ftp_server

HOW TO CONFIGURE VSFTPD WITH TLS/SSL ON RHEL/CENTOS 6.X AND HOW TO CONNECT SECURE VSFTPD(TLS/SSL) IN HETEROGENEOUS ENVIRONMENTS USING CLIENT PROGRAMS. (PART..A)

1:55 AM   SOMU

Traditional FTP is rather insecure. When you login, your username and password are transmitted in clear text, raising the possibility of your credentials being 'sniffed' by a malicious person. Fortunately there's an easy answer to this. You can quite easily configure your vsftpd server to use OpenSSL encryption, so that usernames & password, and even data files, are encrypted during transfer. It takes just a few simple steps: 

Vsftpd is already available under CentOS/RHEL  default repositories. We assume that CentOS/RHEL users have enabled default repositories in his system. Now execute following command. 

Note:- This post works with Security-Enhanced Linux (SELinux) is enabled  

Installing and Configuring the Vsftpd in RHEL/CentOS 6.x 

Step1:-  Install VsFTPd 

# yum install vsftpd 

Step2:-  Configure Basic VsFTPd Settings 

Now Edit Vsftpd configuration file /etc/vsftpd/vsftpd.conf in CentOS/RHEL and do the some basic settings like below. If you are configuring FTP for private users then we strictly advice to disable anonymous login. 

Before editing any configuration file please maintain a backup. Its good practice 

# cp -a /etc/vsftpd/vsftpd.conf_bkp /etc/vsftpd/vsftpd.conf 

1. Allow anonymous FTP? Set this value to NO to disable anonymous login. default value is YES 

anonymous_enable=NO  

2. Uncomment below line to allow local system users to log in via ftp 

local_enable=YES 

3. Uncomment below line to enable any form of FTP write command like, creating or uploading files and directory. 

write_enable=YES 

3. Uncomment below line to enable local system users to permit  their home directory only. 

chroot_local_user=YES 

Note : - While using chroot_local_user=YES  you must set user default shell as /sbin/nologin Otherwise ftp users can gain the access to ssh login 

Now start the vsftpd service  

# service vsftpd start 

To check the vsftpd service running or not 

# service vsftpd status 

To check the vsftpd service running port 

# netstat -nptelu | grep vsftpd 

Step3:-  First load the following module to make sure passive ftp connections are not rejected and also allow the port 

Open the following file /etc/sysconfig/iptables-config and change IPTABLES_MODULES=" " to IPTABLES_MODULES="ip_conntrack_ftp"  

Make sure ftp port is allowed in iptables. 

# iptables -L --line-number -n  

Now restart the iptables and vsftpd service  

# service iptables restart && service vsftpd restart  

Step4:- Create user and check the login 

# useradd -s /sbin/nologin test 

# passwd test 

Now use FileZilla client software to check. Because it will give exact issue if any problem 

I think SELinux will prevent while switching to the home directory. the error like below 

Image 



Now you have to allow the polices in selinux. 

# setsebool -P ftp_home_dir 1 

# setsebool -P allow_ftpd_full_access 1 

Till now we are done with basic vsftpd installation and configuration. Now we are going to configure TLS/SSL. 

Configuring the TLS/SSL  

Step5:-  Make sure openssl package is installed on machine. Here we are securing vsftpd by using self signed certificates 

Please follow the below steps for generating self signed certificates 

#openssl req -x509 -nodes -days 3650 -newkey rsa:2048 -keyout /etc/vsftpd/vsftpdkey.pem -out /etc/vsftpd/vsftpd.pem 

In "Common Name (eg, your name or your server's hostname)" part give proper domain name otherwise use wildcards Ex: *.google.com, *.xyz.com 

Then change the permissions to these certificate files 

# chmod 400 /etc/vsftpd/vsftpd.pem 

# chmod 400 /etc/vsftpd/vsftpdkey.pem 

Step6:- Securing the ftp can be done by two ways. 

1) Implicit SSL of vsftp (Port 990) 

2) Explicit TLS of vsftp (Port 21) 

1) Implicit SSL of vsftp (Port 990) 

In this method client must use SSL to connect using the port number 990. 

Follow the below configuration details. 



Open vsftpd file /etc/vsftpd/vsftpd.conf  add below lines in end of this file 



#ssl/tsl enable 

rsa_cert_file=/etc/vsftpd/vsftpd.pem 

rsa_private_key_file=/etc/vsftpd/vsftpdkey.pem 

ssl_enable=YES 

allow_anon_ssl=NO 

force_local_data_ssl=YES 

force_local_logins_ssl=YES 

ssl_tlsv1=YES 

ssl_sslv2=NO 

ssl_sslv3=NO 

require_ssl_reuse=NO 

ssl_ciphers=HIGH 

 #Implicit SSL Configuration 

implicit_ssl=YES 

listen_port=990 



# Pasive ftp enable (These ports are up to you ) 

pasv_min_port=2100 

pasv_max_port=2200 



# Ftp Loging 

xferlog_file=/var/log/vsftpd.log 

xferlog_enable=YES 

dirmessage_enable=YES 

xferlog_std_format=NO 

data_connection_timeout=600 

dual_log_enable=YES 

log_ftp_protocol=YES 

debug_ssl=YES 

Save and Exit the file 

#service vsftpd restart 

To check the vsftpd service running port 

# netstat -nptelu | grep vsftpd 



Note:- Allow the ports 2100 to 2200 in iptables (These ports are up to you ) 



2) Explicit TLS of vsftp (Port 21) 

In this method client can send the connection using default port only( Port 21). 

Follow the below configuration details. 

Open vsftpd file /etc/vsftpd/vsftpd.conf  add below lines in end of this file 

#ssl/tsl enable 

rsa_cert_file=/etc/vsftpd/vsftpd.pem 

rsa_private_key_file=/etc/vsftpd/vsftpdkey.pem 

ssl_enable=YES 

allow_anon_ssl=NO 

force_local_data_ssl=YES 

force_local_logins_ssl=YES 

ssl_tlsv1=YES 

ssl_sslv2=NO 

ssl_sslv3=NO 

require_ssl_reuse=NO 

ssl_ciphers=HIGH 



#Explicit TLS Configuration 

#implicit_ssl=YES 

#listen_port=990 



# Pasive ftp enable(These ports are up to you ) 

pasv_min_port=2100 

pasv_max_port=2200 



# Ftp Loging 

xferlog_file=/var/log/vsftpd.log 

xferlog_enable=YES 

dirmessage_enable=YES 

xferlog_std_format=NO 

data_connection_timeout=600 

dual_log_enable=YES 

log_ftp_protocol=YES 

debug_ssl=YES 

Save and Exit the file 

#service vsftpd restart 

To check the vsftpd service running port 

# netstat -nptelu | grep vsftpd 

Note:- Allow the ports 2100 to 2200 in iptables ( These ports are up to you ) 

Resources:
http://thelinuxmen.blogspot.com/2016/01/how-to-configure-vsftpd-with-tlsssl-on.html
http://gabrielmagana.com/2014/11/installing-ftp-server-vsftpd-on-an-amazon-ec2-ubuntu-14-04-host/
http://unix.stackexchange.com/questions/94603/limit-ftp-access-only-to-the-var-www-with-vsftpd