high port connection, not the port 21 control connection.

FTP active mode therefore transfers data in a counter intuitive way to the TCP standard, as it selects port 20 as it's source port (not a random high port that's greater than 1024) and connects back to the client on a random high port that has been pre-negotiated on the port 21 control connection.

Passive FTP

Passive FTP works differently:

Your client connects to the FTP server by establishing an FTP control connection to port 21 of the server. Your commands such as ls and get are sent over that connection.
Whenever the client requests data over the control connection, the client initiates the data transfer connections to the server. The source port of these data transfer connections is always a high port on the client with a destination port of a high port on the server.

Passive FTP should be viewed as the server never making an active attempt to connect to the client for FTP data transfers. Because client always initiates the required connections, passive FTP works better for clients protected by a firewall.

Regular FTP

By default, the VSFTPD package allows regular Linux users to copy files to and from their home directories with an FTP client using their Linux usernames and passwords as their login credentials.

VSFTPD also has the option of allowing this type of access to only a group of Linux users, enabling you to restrict the addition of new files to your system to authorized personnel.

The disadvantage of regular FTP is that it isn't suitable for general download distribution of software as everyone either has to get a unique Linux user account or has to use a shared username and password. Anonymous FTP allows you to avoid this difficulty.

Anonymous FTP

Anonymous FTP is the choice of Web sites that need to exchange files with numerous unknown remote users. Common uses include downloading software updates and MP3s and uploading diagnostic information for a technical support engineers' attention. Unlike regular FTP where you login with a preconfigured Linux username and password, anonymous FTP requires only a username of anonymous and your email address for the password. Once logged in to a VSFTPD server, you automatically have access to only the default anonymous FTP directory (/var/ftp in the case of VSFTPD) and all its subdirectories.

Installing vsftpd:

Most RedHat and Fedora Linux software product packages are available in the RPM format as vsftpd-1.2.1-5.i386.rpm.

Testing the Status of VSFTPD

You can always test whether the VSFTPD process is running by using the netstat -a command which lists all the TCP and UDP ports on which the server is listening for traffic. This example shows the expected output.

# netstat -a | grep ftp

tcp        0        0        *:ftp         *:*        LISTEN

If VSFTPD wasn't running, there would be no output at all.

The vsftpd.conf File:

This file uses a number of default settings you need to know about.

VSFTPD runs as an anonymous FTP server. Unless you want any remote user to log into to your default FTP directory using a username of anonymous and a password that's the same as their email address.
If you enable anonymous FTP with VSFTPD, remember to define the root directory that visitors will visit. This is done with the anon_root directive.

anon_root=/data/directory

VSFTPD logs FTP access to the /var/log/vsftpd.log log file. You can change this by modifying the xferlog_file directive.
By default VSFTPD expects files for anonymous FTP to be placed in the /var/ftp directory. You can change this by modifying the anon_root directive. There is always the risk with anonymous FTP that users will discover a way to write files to your anonymous FTP directory. You run the risk of filling up your /var partition if you use the default setting. It is best to make the anonymous FTP directory reside in its own dedicated partition.

Configuration file:

