Using the Very Secure FTP Server
The Very Secure FTP Server (vsFTPd) is the only FTP server software included in the Fedora distribution. vsFTPd is becoming the FTP server of choice for sites that need to support thousands of concurrent downloads. It was also designed to secure your systems against most common attacks.
Red Hat, Inc. itself uses vsFTPd on its own FTP servers (ftp.redhat.com). Other organizations in the Linux/GNU world have also made the switch to vsFTPd, including Debian Linux (ftp.debian.org) and the GNU Project (ftp.gnu.org).
Besides security and scalability, vsFTPd was designed for simplicity. Therefore, fewer options exist for configuring vsFTPd than you find in WU-FTPD, an older FTP server package which is still commonly used, so you are expected to rely on standard Linux file and directory permissions to provide refined access to your server. Getting started with vsFTPd, or using it to replace WU-FTPD, is fairly straightforward.
| Note | Although vsFTPd is the only full-blown FTP server software in Fedora, the WU-FTPD FTP server sofware, which was once part of Red Hat Linux, is still available on the Web. At this point, you must decide if you want to run the vsFTPd server on your Fedora system or download WU-FTPD (wu-ftpd package) and install it instead. The one you choose will take over the full functions of FTP service on your computer. Descriptions for setting up WU-FTPD from a previous edition of the Red Hat Linux Bible are available online from the companion Web site to this book: www.wiley.com/go/fedora3bible. |
Quick-starting vsFTPd
By enabling the vsFTPd service, you can almost instantly have an FTP service running with the default values (set in the /etc/vsftpd/vsftpd.conf file). The following is a quick procedure for getting your vsFTPd server up and running.
| Note | If you have been using the WU-FTP server on your computer and you are switching to vsFTPd, you need to turn off WU-FTP. To do that, change disable=no to disable=yes in the /etc/xinetd.d/wu-ftpd file. Then, after you have completed the following procedure, vsFTPd will take control of the default FTP configuration, allowing access to the /var/ftp directory and listening on the default FTP port. Because the two packages have some different default settings, however, you may want to do additional tuning to get vsFTPd to perform as you would like it to. |
-
To use the vsFTPd server, you must make sure that the vsFTPd software package is installed.
# rpm -q vsftpd
-
Enable the vsFTPd server by typing the following line (as root user):
# chkconfig vsftpd on
-
Start the vsFTPd server as follows:
# service vsftpd start
-
Try to log in to the FTP server as anonymous (using any e-mail address as the password):
$ ftp localhost Connected to yourhost 220 (vsFTPd 1.2.1) 530 Please login with USER and PASS Name (localhost:chris): anonymous 331 Please specify the password. Pasword: ****** 230 Login successful. Remote system type is UNIX. Using binary mode to transfer files. ftp>
If you saw messages similar to the preceding, your vsFTPd server is now up and running. Next, try to access the server from another computer on the network to be sure that it is accessible.
| Note | If your FTP server is not accessible to the outside world, you may need to ensure that your network is configured properly and that your firewall allows access to port 21.Refer to Appendix C for information on getting your network services working. |
The next section explains the /etc/vsftpd/vsftpd.conf configuration file.
Configuring vsFTPd
Most of the configuration of vsFTPd is done in the /etc/vsftpd/vsftpd.conf file. Although many values are not set explicitly in vsftpd.conf, you can override the defaults by setting option=value statements in this file. You can set such things as which users have access to your vsFTPd server, how logging is done, and how timeouts are set.
Read the following sections for more information about how vsFTPd is configured by default and how you can further configure your vsFTPd server.
