Pure-FTP on SLES OES2

I will be talking about PURE-FTP

Installation:

You can install pure-ftp using YAST ( interactive tool for software installation on SLES/OES2)

# rpm -qagrep ftp
pure-ftpd-1.0.20-24.13

Configuration:

Configuration files:

/etc/pure-ftpd/pure-ftpd.conf
/etc/ftpusers


Make sure that service is running and will startup on next reboot

#chkconfig --list grep ftp
pure-ftpd 0:off 1:off 2:off 3:on 4:off 5:on 6:off

pure-ftpd is the name of the deamon/service. If there were 'off' on runleve 3 and 5, you could run the command

#chkconfig pure-ftpd on


/etc/pure-ftpd/pure-ftpd.conf file is very clean and nicely described.

Some of the parameters are:
ChrootEveryone yes
TrustedGID 100

NoAnonymous yes
UnixAuthentication yes

NoRename yes
and many more


Make sure that, after making some changes on this file, you have to restart the service.

#service pure-ftpd restart



Additional Tips:

What should I do to give ftp user (say ftpuser) access to some different directory?

Ans: Say, ftpuser is chrooted to /home/ftpuser. So, he won't be able to access other than /home/ftpuser. Say, ftpuser need access to /tmp/backup. You can create a shortcut for /tmp/backup in /home/ftpuser. However, 'ln' command will not help in FTP. You will have to use 'mount --bind ' command

#mount --bind /tmp/backup /home/ftpuser/backup

You can go to /etc/bash.bashrc and add the above line to mount the drive automatically at every reboot.


Have a fun :)

Grant access to Anonymous user for FTP read/write operation

In SLES, anonymous user is chrooted to /srv/ftp directory
In CentOS and RedHat linux, anonymous user is chrooted to /var/ftp directory

(when I say chrooted, I mean that '/sr/ftp' acts like '/' for anonymous user. This prevents anonymous user to hack into the root structure of the ftp server)

Make some changes on vsftpd.conf so that anonymous user can do read/write operation.
However, before making any changes, make a backup copy of vsftpd.conf


Server01:/srv/ftp # diff /etc/vsftpd.conf /etc/vsftpd.conf.bak
+anon_upload_enable=YES
-#anon_upload_enable=YES
+ anon_mkdir_write_enable=YES
-#anon_mkdir_write_enable=YES
+ anon_other_write_enable=YES
-#anon_other_write_enable=YES
Now you have to grant "WRITE" access to "other" user in /srv/ftp directory

#chmod o+w /srv/ftp
After that, restart the ftp server

#service vsftpd restart



Try login into the ftp server as anonymous user and try to use 'get' and 'put' commands to download and upload files.

:)



However, above process may not fullfill your needs.
So, try something different

--> Create FTP user

#useradd -r -m ftpuser
#passwd ftpuser
(you can give any name u like)

--> Chroot the user to it's home directory. i.e /home/ftpuser will be root for the ftp user

Server01:~ # diff /etc/vsftpd.conf /etc/vsftpd.conf.backup+chroot_list_enable=YES
-#chroot_list_enable=YES
+chroot_list_file=/etc/vsftpd.chroot_list
- #chroot_list_file=/etc/vsftpd.chroot_list

--> Restart ftp server

#service vsftpd restart



Now, try to login in ftp server using username and password. You can upload and download flawlessly now. You can't break into the root structure of the server as you are in chroot jail of /home/[username]
Have a fun! :)


Today, one of my friend asked me, can we define /var/ftp rather than /srv/ftp as the root directory for the ftpuser in SLES?
Of course, yes. However, you have to hack in /etc/vsftpd.conf

FTPserver#vi /etc/vsftpd.conf
........
write_enable=YES
local_enable=YES
chroot_list_enable=YES
#anonymous_enable=YES
#anon_world_readable_only=YES
....
userlist_enable=YES
userlist_deny=NO
local_root=/var/ftp/
listen_address=[ftp server IP address]


#vi /etc/vsftpd.user_list
add the list of the allowed ftp users over here

#service vsftpd restart


That's it. Try it. ;D

How to setup VSFTP server in RHEL5?

VSFTP: Very Secure File Transfer Protocol


========SERVER=============

[root@ilinux ~]# rpm -qa|grep vsftpd
vsftpd-2.0.5-12.el5

[root@ilinux ~]# service vsftpd status
vsftpd is stopped

[root@ilinux ~]# service vsftpd start
Starting vsftpd for vsftpd: [ OK ]

[root@ilinux ~]# chkconfig --list vsftpd
vsftpd 0:off 1:off 2:off 3:off 4:off 5:off 6:off

[root@ilinux ~]# chkconfig --level 35 vsftpd on
[root@ilinux ~]# chkconfig --list vsftpd
vsftpd 0:off 1:off 2:off 3:on 4:off 5:on 6:off

[root@ilinux ~]# vi /etc/vsftpd/vsftpd.conf

By default, anonymous user can do ftp without password;
anonymous user is chrooted to /var/ftp as "/"
local users (linux users) can do ftp using password;
local users are not chrooted by default; i.e local users can access all the resources of the system using ftp

===========CLIENT SIDE================

#ftp IP-ADD of server
username: anonymous
password: password is not required
ftp>help
ftp>ls {it will show the content of the remote/server}
ftp>!ls {it will display the content of the local system}
ftp>pwd {it will show the PWD of the remote/server}
ftp>lcd {it will display the LOCAL working directory}

[notice: for anonymous user pwd will display "/" which is chrooted to /var/ftp]

#ftp IP-ADD of server
username: local user's username
password: password
ftp>........
...............
[notice: for local users by default pwd will be "/home/username" and local users can change the location on the remote server i.e he can go to /etc or any possible location and thus can theft the important data easily]

========================================
========================================

=========SERVER SIDE================
Q: How to create chroot jail for the local users?
A: For this we need to uncomment few lines shown below in /etc/vsftpd/vsftpd.conf

#vi /etc/vsftpd/vsftpd.conf
chroot_list_enable=YES
chroot_list_file=/etc/vsftpd/chroot_list

#vi /etc/vsftpd/chroot_list
[add the usernames to be chrooted to /home/username]

#service vsftpd restart

=============CLIENT SIDE==================

#ftp
username:
password:
ftp>........
...............

[now PWD will show "/" as user is chrooted to /home/username and local users cannot change the location outside /home/username as "/" for this user will be "/home/username"