Hack The Sec-Leading Resource Of Linux Tutorial: ftp

<div dir="ltr" style="text-align: left;" trbidi="on">
<span style="background-color: white; color: #222222; font-family: Trebuchet, 'Trebuchet MS', Arial, Verdana, sans-serif; font-size: 16px; line-height: 30px;">FTP server is used to exchange files between computers over network . This guide helps you to setup ftp server on centos 7 . This guide contains configuration steps for both FTP and SFTP as well as user creation . Here i’ve used VSFTP package which is secure and less vulnerable .</span><br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh8sgDFsdT2-6ibob-V7LU1f1pGVI-HlDBDGWTeG4AaIfixz9vJlEUDp5vUVY9CZD_GXxp-3wN4OZwzjXq2jyJKXOOyXmkR-885QKJ349qlBMn07qZQ0sxAfb7pOvIDBiPkRy3HYq8S2k7R/s1600/Vsftpd-on-CentOS_ww.hackthesec.co.in.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="426" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh8sgDFsdT2-6ibob-V7LU1f1pGVI-HlDBDGWTeG4AaIfixz9vJlEUDp5vUVY9CZD_GXxp-3wN4OZwzjXq2jyJKXOOyXmkR-885QKJ349qlBMn07qZQ0sxAfb7pOvIDBiPkRy3HYq8S2k7R/s640/Vsftpd-on-CentOS_ww.hackthesec.co.in.png" width="640" /></a></div>
<br />
<span style="color: red;"><span style="background-color: white; font-family: Trebuchet, 'Trebuchet MS', Arial, Verdana, sans-serif; font-size: 16px; line-height: 30px;">1. </span>FTP Server<br style="background-color: white; font-family: Trebuchet, 'Trebuchet MS', Arial, Verdana, sans-serif; font-size: 16px; line-height: 30px;" /><span style="background-color: white; font-family: Trebuchet, 'Trebuchet MS', Arial, Verdana, sans-serif; font-size: 16px; line-height: 30px;">2. </span>SFTP Server<br style="background-color: white; font-family: Trebuchet, 'Trebuchet MS', Arial, Verdana, sans-serif; font-size: 16px; line-height: 30px;" /><span style="background-color: white; font-family: Trebuchet, 'Trebuchet MS', Arial, Verdana, sans-serif; font-size: 16px; line-height: 30px;">3. </span>User creation</span><br />
<br />
<div style="background-color: white; color: #222222; font-family: Trebuchet, 'Trebuchet MS', Arial, Verdana, sans-serif; font-size: 16px; line-height: 30px;">
</div>
<h1 style="background-color: white; clear: both; font-family: Trebuchet, 'Trebuchet MS', Arial, Verdana, sans-serif; font-size: 30px; font-weight: normal; height: auto; line-height: 31px; margin: 0px; padding: 0px; width: 614px;">
<span style="color: #0b5394;">Setup FTP server on centos 7</span><span style="color: #222222;"><a href="https://www.blogger.com/null" name="FTP"></a></span></h1>
<div>
<span style="color: #0b5394;"><br /></span></div>
<div style="background-color: white; font-family: Trebuchet, 'Trebuchet MS', Arial, Verdana, sans-serif; font-size: 16px; line-height: 30px;">
<strong style="color: #222222;">Step 1 :</strong><span style="color: #222222;"> Update your repository and install <b>VSFTPD </b>package .</span></div>
<div style="background-color: white; font-family: Trebuchet, 'Trebuchet MS', Arial, Verdana, sans-serif; font-size: 16px; line-height: 30px;">
<span style="color: #222222;"><br /></span><code style="background-color: #0e0e0e; border-radius: 5px; color: white; display: block; font-family: Verdana, 'MS Sans Serif', sans-serif, serif; font-size: 14px; line-height: 25px; padding: 4px;">[root@hackthesec ~]# yum check-update<br />[root@hackthesec ~]# yum -y install vsftpd</code><br /><strong style="color: #222222;">Step 2 </strong><strong style="color: #222222;">:</strong><span style="color: #222222;"> After installation you can find </span><strong><span style="color: red;">/etc/vsftpd/vsftpd.conf</span></strong><span style="color: #222222;"> file which is the main configuration file for VSFTP.</span><br /><span style="color: #222222;">Take a backup copy before making changes .</span></div>
<div style="background-color: white; font-family: Trebuchet, 'Trebuchet MS', Arial, Verdana, sans-serif; line-height: 30px;">
<br /><code style="background-color: #0e0e0e; border-radius: 5px; display: block; font-family: Verdana, 'MS Sans Serif', sans-serif, serif; font-size: 14px; line-height: 25px; padding: 4px;"><span style="color: white;">[root@hackthesec ~]# mv /etc/</span><span style="color: lime;">vsftpd</span><span style="color: white;">/vsftpd.conf /etc/vsftpd/vsftpd.conf.org</span></code></div>
<div style="background-color: white; color: #222222; font-family: Trebuchet, 'Trebuchet MS', Arial, Verdana, sans-serif; font-size: 16px; line-height: 30px;">
<br /></div>
