{"id":156,"date":"2018-10-17T04:57:54","date_gmt":"2018-10-17T04:57:54","guid":{"rendered":"http:\/\/www.appservgrid.com\/paw92\/index.php\/2018\/10\/17\/how-to-setup-ftp-server-with-vsftpd-on-ubuntu-18-04\/"},"modified":"2018-10-17T04:57:54","modified_gmt":"2018-10-17T04:57:54","slug":"how-to-setup-ftp-server-with-vsftpd-on-ubuntu-18-04","status":"publish","type":"post","link":"https:\/\/www.appservgrid.com\/paw92\/index.php\/2018\/10\/17\/how-to-setup-ftp-server-with-vsftpd-on-ubuntu-18-04\/","title":{"rendered":"How to Setup FTP Server with VSFTPD on Ubuntu 18.04"},"content":{"rendered":"<p>FTP (File Transfer Protocol) is a standard network protocol used to transfer files to and from a remote network. For more secure and faster data transfers, use <a href=\"\/post\/how-to-use-scp-command-to-securely-transfer-files\/\" src=\"http:\/\/lxer.com\/post\/how-to-use-scp-command-to-securely-transfer-files\/\">SCP<\/a>.<\/p>\n<p>There are many open source FTP servers available for Linux. The most popular and widely used are <a href=\"https:\/\/www.pureftpd.org\/project\/pure-ftpd\">PureFTPd<\/a>, <a href=\"http:\/\/www.proftpd.org\/\">ProFTPD<\/a> and <a href=\"https:\/\/security.appspot.com\/vsftpd.html\">vsftpd<\/a>. In this tutorial we\u2019ll be installing vsftpd. It is a stable, secure and fast FTP server. We will also show you how configure vsftpd to restrict users to their home directory and encrypt the entire transmission with SSL\/TLS.<\/p>\n<p>Although this tutorial is written for Ubuntu 18.04 the same instructions apply for Ubuntu 16.04 and any Debian based distribution, including Debian, Linux Mint and Elementary OS.<\/p>\n<h2>Prerequisites<\/h2>\n<p>Before continuing with this tutorial, make sure you are logged in as a <a href=\"\/post\/how-to-create-a-sudo-user-on-ubuntu\/\" src=\"http:\/\/lxer.com\/post\/how-to-create-a-sudo-user-on-ubuntu\/\">user with sudo privileges<\/a>.<\/p>\n<h2>Installing vsftpd on Ubuntu 18.04<\/h2>\n<p>The vsftpd package is available in the Ubuntu repositories. To install it, simply run the following commands:<\/p>\n<p>sudo apt update<br \/>\nsudo apt install vsftpd<\/p>\n<p>vsftpd service will automatically start after the installation process is complete. Verify it by printing the service status:<\/p>\n<p>sudo systemctl status vsftpd<\/p>\n<p>The output will look something like below, showing that the vsftpd service is active and running:<\/p>\n<p>* vsftpd.service &#8211; vsftpd FTP server<br \/>\n Loaded: loaded (\/lib\/systemd\/system\/vsftpd.service; enabled; vendor preset: enabled)<br \/>\n Active: active (running) since Mon 2018-10-15 03:38:52 PDT; 10min ago<br \/>\n Main PID: 2616 (vsftpd)<br \/>\n Tasks: 1 (limit: 2319)<br \/>\n CGroup: \/system.slice\/vsftpd.service<br \/>\n `-2616 \/usr\/sbin\/vsftpd \/etc\/vsftpd.conf<\/p>\n<h2>Configuring vsftpd<\/h2>\n<p>The vsftpd server can be configured by editing the \/etc\/vsftpd.conf file. Most of the settings are documented inside the configuration file. For all available options visit the <a href=\"http:\/\/vsftpd.beasts.org\/vsftpd_conf.html\">official vsftpd<\/a> page.<\/p>\n<p>In the following sections we will go over some important settings needed to configure a secure vsftpd installation.<\/p>\n<p>Start by opening the vsftpd config file:<\/p>\n<p>sudo nano \/etc\/vsftpd.conf<\/p>\n<h3>1. FTP Access<\/h3>\n<p>We\u2019ll allow access to the FTP server only the local users, find the anonymous_enable and local_enable directives and verify your configuration match to lines below:<\/p>\n<p>\/etc\/vsftpd.conf<\/p>\n<p>anonymous_enable=NO<br \/>\nlocal_enable=YES<\/p>\n<h3>2. Enabling uploads<\/h3>\n<p>Uncomment the write_enable setting to allow changes to the filesystem such as uploading and deleting files.<\/p>\n<p>\/etc\/vsftpd.conf<\/p>\n<h3>3. Chroot Jail<\/h3>\n<p>To prevent the FTP users to access any files outside of their home directories uncomment the chroot setting.<\/p>\n<p>\/etc\/vsftpd.conf<\/p>\n<p>By default to prevent a security vulnerability, when chroot is enabled vsftp will refuse to upload files if the directory that users are locked in is writable.<\/p>\n<ul>\n<li>\n<p>Method 1. &#8211; The recommended method to allow upload is to keep chroot enabled, and configure FTP directories. In this tutorial we will create an ftp directory inside the user home which will serve as the chroot and a writable uploads directory for uploading files.