How To: Configure Secure FTP Server (VSFTPD)

zhangxinba

　　This post is totally dedicated to vsftpd configuration with uploads enabled. vsftpd stands for Very Secure FTP Daemon. It is shipped with almost all the latest Red Hat based OS. vsftpd for rpm based Linux distros can be downloaded from here. Also, one can install vsftpd by issuing ‘yum install vsftpd’ or ‘apt-get install vsftpd’ command. After installing vsftpd, you just need to start the vsftpd service.
[root@bordeaux saini]$ service vsftpd start [Enter]　　And you are done. Your computer is now a FTP server. You can browse your ftp server by pointing your favourite browser to ftp://localhost/ or ftp://127.0.0.1/ or ftp:// .

　　If you see access denied or some error>　　By default the files and directories in /var/ftp/ directory will be shown at ftp://localhost/ . Now, there are two ways to share your files on ftp.
　　1. Copy/move files that you want to share to /var/ftp/ directory.
　　2. Mount directories you want to share to /var/ftp/SharedDirName. Suppose you want to share /home/saini/Movies/ folder on your ftp, then follow the following steps:
Step 1
　　Login as root.
1　　
2
[saini@bordeaux saini]$ su [Enter]Enter Password for root.Step 2
　　Go to /var/ftp/ and create the directory that you want to share.
1　　
2
[root@bordeaux saini]$ cd /var/ftp/ [Enter][root@bordeaux ftp]$ mkdir SharedMovies [Enter]Step 3
　　Bind the original directory to SharedMovies.
[root@bordeaux ftp]$ mount --bind /home/saini/Movies/ /var/ftp/SharedMovies/ [Enter]　　If you browse your ftp now, you’ll see SharedMovies folder as well. You can remove default pub directory if you don’t like it.
　　The current ftp server will be a very basic one and will allow only downloads. Below we will see how to configure it so that others are allowed to upload files/directories to your server.
Step 1
　　Create a directory say ‘Upload’.
[root@bordeaux saini]$ mkdir Upload [Enter]　　Note that this Upload directory can be anywhere either in your home directory or in /var/ftp/ or even on some other partitions.
Step 2
　　Change the ownership of Upload to ftp and change the permissions to 777.
1　　
2
[root@bordeaux saini]$ chown ftp:ftp Upload [Enter][root@bordeaux saini]$ chmod 777 Upload [Enter]Step 3
　　If you created Upload at any place other than /var/ftp/ , then bind it to a dir in /var/ftp/ .
1　　
2
[root@bordeaux saini]$ mkdir /var/ftp/Uploads [Enter][root@bordeaux saini]$ mount --bind /home/saini/Upload/ /var/ftp/Uploads/ [Enter]Step 4
　　Configure vsftpd.conf . The default configuration files for vsftpd lives in /etc/vsftpd/ . vsftpd.conf is configuration file for vsftpd.
　　Open /etc/vsftpd/vsftpd.conf in any editor and add/uncomment the following lines :
　　Lines to be added or uncomments in /etc/vsftpd/vsftpd.conf
1　　
2
　　
3
　　
4
　　
5
　　
6
　　
7
　　
8
　　
9
　　
10
　　
11
anonymous_enable=YES　　
write_enable=YES
　　
write_enable=YES
　　
anon_upload_enable=YES
　　
anon_mkdir_write_enable=YES
　　
anon_other_write_enable=YES
　　
dirmessage_enable=YES
　　
dirlist_enable=YES
　　
no_anon_password=YES
　　
file_open_mode=0777
　　
guest_enable=YES
　　Save vsftpd.conf file and restart the vsftpd service with the command ‘service vsftpd restart’. Now anyone can upload files to your ftp server, but only to Upload folder.

　　There are certain more configurations which are>1　　
2
　　
3
　　
4
max_per_ip=2 # Max no. of allowed connections per IP Address.max_clients=3　　
# Max no. of different IP Addressed which are allowed to connect.anon_max_rate=1097152 # Max bytes/sec a user can upload/download to/from your ftp server.banner_file=/etc/vsftpd/ftp_banner # The file containing the welcome message to be displayed to the clients.
　　For more configuration options, refer man pages for vsftpd.conf and vsftpd.
　　Note :

• 　　Whenever you restart your computer, you have to bind the directories everytime, so that they are shown on the ftp server. To skip binding every time, write everything (all commands for binding) in a mount.sh file and run it whenever you restart your computer.
  
• 　　You can view my vsftpd.conf file here.
  
• 　　Sometime, uploaded files doesn’t have 777 permissions. You can run this shell scriptin background forever.