# Example config file /etc/vsftpd/vsftpd.conf

# The default compiled in settings are fairly paranoid. This sample file

# loosens things up a bit, to make the ftp daemon more usable.

# Please see vsftpd.conf.5 for all compiled in defaults.

# READ THIS: This example file is NOT an exhaustive list of vsftpd options.

# Please read the vsftpd.conf.5 manual page to get a full idea of vsftpd's

# capabilities.

# Allow anonymous FTP? (Beware - allowed by default if you comment this out).

anonymous_enable=YES

# Uncomment this to allow local users to log in.

local_enable=YES

# Uncomment this to enable any form of FTP write command.

write_enable=YES

# Default umask for local users is 077. You may wish to change this to 022,

# if your users expect that (022 is used by most other ftpd's)

local_umask=022

# Uncomment this to allow the anonymous FTP user to upload files. This only

# has an effect if the above global write enable is activated. Also, you will

# obviously need to create a directory writable by the FTP user.

#anon_upload_enable=YES

# Uncomment this if you want the anonymous FTP user to be able to create

# new directories.

#anon_mkdir_write_enable=YES

# Activate directory messages - messages given to remote users when they

# go into a certain directory.

dirmessage_enable=YES

# The target log file can be vsftpd_log_file or xferlog_file.

# This depends on setting xferlog_std_format parameter

xferlog_enable=YES

# Make sure PORT transfer connections originate from port 20 (ftp-data).

connect_from_port_20=YES

# If you want, you can arrange for uploaded anonymous files to be owned by

# a different user. Note! Using "root" for uploaded files is not

# recommended!

#chown_uploads=YES

#chown_username=whoever

# The name of log file when xferlog_enable=YES and xferlog_std_format=YES

# WARNING - changing this filename affects /etc/logrotate.d/vsftpd.log

#xferlog_file=/var/log/xferlog

# Switches between logging into vsftpd_log_file and xferlog_file files.

# NO writes to vsftpd_log_file, YES to xferlog_file

xferlog_std_format=YES

# You may change the default value for timing out an idle session.

#idle_session_timeout=600

# You may change the default value for timing out a data connection.

#data_connection_timeout=120

# It is recommended that you define on your system a unique user which the

# ftp server can use as a totally isolated and unprivileged user.

#nopriv_user=ftpsecure

# Enable this and the server will recognise asynchronous ABOR requests. Not

# recommended for security (the code is non-trivial). Not enabling it,

# however, may confuse older FTP clients.

#async_abor_enable=YES

# By default the server will pretend to allow ASCII mode but in fact ignore

# the request. Turn on the below options to have the server actually do ASCII

# mangling on files when in ASCII mode.

# Beware that on some FTP servers, ASCII support allows a denial of service

# attack (DoS) via the command "SIZE /big/file" in ASCII mode. vsftpd

# predicted this attack and has always been safe, reporting the size of the

# raw file.

# ASCII mangling is a horrible feature of the protocol.

#ascii_upload_enable=YES

#ascii_download_enable=YES

# You may fully customise the login banner string:

#ftpd_banner=Welcome to blah FTP service.

# You may specify a file of disallowed anonymous e-mail addresses. Apparently

# useful for combatting certain DoS attacks.

#deny_email_enable=YES

# (default follows)

#banned_email_file=/etc/vsftpd/banned_emails

# You may specify an explicit list of local users to chroot() to their home

# directory. If chroot_local_user is YES, then this list becomes a list of

# users to NOT chroot().

#chroot_local_user=YES

#chroot_list_enable=YES

# (default follows)

#chroot_list_file=/etc/vsftpd/chroot_list

# You may activate the "-R" option to the builtin ls. This is disabled by

# default to avoid remote users being able to cause excessive I/O on large

# sites. However, some broken FTP clients such as "ncftp" and "mirror" assume

# the presence of the "-R" option, so there is a strong case for enabling it.

#ls_recurse_enable=YES

# When "listen" directive is enabled, vsftpd runs in standalone mode and

# listens on IPv4 sockets. This directive cannot be used in conjunction

# with the listen_ipv6 directive.

listen=YES

# This directive enables listening on IPv6 sockets. To listen on IPv4 and IPv6

# sockets, you must run two copies of vsftpd with two configuration files.

# Make sure, that one of the listen options is commented !!

#listen_ipv6=YES

pam_service_name=vsftpd

userlist_enable=YES

tcp_wrappers=YES

Options Explained:

1. anonymous_enable=YES

By default anonymous users are allowed to log into the FTP. If you want to disable this feature, write NO instead of YES.

2. local_enable=YES

By default, local user also can log into the FTP. If you don’t want them to login, write NO.

3. write_enable=YES

If this option is enabled, then (both) users are able to perform write action in FTP.

4. local_umask=022

Default umask for local users is 077. You may wish to change this to 022, if your users expect that (022 is used by most other ftpd's).

5. #anon_upload_enable=YES

This option allows anonymous users to upload a file in FTP. By default this option is disabled.

To allow, make it uncomment.

6. #anon_mkdir_write_enable=YES

This option will let the anonymous users to create the directory in FTP. If you want anon users to create the directory, uncomment it.

7. dirmessage_enable=YES

Whenever you want user to show some message when they do the FTP, uncomment this option with the required message.

Note: To do this, create a file named “.message” in /var/ftp/pub and write here the welcome message.

8. xferlog_enable=YES

This option enables the FTP logging.

9. #chown_uploads=YES

#chown_username=whoever

These 2 options are used simultaneously.

If you want anonymous users to upload a file and that anon file is owned by a different user say FTPUSER, then you need to uncomment both options.

Write the username in 2^nd line.

#chown_username=ftpuser

10. #xferlog_file=/var/log/xferlog

If option7 is enabled, the log file will be saved at path /var/log/xferlog.

11. xferlog_std_format=YES

There are 2 types of Log files. Standard logging (gives less info) and Xferlogging (gives more info than standard format).

If this option is enabled, Xferlog messages will be saved.

For this, disable the vsftpd_log_file option.

12. #chroot_local_user=YES

If you want local users to be chrooted, enable the option by uncommenting it.

13. #chroot_list_enable=YES

#chroot_list_file=/etc/vsftpd/chroot_list

Note: Chroot option:

If this option is enabled then the directory /var/ftp becomes /. Means, when an anon user get login at /var/ftp directory, it can’t go back than /var/ftp directory because it will act like the “/”.

So it makes /var/ftp = /

This is called chroot.

Local users get their login in their home directory.

For local users, if chroot option is enabled,

/home/user1 will act like / for them in FTP. Now user1 cant go 1 level up to the directory structure. If user runs the command

#cd, it will be at /home/user1. And if user runs command

#cd .., it will be at /home/user1. Its path will not change backwards.

Note: To enable this option, you need to create a file under /etc/vsftpd/chroot_list.