<\/p>\n<p>\/etc\/vsftpd.conf<\/p>\n<p>user_sub_token=$USER<br \/>\nlocal_root=\/home\/$USER\/ftp<\/li>\n<li>\n<p>Method 2. &#8211; Another option is to add the following directive in the vsftpd configuration file. Use this option if you must to grant writable access to your user to its home directory.<\/p>\n<p>\/etc\/vsftpd.conf<\/p>\n<p>allow_writeable_chroot=YES<\/li>\n<\/ul>\n<h3>4. Passive FTP Connections<\/h3>\n<p>vsftpd can use any port for passive FTP connections. We\u2019ll specify the minimum and maximum range of ports and later open the range in our firewall.<\/p>\n<p>Add the following lines to the configuration file:<\/p>\n<p>\/etc\/vsftpd.conf<\/p>\n<p>pasv_min_port=30000<br \/>\npasv_max_port=31000<\/p>\n<h3>5. Limiting User Login<\/h3>\n<p>To allow only certain users to login to the FTP server add the following lines at the end of the file:<\/p>\n<p>\/etc\/vsftpd.conf<\/p>\n<p>userlist_enable=YES<br \/>\nuserlist_file=\/etc\/vsftpd.user_list<br \/>\nuserlist_deny=NO<\/p>\n<p>When this option is enabled you need to explicitly specify which users are able to login by adding the user names to the \/etc\/vsftpd.user_list file (one user per line).<\/p>\n<h3>6. Securing Transmissions with SSL\/TLS<\/h3>\n<p>In order to encrypt the FTP transmissions with SSL\/TLS, you\u2019ll need to have an SSL certificate and configure the FTP server to use it.<\/p>\n<p>You can use an existing SSL certificate signed by a trusted Certificate Authority or create a self signed certificate.<\/p>\n<p>If you have a domain or subdomain pointing to the FTP server\u2019s IP address you can easily generate a free <a href=\"\/post\/secure-nginx-with-let-s-encrypt-on-ubuntu-18-04\/\" src=\"http:\/\/lxer.com\/post\/secure-nginx-with-let-s-encrypt-on-ubuntu-18-04\/\">Let\u2019s Encrypt<\/a> SSL certificate.<\/p>\n<p>In this tutorial we will generate a self signed SSL certificate using the openssl command.<\/p>\n<p>The following command will create a 2048-bit private key and self signed certificate valid for 10 years. Both the private key and the certificate will be saved in a same file:<\/p>\n<p>sudo openssl req -x509 -nodes -days 3650 -newkey rsa:2048 -keyout \/etc\/ssl\/private\/vsftpd.pem -out \/etc\/ssl\/private\/vsftpd.pem<\/p>\n<p>Now that the SSL certificate is created open the vsftpd configuration file:<\/p>\n<p>sudo nano \/etc\/vsftpd.conf<\/p>\n<p>Find the rsa_cert_file and rsa_private_key_file directives, change their values to the pam file path and set the ssl_enable directive to YES:<\/p>\n<p>\/etc\/vsftpd.conf<\/p>\n<p>rsa_cert_file=\/etc\/ssl\/private\/vsftpd.pem<br \/>\nrsa_private_key_file=\/etc\/ssl\/private\/vsftpd.pem<br \/>\nssl_enable=YES<\/p>\n<p>If not specified otherwise, the FTP server will use only TLS to make secure connections.<\/p>\n<h3>Restart the vsftpd Service<\/h3>\n<p>Once you are done editing, the vsftpd configuration file (excluding comments) should look something like this:<\/p>\n<p>\/etc\/vsftpd.conf<\/p>\n<p>listen=NO<br \/>\nlisten_ipv6=YES<br \/>\nanonymous_enable=NO<br \/>\nlocal_enable=YES<br \/>\nwrite_enable=YES<br \/>\ndirmessage_enable=YES<br \/>\nuse_localtime=YES<br \/>\nxferlog_enable=YES<br \/>\nconnect_from_port_20=YES<br \/>\nchroot_local_user=YES<br \/>\nsecure_chroot_dir=\/var\/run\/vsftpd\/empty<br \/>\npam_service_name=vsftpd<br \/>\nrsa_cert_file=\/etc\/ssl\/private\/vsftpd.pem<br \/>\nrsa_private_key_file=\/etc\/ssl\/private\/vsftpd.pem<br \/>\nssl_enable=YES<br \/>\nuser_sub_token=$USER<br \/>\nlocal_root=\/home\/$USER\/ftp<br \/>\npasv_min_port=30000<br \/>\npasv_max_port=31000<br \/>\nuserlist_enable=YES<br \/>\nuserlist_file=\/etc\/vsftpd.user_list<br \/>\nuserlist_deny=NO<\/p>\n<p>Save the file and restart the vsftpd service for changes to take effect:<\/p>\n<p>sudo systemctl restart vsftpd<\/p>\n<h2>Opening the Firewall<\/h2>\n<p>If you are running an <a href=\"\/post\/how-to-setup-a-firewall-with-ufw-on-ubuntu-18-04\/\" src=\"http:\/\/lxer.com\/post\/how-to-setup-a-firewall-with-ufw-on-ubuntu-18-04\/\">UFW firewall<\/a> you\u2019ll need to allow FTP traffic.