🌐 🇵🇱 Polski · 🇬🇧 EN
There are many different solutions available for sharing files with users on a network. In this case, we will present FTP - File Transfer Protocol. The advantage of this solution is that users must log in before gaining access to resources, and it is simple to configure.
FTP SERVER INSTALLATION
The package used will be vsftpd, which stands for Very Secure FTP Deamon.
Step 1 - Install the appropriate package
[root@RHEL01 yum.repos.d]# yum install -y vsftpd
Loaded plugins: product-id, security, subscription-manager
Updating certificate-based repositories.
Setting up Install Process
Resolving Dependencies
--> Running transaction check
---> Package vsftpd.i686 0:2.2.2-6.el6_0.1 will be installed
--> Finished Dependency Resolution
Dependencies Resolved
=================================================================
Package Arch Version Repository Size
=================================================================
Installing:
vsftpd i686 2.2.2-6.el6_0.1 cdrom 155 k
Transaction Summary
=================================================================
Install 1 Package(s)
Total download size: 155 k
Installed size: 343 k
Downloading Packages:
Running rpm_check_debug
Running Transaction Test
Transaction Test Succeeded
Running Transaction
Installing : vsftpd-2.2.2-6.el6_0.1.i686 1/1
cdrom/productid | 1.7 kB 00:00 ...
Installed products updated.
Installed:
vsftpd.i686 0:2.2.2-6.el6_0.1
Complete!
Step 2 - Verify that the package is actually installed on the system:
[root@RHEL01 yum.repos.d]# rpm -qa | grep vsftpd
vsftpd-2.2.2-6.el6_0.1.i686
Step 3 - Also check if it is set to start at system boot; if not, configure it to do so:
[root@RHEL01 yum.repos.d]# chkconfig vsftpd on
[root@RHEL01 yum.repos.d]# chkconfig --list vsftpd
vsftpd 0:off 1:off 2:on 3:on 4:on 5:on 6:off
VSFTPD CONFIGURATION
FTP server configuration begins in the /etc/vsftpd/vsftpd.conf file, which contains the server settings.
Step 1 - Let's see the available configuration options for vsftpd:
[root@RHEL01 vsftpd]# grep -v ^# vsftpd vsftpd.conf
grep: vsftpd: No such file or directory
vsftpd.conf:anonymous_enable=YES
vsftpd.conf:local_enable=YES
vsftpd.conf:write_enable=YES
vsftpd.conf:local_umask=022
vsftpd.conf:dirmessage_enable=YES
vsftpd.conf:xferlog_enable=YES
vsftpd.conf:connect_from_port_20=YES
vsftpd.conf:xferlog_std_format=YES
vsftpd.conf:listen=YES
vsftpd.conf:
vsftpd.conf:pam_service_name=vsftpd
vsftpd.conf:userlist_enable=YES
vsftpd.conf:tcp_wrappers=YES
FIREWALL AND SELINUX CONFIGURATION FOR FTP
Before we start using FTP capabilities, we must set the appropriate options in the iptables and SELinux services. Let's start by setting the appropriate firewall rules. FTP uses two communication ports, TCP 20 and 21, for which traffic must be opened.
Step 1 - Creating firewall rules
Let's use the iptables command to create new rules:
# iptables -I INPUT 5 -p tcp -m tcp --dport 20 -j ACCEPT
# iptables -I INPUT 5 -p tcp -m tcp --dport 21 -j ACCEPT
Changes can be viewed after issuing the command: # iptables --list
Step 2 - Saving settings
# service iptables save
SELinux booleans:
ftp_home_dir - Allows FTP to read and write files in user home directories
allow_ftpd_full_access - Allows the FTP server to log in local users and write/read all files on the system
allow_ftpd_use_nfs - Allows the FTP server to use NFS for public transfers
allow_ftpd_anon_write - Allows the FTP server to receive files from public services. The directory must have the public_content_rw_t label
ftpd_connect_db - Allows FTP connection to a MySQL server
allow_ftpd_use_cifs - Allows the use of CIFS
httpd_enabled_ftp_server - Allows access to the FTP server via the httpd protocol.
Step 1 - Query to check the values that need to be changed
[root@RHEL01 vsftpd]# getsebool -a | grep ftpd_full
allow_ftpd_full_access --> off
FTP SERVER INSTALLATION
The package used will be vsftpd, which stands for Very Secure FTP Deamon.
Step 1 - Install the appropriate package
[root@RHEL01 yum.repos.d]# yum install -y vsftpd
Loaded plugins: product-id, security, subscription-manager
Updating certificate-based repositories.
Setting up Install Process
Resolving Dependencies
--> Running transaction check
---> Package vsftpd.i686 0:2.2.2-6.el6_0.1 will be installed
--> Finished Dependency Resolution
Dependencies Resolved
=================================================================
Package Arch Version Repository Size
=================================================================
Installing:
vsftpd i686 2.2.2-6.el6_0.1 cdrom 155 k
Transaction Summary
=================================================================
Install 1 Package(s)
Total download size: 155 k
Installed size: 343 k
Downloading Packages:
Running rpm_check_debug
Running Transaction Test
Transaction Test Succeeded
Running Transaction
Installing : vsftpd-2.2.2-6.el6_0.1.i686 1/1
cdrom/productid | 1.7 kB 00:00 ...
Installed products updated.
Installed:
vsftpd.i686 0:2.2.2-6.el6_0.1
Complete!
