INFORMATICS

Installing vsftpd on CentOS 8

# dnf install -y vsftpd

Take backup of existing vsftpd.conf file.

# cp /etc/vsftpd/vsftpd.conf /etc/vsftpd/vsftpd.conf.org

Edit vsftpd configuration file.

# vi /etc/vsftpd/vsftpd.conf

Open FTP port 21 on the system firewall to allow access to FTP services from external systems.

# firewall-cmd --zone=public --permanent --add-port=20-21/tcp

# firewall-cmd --permanent --add-port=30000-31000/tcp

or # firewall-cmd --add-service=ftp --permanent
# firewall-cmd --reload

Set the following parameters with these corresponding values

anonymous_enable=NO  # line 12: make sure value is [NO] (no anonymous)           
local_enable=YES 		
write_enable=YES		
local_umask=022		        
dirmessage_enable=YES	        
xferlog_enable=YES		
connect_from_port_20=YES        
xferlog_std_format=YES          
listen=NO  # line 115: change (if listening IPv4 only) 	if listning IPv4 and IPv6 both, specify [NO]		
listen_ipv6=YES		        
pam_service_name=vsftpd 
use_localtime=YES     

Configure User List in Secure FTP Server:

Users that are allowed/deny to use FTP service are listed in a user_list file.

Default user_list file is located at /etc/vsftpd/user_list, we can add or remove FTP users in this file.

By default, all the users in the user_list are denied to access FTP service.

We have to explicitly allow users in user_list by setting following directives in vsftpd.conf file.

userlist_enable=YES # enable vsftpd to load usernames
userlist_deny=NO # allow access to users in userlist

Enable Chroot Jail for Secure FTP Server on CentOS 8:
To restrict FTP users in a chrooted environment, add following two directives in vsftpd.conf file.

chroot_local_user=YES # Create chrooted environment for users
allow_writeable_chroot=YES # Allow write permission to user on chroot jail directory

For security, you can also enable TLS encryption

 Create a CentOS 8 User to access Secure FTP Service:
# useradd new_user
# passwd new_user

Add this user to allowed user_list.

# echo ahmer >> /etc/vsftpd/user_list