<\/p>\n<p>To open port 21 (FTP command port), port 20 (FTP data port) and 30000-31000 (Passive ports range), run the following commands:<\/p>\n<p>sudo ufw allow 20:21\/tcp<br \/>\nsudo ufw allow 30000:31000\/tcp<\/p>\n<p>To avoid being locked out we will aso open the port 22:<\/p>\n<p>Reload the UFW rules by disabling and re-enabling UFW:<\/p>\n<p>sudo ufw disable<br \/>\nsudo ufw enable<\/p>\n<p>To verify the changes run:<\/p>\n<p>Status: active<\/p>\n<p>To Action From<br \/>\n&#8212; &#8212;&#8212; &#8212;-<br \/>\n20:21\/tcp ALLOW Anywhere<br \/>\n30000:31000\/tcp ALLOW Anywhere<br \/>\nOpenSSH ALLOW Anywhere<br \/>\n20:21\/tcp (v6) ALLOW Anywhere (v6)<br \/>\n30000:31000\/tcp (v6) ALLOW Anywhere (v6)<br \/>\nOpenSSH (v6) ALLOW Anywhere (v6) <\/p>\n<h2>Creating FTP User<\/h2>\n<p>To test our FTP server we will create a new user.<\/p>\n<ul>\n<li>If you already have a user which you want to grant FTP access skip the 1st step.<\/li>\n<li>If you set allow_writeable_chroot=YES in your configuration file skip the 3rd step.<\/li>\n<\/ul>\n<ol>\n<li>\n<p>Create a new user named newftpuser:<\/p>\n<\/li>\n<li>\n<p>Add the user to the allowed FTP users list:<\/p>\n<p>echo &#8220;newftpuser&#8221; | sudo tee -a \/etc\/vsftpd.user_list<\/li>\n<li>\n<p>Create the FTP directory tree and set the correct permissions:<\/p>\n<p>sudo mkdir -p \/home\/newftpuser\/ftp\/upload<br \/>\nsudo chmod 550 \/home\/newftpuser\/ftp<br \/>\nsudo chmod 750 \/home\/newftpuser\/ftp\/upload<br \/>\nsudo chown -R newftpuser: \/home\/newftpuser\/ftp<\/p>\n<p>As discussed in the previous section the user will be able to upload its files to the ftp\/upload directory.<\/p>\n<\/li>\n<\/ol>\n<p>At this point your FTP server is fully functional and you should be able to connect to your server with any FTP client that can be configured to use TLS encryption such as <a href=\"https:\/\/filezilla-project.org\/\">FileZilla<\/a>.<\/p>\n<h2>Disabling Shell Access<\/h2>\n<p>By default, when creating a user, if not explicitly specified the user will have SSH access to the server.<\/p>\n<p>To disable shell access, we will create a new shell which will simply print a message telling the user that their account is limited to FTP access only.<\/p>\n<p>Create the \/bin\/ftponly shell and make it executable:<\/p>\n<p>echo -e &#8216;#!\/bin\/shnecho &#8220;This account account is limited to FTP access only.&#8221;&#8216; | sudo tee -a \/bin\/ftponly<br \/>\nsudo chmod a+x \/bin\/ftponly<\/p>\n<p>Append the new shell to the list of valid shells in the \/etc\/shells file<\/p>\n<p>echo &#8220;\/bin\/ftponly&#8221; | sudo tee -a \/etc\/shells<\/p>\n<p>Change the user shell to \/bin\/ftponly:<\/p>\n<p>sudo usermod newftpuser -s \/bin\/ftponly<\/p>\n<h2>Conclusion<\/h2>\n<p>In this tutorial, you learned how to install and configure a secure and fast FTP server on your Ubuntu 18.04 system.<\/p>\n<p> <a href=\"http:\/\/lxer.com\/module\/newswire\/ext_link.php?rid=261798\" target=\"_blank\">Source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>FTP (File Transfer Protocol) is a standard network protocol used to transfer files to and from a remote network. For more secure and faster data transfers, use SCP. There are many open source FTP servers available for Linux. The most popular and widely used are PureFTPd, ProFTPD and vsftpd. In this tutorial we\u2019ll be installing &hellip; <\/p>\n<p class=\"link-more\"><a href=\"https:\/\/www.appservgrid.com\/paw92\/index.php\/2018\/10\/17\/how-to-setup-ftp-server-with-vsftpd-on-ubuntu-18-04\/\" class=\"more-link\">Continue reading<span class=\"screen-reader-text\"> &#8220;How to Setup FTP Server with VSFTPD on Ubuntu 18.04&#8221;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-156","post","type-post","status-publish","format-standard","hentry","category-linux"],"_links":{"self":[{"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/posts\/156","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/comments?post=156"}],"version-history":[{"count":0,"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/posts\/156\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/media?parent=156"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/categories?post=156"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/tags?post=156"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}