User accounts
Users who can access your vsFTPd server are, by default, the anonymous user and any users with real-user accounts on your system. (A guest user is simply a real user account that is restricted to its own home directory.) The following lines set these user access features:
anonymous_enable=YES local_enable=YES
The anonymous_enable line lets users log in anonymously using either the anonymous or ftp user name. Any users with local accounts (in /etc/passwd) can log into the FTP server with local_enable set to YES. An exception to this rule is that, by default, all user accounts listed in the /etc/vsftpd.user_list file are denied access.
| Note | If you want to disable access by anonymous users, don’t just comment out anonymous_enable. Anonymous access is on by default, so you must set anonymous_enable=NO to disable it. |
Check the vsftpd.user_list file to see which users are denied access to the vsFTPd server. Note that root and other administrative logins are excluded. You can add other users to this list or change the location of the list by setting the userlist_file parameter to the file you want. To add a user to the vsftpd.user_list or use the userlist_file parameter to create a new list, you must also have userlist_enable set to YES (as it is by default). For example:
userlist_file=/etc/vsftpd.user_list_local userlist_enable=YES
If you like, you can change the meaning of the /etc/vsftpd.user_list file so that only the users in that list are allowed to use the vsFTPd service. Set userlist_deny=NO and change the /etc/vsftpd.user_list to include only names of users to whom you want to grant access to the server. (All other users, including anonymous and ftp, will be denied access.)
Setting FTP access
The vsFTPd server software provides a simple and seemingly secure approach to access permissions. Instead of using settings in the FTP service to selectively prevent downloads and uploads of particular directories (as FTP servers such as WU-FTPD do), you can use standard Linux file and directory permissions to limit access. There are, however, the following general settings in the /etc/vsftpd/vsftpd.conf file to let users get files from and put files onto your vsFTPd server.
Downloading files
Any users with valid logins (anonymous or real users, excluding some administrative logins) can download files from the vsFTPd server, by default. The ability to download a particular file or a file from a particular directory is governed by the following basic Linux features:
-
File and directory permissions — Standard file and directory permissions apply as a means of limiting access to particular files, even in accessible file systems. So, if the root user puts a file with 600 permission (read/write to root only) in the /var/ftp directory, an anonymous user is not able to download that file.
-
Root directory — The root directory (chroot) for anonymous users is /var/ftp. The root directory for regular users is the entire computer’s root directory (/), although their current directory after connecting to FTP is /home/user, where user is the user name. So an anonymous user is restricted to downloads from the /var/ftp directory structure, while a regular user potentially has access to the whole file system. Another possibility is to create guest accounts by restricting some or all users to their home directories.
You can use the chroot_local_user option to change the root directory for regular users so that they are restricted to their home directory. In general you will not want to do this, because using the same user name and password for general Linux logins doesn’t place such restrictions on your users. To restrict all regular users to their home directory when using vsFTPd, add this line to the vsftpd.conf file:
chroot_local_user=YES
To enable the concept of guest users, you can choose to limit only selected users to their home directories. You do this by setting chroot_list_enable to YES, then adding a list of guest users to a file noted with the chroot_list_file option. The following example lets you add such a list (one user name per line) to the /etc/vsftpd.chroot_list file:
chroot_list_enable=YES chroot_list_file=/etc/vsftpd.chroot_list
| Tip | To restrict a user to FTP access only, set the user's shell to /sbin/nologin in the /etc/passwd file. |
You can add a setting to the vsftpd.conf file to affect how files are downloaded. To enable ASCII downloads, you can enable that feature as follows:
ascii_download_enable=YES
Without making that change, all downloads are done in binary mode. Although vsFTPd will seem to allow the user to change to ascii mode, ascii mode will not work if this setting is NO.
Uploading (writing) files from local users
Two values set in the vsftpd.conf file allow the uploading of files during a vsFTPd session. The following defaults allow any users with regular, local user accounts to upload files:
write_enable=YES local_umask=022
The write_enable value must be YES if you intend to allow any users the ability to write to the FTP server. The umask=022 value sets the default file permission used when a local user creates a file on the server. (The 022 value causes files created to have 644 permission, allowing the user read and write permission and everyone else only read permission.)
As with downloading, uploading in ascii mode is prohibited by default. Though ascii downloads create a potential security hole for draining resources from your server, ascii uploads are apparently not as dangerous and can be useful for uploading text files. To allow ascii uploads, add the following line:
ascii_upload_enable=YES
Uploading (writing) files from anonymous users
The ability to upload files is turned off for anonymous FTP users. If you want to turn it on, add the following line to the vsftpd.conf file:
anon_upload_enable=YES
You must also make sure that the /var/ftp directory contains one or more directories with write permissions open to anonymous users. For example, you might want to create an incoming directory and open its permissions (chmod 777 /var/ftp/incoming).
