How to configure FTP (vsftpd) Server in Advanced Way

In my previous post, I have described how to start with the FTP server using vsftpd. See the below link, if missed out. "How to configure FTP Server In Red Hat Enterprise Linux 7"

And the default configuration summary will be:

# grep -v ^# /etc/vsftpd/vsftpd.conf 
anonymous_enable=YES
local_enable=YES
write_enable=YES
local_umask=022
dirmessage_enable=YES
xferlog_enable=YES
connect_from_port_20=YES
xferlog_std_format=YES
listen=NO
listen_ipv6=YES

pam_service_name=vsftpd
userlist_enable=YES
tcp_wrappers=YES

Scenario:1 Disable anonymous (ftp) access and disable to exposed the vsftpd version.

Step:1 To change the vsftpd service configuration file.

# vim /etc/vsftpd/vsftpd.conf 
::::::::::::: CUT SOME OUTPUT :::::::::::::  
anonymous_enable=NO
ftpd_banner=Welcome to blah FTP service.
::::::::::::: CUT SOME OUTPUT :::::::::::::  

Step:2 To restart the vsftpd server to reflect the last changes.

# systemctl restart vsftpd
# systemctl is-active vsftpd
active

Step:2 To verify our expectations on vsftpd service.

# telnet 192.168.122.144 21
Trying 192.168.122.144...
Connected to 192.168.122.144.
Escape character is '^]'.
220 Welcome to blah FTP service.   << has replaced with 220 (vsFTPd 3.0.2)  

# ftp 192.168.122.144 21
Connected to 192.168.122.144 (192.168.122.144).
220 Welcome to blah FTP service.
Name (192.168.122.144:mhaque): anonymous
331 Please specify the password.
Password:
530 Login incorrect.
Login failed.

if anonymous access enabled, it will be successful login:

::::::::::::: CUT SOME OUTPUT ::::::::::::: 
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.

Scenario:2 To turn off standard ftpd xferlog log format and turn on verbose vsftpd log format. The default vsftpd log file is /var/log/vsftpd.log.

Step:1 To change the vsftpd service configuration file.

# vim /etc/vsftpd/vsftpd.conf 
::::::::::::: CUT SOME OUTPUT :::::::::::::  
xferlog_std_format=NO
log_ftp_protocol=YES
::::::::::::: CUT SOME OUTPUT :::::::::::::  

Step:2 To restart the vsftpd server to reflect the last changes.

# systemctl restart vsftpd
# systemctl is-active vsftpd
active

Step:3 To verify our expectations on vsftpd service.

# tail -2 /var/log/vsftpd.log  
Wed Jul 22 23:19:56 2019 [pid 4101] FTP command: Client "::ffff:192.168.122.1", "PASV"
Wed Jul 22 23:19:56 2019 [pid 4101] FTP response: Client "::ffff:192.168.122.1", "530 Please login with USER and PASS."

vsftpd.log log file will automatically create, and the ftp logs will populate into the vsftpd.log file instead of xferlog.

# tail -2 /var/log/xferlog 
Sun Jul 19 21:33:56 2019 1 ::ffff:192.168.122.112 3575677 /pub/rhel7/repodata/cda777f1e54509e022f31e0772d4063d5c7eccffadbb28d06ec6a7c0e62b9b82-primary.sqlite.bz2 b _ o a ftp@example.com ftp 0 * c
Sun Jul 19 21:34:01 2019 1 ::ffff:192.168.122.112 3713 /pub/rhel7/repodata/repomd.xml b _ o a ftp@example.com ftp 0 * c

Scenario:3 User should able to upload anonymous files and does not have write access to the top-level directory within the chroot.

Step:1 To change the vsftpd service configuration file.

# vim /etc/vsftpd/vsftpd.conf 
::::::::::::: CUT SOME OUTPUT ::::::::::::: 
local_enable=YES
write_enable=YES
chroot_local_user=YES
chown_uploads=YES
allow_writeable_chroot=YES
::::::::::::: CUT SOME OUTPUT ::::::::::::: 

Step:2 To restart the vsftpd server to reflect the last changes.

# systemctl restart vsftpd
# systemctl is-active vsftpd
active

Step:3 To verify our expectations on vsftpd service.

# ftp 192.168.122.144 
Connected to 192.168.122.144 (192.168.122.144).
220 Welcome to blah FTP service.
Name (192.168.122.144:mhaque): atower
331 Please specify the password.
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> pwd
257 "/"
ftp> lcd /tmp/
Local directory now /tmp
ftp> !ls abc    << local file that will upload to ftp server
abc
ftp> ls
227 Entering Passive Mode (192,168,122,144,125,91).
150 Here comes the directory listing.
226 Directory send OK. << There is no abc file in the ftp server
ftp> mput abc
mput abc? y
227 Entering Passive Mode (192,168,122,144,189,125).
150 Ok to send data.
226 Transfer complete.
ftp> ls
227 Entering Passive Mode (192,168,122,144,27,107).
150 Here comes the directory listing.
-rw-r--r--    1 1001     1001            0 Jul 22 15:53 abc
226 Directory send OK.
ftp> 

Scenario:4 The ftp server access restriction for the user (only listed user can able to access) and the client system.

Step:1 To change the vsftpd service configuration file.

# vim /etc/vsftpd/vsftpd.conf 
::::::::::::: CUT SOME OUTPUT ::::::::::::: 
userlist_deny=NO
tcp_wrappers=YES
::::::::::::: CUT SOME OUTPUT ::::::::::::: 

# cat /etc/vsftpd/user_list 
# vsftpd userlist
# If userlist_deny=NO, only allow users in this file
# If userlist_deny=YES (default), never allow users in this file, and
# do not even prompt for a password.
# Note that the default vsftpd pam config also checks /etc/vsftpd/ftpusers
# for users that are denied.
atower

Step:2 We have enabled the tcp wrappers for the vsftpd server and need to configure tcp wrappers (hosts.allow & hosts.deny files) for the external device (client system) that will be authorized to have access.

# systemctl restart vsftpd
# systemctl is-active vsftpd
active

Step:3 To restart the vsftpd server to reflect the last changes.

# cat /etc/hosts.allow 
::::::::::::: CUT SOME OUTPUT ::::::::::::: 
#
vsftpd: ALL EXCEPT 192.168.122.254

# cat /etc/hosts.deny 
::::::::::::: CUT SOME OUTPUT ::::::::::::: 
#
vsftpd: ALL

TCP Wrapper is a computer program that provides firewall services to UNIX users on a network by monitoring incoming packets to determine if the external device is authorized to have access. TCP Wrapper monitors and filters incoming requests for the FTP (VSFTPD) and other network services.

Step:4 To verify our expectations on vsftpd service.

# ftp 192.168.122.144 
Connected to 192.168.122.144 (192.168.122.144).
220 Welcome to blah FTP service.
Name (192.168.122.144:mhaque): atower
331 Please specify the password.
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> 221 Goodbye.

# ftp 192.168.122.144 
Connected to 192.168.122.144 (192.168.122.144).
220 Welcome to blah FTP service.
Name (192.168.122.144:mhaque): abc
530 Permission denied.
Login failed.
ftp> 

# ifconfig eth0|grep "inet " 
        inet 192.168.122.254  netmask 255.255.255.0  broadcast 192.168.122.255

# ftp 192.168.122.144 
Connected to 192.168.122.144 (192.168.122.144).
421 Service not available.

We can get more configuration related information from the man pages.

# man vsftpd.conf

# man hosts.allow