Complete configuration of VSFTPD server with access control implementation

Complete configuration of VSFTPD server with access control implementation: Centos/Redhat

VSFTPD stand for Very Secure FTP Daemon is frequently used FTP server under the linux distribution which is fast, secure , stable and many more features comparatively to other FTP servers.

Features of VSFTPD:

Anonymous and user based login FTP sessions.
Virtual IP configurations
Virtual users
Standalone or inetd operation
Powerful per-user configurability
Bandwidth throttling
Per-source-IP configurability
Per-source-IP limits
Support IPv6
Encryption support through SSL integration
vsftpd dose not permit ‘root’ and ‘service accounts’ access By default.

Lets begin installation and configuration of vsftpd server:

Install Vsftpd FTP Server:

Install vsftpd package from yum command:

# yum install vsftpd -y

Vsftpd use 21(command port) and 20(data port) network ports by default. The main configuration file of Vsftpd is located at /etc/vsftpd/vsftpd.conf

configure Vsftpd configuration file:

In the configuration file of vsftpd many options, according the requirement we make changes in it. Let’s understand the Boolean, numeric and string options of the configuration file. Vsftpd configuration file is very simple each line either a comment line which is start by # or a directive line which has the format option=value.
NOTE: If we put any space between the option, = and value it is an error.

open configuration file just type:

# vim /etc/vsftpd/vsftpd.conf

Turn off standard ftpd xferlog log format:
xferlog_std_format=NO
Turn on log_ftp_protocol vsftpd log format if xferlog_std_format is not enabled, by default all FTP requests and responses are logged vsftpd log file /var/log/vsftpd.log.
log_ftp_protocol=YES
If chroot_local_user set to YES, local users will be (by default) placed in a chroot() jail in their home directory after login.
chroot_local_user=YES
lock down vsftpd to a predictable port range. (By default, vsftpd runs in passive mode and will choose a port between 1024-65535). Add the following(Don’t forget to open that port range in your firewall):
pasv_min_port=3000
pasv_max_port=3050

Create alert banners for all FTP users:
banner_file=/etc/vsftpd/issue
Create /etc/vsftpd/issue file with a message :
NOTICE TO USERS
*** company legal notice or security policies notice ******

Enabled ‘vsftpd’ in multi-user run-levels:

To enable the vsftpd runs at boot and multiple user run below mention command:

# chkconfig vsftpd on
# chkconfig –list vsftpd

chkconfig –list vsftpd command Verify the “on” status in different runlevels by checking the complete chkconfig output.

Configure Firewalls to Protect the FTP Server:

Open file /etc/sysconfig/iptables

# vi /etc/sysconfig/iptables

Add the following lines

iptables -I RH-Firewall-1-INPUT 1 -p tcp –dport 3000:3050 -j ACCEPT
iptables -I RH-Firewall-1-INPUT -m tcp -p tcp –dport 21 -j ACCEPT

Save and close the file. Restart firewall:

# service iptables restart

Implement the access Control:

We can implement the access control from two way:

User based access control.
Ip based access control.

Lets talk about the user based access control:

Its very simple and easiest way to denind the particular user to access the ftp server. open the ftpusers file which is located at /etc/vsftpd/ftpusers and make that user entry in it.By default, this list includes the root, bin, and daemon users, among others.

Ip based access control:

Ip based access control is implemented by the TCP wrappers is done with ‘/etc/hosts.allow’ and ‘/etc/hosts.deny’. In both file hosts.allow priority is higher then hosts.deny.

Some example below to understand the how to use the TCP wrapper:

[root@Server ~]# vi /etc/hosts.deny
vsftpd: ALL
[root@Server ~]# vi /etc/hosts.allow
vsftpd: 10.0.0.0
In above example allow to access vsftpd only from 10.0.0.0

Some tips :

View VsFtpd log file:

Run following command:

# tail -f /var/log/vsftpd.log

Monitor VsFtpd clients:

Run command mention below:

watch ps -C vsftpd -o user,pid,stime,cmd

Please make sure before run the command, Open configuration file then check option checksetproctitle_enable=YES is enabled if not enabled then enable it and restart the vsftpd service.

To change the by default path of FTP to directory other directory:

Type the following in /etc/vsftpd.conf file:

anon_root=/some/directory/of/your/choice/
e.g.
anon_root=/var/ftp/
and set up propper permissions for that directory and its subdiretories.

Friday, November 8, 2013