In this file, you write the name of the users you DON’T want to be chrooted.

Some other options:

Followings are some options that can be added in the end of the conf file separately.

1. max_clients = 25

Means, your FTP server will answer to at max 25 clients at a time.

2. max_per_ip = 3

Means, from a particular IP address, at max 3 connections are allowed.

3. anon_max_rate = 5

This option specifies the connection speed for anon users.

4. local_max_rate = 10

This option specifies the connection speed for the local users.

Create a file /etc/vsftpd/<username>_config

And write here:

max_rate = 10

Now that particular user will get the specified Rate.

For this you have to write another option in the end of the vsftpd configuration file:

5. User_config_dir = /etc/vsftpd/user_config

6. hide_ids = yes

Means, the true identity will not be shown when some user run the command #ls.

If this option is disabled, and root user creates a file. After #ls command, the output shows

0 0 file_name

If this option is enabled, it will look like:

ftp ftp file_name

Means, every file will have the ownership and group of “ftp” not the original ID.

Thus, the option hides the true IDs.

Note:

You can face the problem while trying to log into FTP server if SElinux is not disabled.

So either you disable the selinx or follow the following steps:

1. # getsebool –a | grep ftp

It will a list of all the Booleans related to FTP.

Allow “allow_ftpd_full_access” and “ftp_home_dir” Booleans on by running the command:

# setsebool -P allow_ftpd_full_access 1

# setsebool -P ftp_home_dir 1

Note: User(s) Control :

Since we specify in the configuration that we want to explicitly say which user(s) are allowed to use the FTP service, we need to edit the following file /etc/vsftpd/user_list and add the user1, user2, user4 using your favorite text editor such as `nano` or `vi` :

nano /etc/vsftpd/user_list

Then, if there something in the file, delete everything, and make it look like :

user1

user2

user4

Please take note that all other user(s), regardless of who they are, will not be allowed if they aren’t mentioned in this file.

Note: Firewall Configuration :

Assuming that you did correctly forward the port from your router to your CentOS server as required in the Topology, you will probably need to add some iptables firewall rules to allow the connections to come in and out.

Run the following commands to add the necessary rules :

/sbin/iptables -A OUTPUT -p tcp --sport 20 -j ACCEPT

/sbin/iptables -A INPUT -p tcp --dport 21 -j ACCEPT

/sbin/iptables -A INPUT -p tcp -m multiport --dports 2000:2050 -j ACCEPT

/sbin/service iptables save

/sbin/service iptables restart

1. ftp package is required to be installed.

2. telnet package is required to be installed.

The /etc/vsftpd/ftpusers File:

Users that are not allowed to login via ftp are written here.

For added security, you may restrict FTP access to certain users by adding them to the list of users in the /etc/vsftpd.ftpusers file. The VSFTPD package creates this file with a number of entries for privileged users that normally shouldn't have FTP access. As FTP doesn't encrypt passwords, thereby increasing the risk of data or passwords being compromised, it is a good idea to let these entries remain and add new entries for additional security.

The /etc/vsftpd/user_list File:

If userlist_deny=NO -> only allow users in this file

If userlist_deny=YES -> never allow users in this file

Note: vsftpd also checks the file /etc/vsftpd/ftpusers for users that are denied.

Client side configuration:

Lets say there are 2 users User1, User2 and the server IP is 192.168.1.50.

When you are logged in from “User1”:

[user1@rc Desktop]$ ftp 192.168.1.50

Connected to 192.168.1.50 (192.168.1.50).

220 Welcome to RC FTP service.

Name (192.168.1.50:user1):

331 Please specify the password.

Password:

230 Login successful.

Remote system type is UNIX.

Using binary mode to transfer files.

ftp> pwd

257 "/"

Note: Here output of the command “#pwd” is “/”. This “/” means “/home/user1” not the actual “/” because it is chrooted. This is the home directory of user1.

ftp> ls

227 Entering Passive Mode (192,168,1,50,56,230).

150 Here comes the directory listing.

-rw-r--r-- 1 500 500 16 Sep 18 08:52 1

drwxr-xr-x 2 500 500 4096 Sep 18 10:14 Desktop

drwxr-xr-x 2 500 500 4096 Sep 18 10:14 Documents

drwxr-xr-x 2 500 500 4096 Sep 18 10:14 Downloads

drwxr-xr-x 2 500 500 4096 Sep 18 10:14 Music

drwxr-xr-x 2 500 500 4096 Sep 18 10:14 Pictures

drwxr-xr-x 2 500 500 4096 Sep 18 10:14 Public

drwxr-xr-x 2 500 500 4096 Sep 18 10:14 Templates

drwxr-xr-x 2 500 500 4096 Sep 18 10:14 Videos

drwxr-xr-x 2 500 500 4096 Sep 18 08:52 q

226 Directory send OK.

ftp> bye

221 Goodbye.

RC's Blog

Saturday, November 28, 2015

FTP server basic configuration