Linux praktikum 2

Installing FTP server vsftpd

Goal: to provide users with secure FTPS access with limited visibility of their home directory only, while ssh access is not available to users.

FTP operates on a client/server model. The server component is called the FTP service. It constantly listens for FTP requests from remote clients.
When a request is received, it manages entry and connection establishment. During the session, it executes any commands sent by the FTP client.

Install vsftpd:
sudo apt-get install vsftpd

To start the service at OS startup, enter:
sudo systemctl start vsftpd
sudo systemctl enable vsftpd

Ubuntu Server can use the ufw firewall. Then you will need to allow ports 20 and 21:
sudo ufw allow 20/tcp
sudo ufw allow 21/tcp

The configuration file /etc/vsftpd.conf contains many configuration options. You can open this file with:
sudo nano /etc/vsftpd.conf

Information on each parameter is available in the same file.

Alternatively, you can look at the system manual for the command:
man 5 vsftpd.conf

Access to the FTP server can be organized in two ways:

• Anonymous
• Authorized (Authenticated)

In anonymous mode, a remote client can access the FTP server using the default user account named "anonymous" or "FTP" and passing in an email address as a password.
In authorized mode, the user must have an account name and password.

User access to FTP server directories and files depends on the access rights of the user-specified during login.
As a rule, the FTP service hides the root directory of the FTP server, replacing it with the FTP home directory. This hides the root filesystem from remote sessions.

Add FTP user
sudo adduser ftpuser

Configuring Anonymous FTP Access

anonymous_enable=YES

The installation process creates an FTP user with a home directory of /srv/ftp.
This is the default directory for FTP. If you wish to change its location to, for example, /srv/files/ftp, simply create a new directory and change the home directory of the FTP user:
sudo mkdir /srv/files/ftp

Change ftp user home directory:
sudo usermod -d /srv/files/ftp ftp
Create a pub directory
sudo mkdir /srv/files/ftp/pub

Change the owner of the directory to be able to write files there:
chown ftp:ftp /srv/files/ftp/pub

Restart vsftpd after changes:
sudo systemctl restart vsftpd

Before making any changes to the configuration file, it is recommended to copy the sample so that you can roll back the changes without reinstalling the package:
sudo cp /etc/vsftpd.conf /etc/vsftpd.conf.orig

By default, an anonymous user is not allowed to upload files to the FTP server.
To change this setting, uncomment the following line and restart vsftpd:

anon_upload_enable=YES

Configuring Authorized FTP Access

To authenticate local users, uncomment the line

local_enable=YES
By default, vsftpd is configured to authenticate system users with the ability to receive files. If you want to allow users to upload files, change /etc/vsftpd.conf to:
write_enable=YES
Restart vsftpd after changes:
sudo systemctl restart vsftpd
Now, when system users log in via FTP, they will go to their home directories, where they can download, upload files, create directories, etc.

FTP Security

There are options in /etc/vsftpd.conf to help make vsftpd more secure. For example, users can be restricted to their home directories by uncommenting:
chroot_local_user=YES

If you need to allow writing to home directories in the chroot, then uncomment:
allow_writeable_chroot=YES

After uncommenting these options, create /etc/vsftpd.chroot_list containing a list of users, one per line. Then restart vsftpd:
sudo systemctl restart vsftpd

Similarly, the /etc/ftpusers file contains a list of users who are denied FTP access. By default, it includes root, daemon, nobody, etc.
To disable FTP access for additional users, simply add them to this list.

Encryption

To configure FTPS, add the following to the end of the /etc/vsftpd.conf file:
ssl_enable=YES
sudo systemctl restart vsftpd

To allow /usr/sbin/nologin shell users to access FTP, but not grant shell access, edit /etc/shells to add the line
/usr/sbin/nologin

You also need to replace the shell user with /usr/sbin/nologin
chsh kasutaja

And enter /usr/sbin/nologin in the input field

Try connecting via FTP using a secure SSL connection. You can only see your home directory, no others should be visible to you!


Source: https://ubuntu.com/server/docs/service-ftp