<span style="color: #222222; font-size: large;">Now open the file and make changes as below</span><br />
<div style="background-color: white; font-family: Trebuchet, 'Trebuchet MS', Arial, Verdana, sans-serif; line-height: 30px;">
<br /><code style="background-color: #0e0e0e; border-radius: 5px; color: white; display: block; font-family: Verdana, 'MS Sans Serif', sans-serif, serif; font-size: 14px; line-height: 25px; padding: 4px;">[root@hackthesec ~]# nano /etc/vsftpd/vsftpd.conf</code></div>
<div style="background-color: white; color: #222222; font-family: Trebuchet, 'Trebuchet MS', Arial, Verdana, sans-serif; font-size: 16px; line-height: 30px;">
<br /></div>
<span style="font-size: large;"><span style="color: #222222;">Find this line </span><strong><span style="color: red;">anonymous_enable=YES</span></strong><span style="color: #222222;"> ( Line no : 12 ) and change value to NO to disable anonymous FTP access.</span></span><br />
<div style="background-color: white; color: #222222; font-family: Trebuchet, 'Trebuchet MS', Arial, Verdana, sans-serif; line-height: 30px;">
<br /><code style="background-color: #0e0e0e; border-radius: 5px; color: white; display: block; font-family: Verdana, 'MS Sans Serif', sans-serif, serif; font-size: 14px; line-height: 25px; padding: 4px;">anonymous_enable=NO</code></div>
<div style="background-color: white; color: #222222; font-family: Trebuchet, 'Trebuchet MS', Arial, Verdana, sans-serif; font-size: 16px; line-height: 30px;">
<br /></div>
<span style="font-size: large;">Uncomment the below line ( Line no : 100 ) to restrict users to their home directory.</span><br />
<div style="background-color: white; color: #222222; font-family: Trebuchet, 'Trebuchet MS', Arial, Verdana, sans-serif; line-height: 30px;">
<br /><code style="background-color: #0e0e0e; border-radius: 5px; color: white; display: block; font-family: Verdana, 'MS Sans Serif', sans-serif, serif; font-size: 14px; line-height: 25px; padding: 4px;">chroot_local_user=YES</code></div>
<div style="background-color: white; color: #222222; font-family: Trebuchet, 'Trebuchet MS', Arial, Verdana, sans-serif; font-size: 16px; line-height: 30px;">
<br /></div>
<span style="font-size: large;">and add the below lines at the end of the file to enable passive mode and allow chroot writable.</span><br />
<div style="background-color: white; color: #222222; font-family: Trebuchet, 'Trebuchet MS', Arial, Verdana, sans-serif; font-size: 16px; line-height: 30px;">
<br /><code style="background-color: #0e0e0e; border-radius: 5px; color: white; display: block; font-family: Verdana, 'MS Sans Serif', sans-serif, serif; font-size: 14px; line-height: 25px; padding: 4px;">allow_writeable_chroot=YES<br />pasv_enable=Yes<br />pasv_min_port=40000<br />pasv_max_port=40100</code><br /><strong>Step 3 </strong><strong>:</strong> Now restart vsftpd service and make it start automatically after reboot.</div>
<div style="background-color: white; font-family: Trebuchet, 'Trebuchet MS', Arial, Verdana, sans-serif; font-size: 16px; line-height: 30px;">
<br /><code style="background-color: #0e0e0e; border-radius: 5px; display: block; font-family: Verdana, 'MS Sans Serif', sans-serif, serif; font-size: 14px; line-height: 25px; padding: 4px;"><span style="color: white;">[root@hackthesec ~]# systemctl </span><span style="color: lime;">restart </span><span style="color: white;">vsftpd.service</span><br /><span style="color: white;">[root@hackthesec ~]# </span><span style="color: lime;">systemctl enable vsftpd.service</span></code><br /><strong style="color: #222222;">Step 4 </strong><strong style="color: #222222;">:</strong><span style="color: #222222;"> Add FTP service in firewall to allow ftp ports .</span></div>
<div style="background-color: white; font-family: Trebuchet, 'Trebuchet MS', Arial, Verdana, sans-serif; font-size: 16px; line-height: 30px;">
<br /><code style="background-color: #0e0e0e; border-radius: 5px; display: block; font-family: Verdana, 'MS Sans Serif', sans-serif, serif; font-size: 14px; line-height: 25px; padding: 4px;"><span style="color: white;">[root@hackthesec ~]# </span><span style="color: lime;">firewall-cmd --permanent --add-service=ftp</span><br /><span style="color: white;">[root@hackthesec ~]# firewall-cmd --reload</span></code><br /><strong style="color: #222222;">Step 5 </strong><strong style="color: #222222;">:</strong><span style="color: #222222;"> Setup SEinux to allow ftp access to the users home directories .</span></div>