Files uploaded by anonymous users will be created with 600 permission by default (read/write permission for the ftp user, not accessible to any other users so that even the user who uploaded the files can't remove them). To allow 644 permission, for example, you can add the following line:
anon_umask=022
When you allow the anonymous user to upload files, you can grant limited ability to change the files he or she uploads. By adding the following line, you can allow anonymous users to rename or delete any files owned by anonymous users (provided that the files are in directories for which the users have write permission):
anon_other_write_enable=YES
If you also want to allow anonymous users to create their own directories, add the following:
anon_mkdir_write_enable=YES
By default, the ftp user is given ownership of uploaded files from anonymous users. If you want to indicate that anonymous uploads be owned by a different user (of your choice), you can use the chown_uploads and chown_username options. For example, if you have a user account named mynewuser, you can set these options as follows:
chown_uploads=YES chown_username=mynewuser
Of course, you can create and use any user name you want. However, for security reasons you should not use the root login or any other administrative login for this purpose.
Adding message files
Although vsFTPd doesn’t support the arrangement of README and welcome files that FTP servers such as WU-FTP support, you can add .message files to any accessible directory on your vsFTPd server. Then, if you use the default dirmessage_enable option as follows, the text from the .message file will be displayed when the user enters the directory:
dirmessage_enable=YES
You will probably at least want to add a .message file to the root directory of the FTP server for anonymous users. By default, that location is /var/ftp/.message. If you want to use files other than .message files, you can set the message_file option. For example, to have text from the .mymessage file displayed when you enter a directory, you can add the following line:
message_file=.mymessage
You can also set a one-line message to appear before the login prompt. You can do this by entering the following line, replacing the text with anything you want to say:
ftpd_banner=Welcome to My FTP service.
Logging vsFTPd activities
Logging is enabled in vsFTPd by default, and the activities of your vsFTPd site are written to the /var/log/xferlog file. The following options enable logging and change the log file to /var/log/vsftpd.log:
xferlog_enable=YES xferlog_file=/var/log/vsftpd.log
You can turn off logging if you like by changing YES to NO. (Note, however, that logging enables you to watch for potential break-ins, so turning it off is not recommended.) Or you can change the location of the log file by changing the value of the xferlog_file option.
If you want to be able to use tools that generate transfer statistics, you can have vsFTPd log data written in the standard xferlog format that is used by WU-FTPD and other FTP servers. To store your transfer data in xferlog format, set the following option:
xferlog_std_format=YES
Setting timeouts
The following timeouts are set by default in vsFTPd (these values are built in, so you don’t have to make any changes to the /etc/vsftpd/vsftpd.conf file for them to take effect):
accept_timeout=60 connect_timeout=60 idle_session_timeout=600 data_connection_timeout=120
The accept_timeout=60 and connect_timeout=60 values determine how long the client has to establish a PASV or PORT style connection, respectively, before the connection times out. Both are set to 60 seconds. (Note that these two lines are not automatically included in the configuration file; you can add them by hand if you want to change their values.) The idle_session_timeout=600 option causes the FTP session to be dropped if the user has been inactive for more than 10 minutes (600 seconds). The data_connection_timeout value sets the amount of time, during which no progress occurs, that the server will wait before dropping the connection (the default here is 120 seconds).
Navigating a vsFTPd site
Most shell wildcard characters that a user might expect to use, such as question marks and brackets, are supported by vsFTPd. There is one particularly useful wildcard character you can use with the ls command, and one option you can turn on. The asterisk (*) wildcard can be used with the ls command. Multiple asterisks in the same line are supported. You can add support for the –R option of ls so that a user can recursively list the contents of the current directory and all subdirectories. To turn on this feature, which is off by default, you can add the following line to the vsftpd.conf file:
ls_recurse_enable=YES
EAN: 2147483647
Pages: 286