[root@RHEL01 yum.repos.d]# rpm -qa | grep vsftpd
vsftpd-2.2.2-6.el6_0.1.i686
Step 3 - Also check if it is set to start at system boot; if not, configure it to do so:
[root@RHEL01 yum.repos.d]# chkconfig vsftpd on
[root@RHEL01 yum.repos.d]# chkconfig --list vsftpd
vsftpd 0:off 1:off 2:on 3:on 4:on 5:on 6:off
VSFTPD CONFIGURATION
FTP server configuration begins in the /etc/vsftpd/vsftpd.conf file, which contains the server settings.
Step 1 - Let's see the available configuration options for vsftpd:
[root@RHEL01 vsftpd]# grep -v ^# vsftpd vsftpd.conf
grep: vsftpd: No such file or directory
vsftpd.conf:anonymous_enable=YES
vsftpd.conf:local_enable=YES
vsftpd.conf:write_enable=YES
vsftpd.conf:local_umask=022
vsftpd.conf:dirmessage_enable=YES
vsftpd.conf:xferlog_enable=YES
vsftpd.conf:connect_from_port_20=YES
vsftpd.conf:xferlog_std_format=YES
vsftpd.conf:listen=YES
vsftpd.conf:
vsftpd.conf:pam_service_name=vsftpd
vsftpd.conf:userlist_enable=YES
vsftpd.conf:tcp_wrappers=YES
Step 2 - Let's see which options we will need
anonymous_enable=YES - to maintain better system security, it is worth changing this option to NO
local_enable=YES - Allows local users to log in
write_enable=YES - Allows users to write to directories
local_umask=022 - Sets the umask for all uploaded files
dirmessage_enable=YES - Displays directory information
xferlog_enables=YES - Logs all transfers in /var/log/xferlog
connect_from_port_20=YES - Forces connections on port 20
xferlog_std_format=YES - Logs everything in the standard transfer format
listen=YES - Allows the server to listen for connections
pam_service_name=vsftpd - Sets the service name
userlist_enables=YES - Enables the user_list lookup service
tcp_wrappers=YES - Allows incoming packets configured with TCP
userlist_deny=YES - Enables the user_list for FTP login
At this moment, the FTP server service is running, but due to the active firewall, it is not possible to log in to the service.
Regarding the configuration of the vsftpd configuration file, the content of the man page may be useful:
# man vsftpd.conf
When entering configuration parameters, be careful not to use any spaces.
FIREWALL AND SELINUX CONFIGURATION FOR FTP
Before we start using FTP capabilities, we must set the appropriate options in the iptables and SELinux services. Let's start by setting the appropriate firewall rules. FTP uses two communication ports, TCP 20 and 21, for which traffic must be opened.
Step 1 - Creating firewall rules
Let's use the iptables command to create new rules:
# iptables -I INPUT 5 -p tcp -m tcp --dport 20 -j ACCEPT
# iptables -I INPUT 5 -p tcp -m tcp --dport 21 -j ACCEPT
Changes can be viewed after issuing the command: # iptables --list
Step 2 - Saving settings
# service iptables save
iptables: Saving firewall rules to /etc/sysconfig/iptables:[OK]
Step 3 - Restarting the firewall service
[root@RHEL01 vsftpd]# service iptables restart
iptables: Flushing firewall rules: [ OK ]
iptables: Setting chains to policy ACCEPT: filter [ OK ]
iptables: Unloading modules: [ OK ]
iptables: Applying firewall rules: [ OK ]
The above can also be performed using the graphical tool:
# system-config-firewall-tui
Where, using the menu, you can open or close ports for various services.
Changes are saved in the file: # /etc/sysconfig/iptables
File content after changes:
# cat /etc/sysconfig/iptables
# Generated by iptables-save v1.4.7 on Thu May 10 11:24:33 2012
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [44:6156]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 21 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 20 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT
# Completed on Thu May 10 11:24:33 2012
File content after changes using the graphical tool:
# cat /etc/sysconfig/iptables
# Firewall configuration written by system-config-firewall
# Manual customization of this file is not recommended.
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 21 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT
After setting the firewall rules, we need to address the SELinux settings.
ftp_home_dir - Allows FTP to read and write files in user home directories
allow_ftpd_full_access - Allows the FTP server to log in local users and write/read all files on the system
allow_ftpd_use_nfs - Allows the FTP server to use NFS for public transfers
allow_ftpd_anon_write - Allows the FTP server to receive files from public services. The directory must have the public_content_rw_t label
ftpd_connect_db - Allows FTP connection to a MySQL server
allow_ftpd_use_cifs - Allows the use of CIFS
httpd_enabled_ftp_server - Allows access to the FTP server via the httpd protocol.
Step 1 - Query to check the values that need to be changed
[root@RHEL01 vsftpd]# getsebool -a | grep ftpd_full
allow_ftpd_full_access --> off
Step 2 - Disabling the SELinux restriction
setsebool -P allow_ftpd_full_access=1
Step 3 - Verifying the changes made
[root@RHEL01 vsftpd]# getsebool -a | grep ftpd_full
allow_ftpd_full_access --> on
It is done similarly, though slightly differently, for the RHEL05 version
Step 1 - Query to check the values to be changed
[root@station1 ~]# getsebool -a | grep ftpd_dis
ftpd_disable_trans --> off
tftpd_disable_trans --> off
Step 2 - Disabling the SELinux restriction
# setsebool -P ftpd_disable_trans=1
Step 3 - Verifying the changes made
[root@station1 ~]# getsebool -a | grep ftpd_dis
ftpd_disable_trans --> on
If necessary, you can also configure anonymous FTP access; to do this, ensure that the allow_ftpd_anon_write option has been set.
Comments