<div style="background-color: white; font-family: Trebuchet, 'Trebuchet MS', Arial, Verdana, sans-serif; font-size: 16px; line-height: 30px;">
<br /><code style="background-color: #0e0e0e; border-radius: 5px; display: block; font-family: Verdana, 'MS Sans Serif', sans-serif, serif; font-size: 14px; line-height: 25px; padding: 4px;"><span style="color: white;">[root@hackthesec ~]# setsebool </span><span style="color: lime;">-P ftp_home_dir on</span></code><br /><strong style="color: #222222;">Step 6 </strong><strong style="color: #222222;">:</strong><span style="color: #222222;"> Now create an User for ftp access. Here</span><span style="color: red;"> <strong>/sbin/nologin</strong></span><span style="color: #222222;"> shell is used to prevent shell access to the server .</span></div>
<div style="background-color: white; font-family: Trebuchet, 'Trebuchet MS', Arial, Verdana, sans-serif; font-size: 16px; line-height: 30px;">
<br /><code style="background-color: #0e0e0e; border-radius: 5px; display: block; font-family: Verdana, 'MS Sans Serif', sans-serif, serif; font-size: 14px; line-height: 25px; padding: 4px;"><span style="color: white;">[root@hackthesec ~]# useradd </span><span style="color: lime;">-m dave -s /sbin/nologin</span><br /><span style="color: white;">[root@hackthesec ~]# passwd dave</span></code></div>
<div style="background-color: white; color: #222222; font-family: Trebuchet, 'Trebuchet MS', Arial, Verdana, sans-serif; font-size: 16px; line-height: 30px;">
<br /></div>
<span style="color: #222222;">Now user dave can able to login ftp on port 21 .</span><br />
<div style="background-color: white; color: #222222; font-family: Trebuchet, 'Trebuchet MS', Arial, Verdana, sans-serif; font-size: 16px; line-height: 30px;">
<br />You can <a href="https://filezilla-project.org/" rel="nofollow" style="color: #0f4884; text-decoration: none;" title="Filezilla">filezilla</a> or <a href="http://winscp.net/eng/download.php" rel="nofollow" style="color: #0f4884; text-decoration: none;" title="Winscp download">winscp</a> client for accessing files.</div>
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEim_29sfoA7aGhZnCZsbVJFWuHP5fVUNiuSkmcUEflO9L24ul4MAUHZVUz1N4AkGndvjVKwk3pYu_Swm-FxTbWQ6sWEuMB2DVrNaFiFVh0LOWgB2adtTOSTX4MT-3VjPWug705c2DaYnoZg/s1600/Setup-ftp-server-centos-7_www.hackthesec.co.in.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEim_29sfoA7aGhZnCZsbVJFWuHP5fVUNiuSkmcUEflO9L24ul4MAUHZVUz1N4AkGndvjVKwk3pYu_Swm-FxTbWQ6sWEuMB2DVrNaFiFVh0LOWgB2adtTOSTX4MT-3VjPWug705c2DaYnoZg/s1600/Setup-ftp-server-centos-7_www.hackthesec.co.in.png" /></a></div>
<div style="background-color: white; color: #222222; font-family: Trebuchet, 'Trebuchet MS', Arial, Verdana, sans-serif; font-size: 16px; line-height: 30px;">
<br /></div>
<h1 style="background-color: white; clear: both; font-family: Trebuchet, 'Trebuchet MS', Arial, Verdana, sans-serif; font-size: 30px; font-weight: normal; height: auto; line-height: 31px; margin: 0px; padding: 0px; width: 614px;">
<span style="color: #0b5394;">SFTP server</span><span style="color: #222222;"><a href="https://www.blogger.com/null" name="SFTP"></a></span></h1>
<div>
<br /></div>
<div style="background-color: white; font-family: Trebuchet, 'Trebuchet MS', Arial, Verdana, sans-serif; font-size: 16px; line-height: 30px;">
<span style="color: #222222;">SFTP ( Secure File Transfer Protocol ) is used to encrypt connections between clients and the FTP server. It is highly recommended to use SFTP because data is transferred over encrypted connection using SSH-tunnel on </span><span style="color: red;"><strong>port 22 </strong>.</span><br /><span style="color: #222222;">Basically we need openssh-server package to enable SFTP .</span><br /><span style="color: #222222;">Install openssh-server package, if its not already installed.</span></div>
<div style="background-color: white; font-family: Trebuchet, 'Trebuchet MS', Arial, Verdana, sans-serif; font-size: 16px; line-height: 30px;">
<br /><code style="background-color: #0e0e0e; border-radius: 5px; display: block; font-family: Verdana, 'MS Sans Serif', sans-serif, serif; font-size: 14px; line-height: 25px; padding: 4px;"><span style="color: white;">[root@hackthesec ~]# yum -y install </span><span style="color: lime;">openssh-server</span></code><br /><strong style="color: #222222;">Step 7 </strong><strong style="color: #222222;">:</strong><span style="color: #222222;"> Create a separate group for FTP access.</span></div>
<div style="background-color: white; font-family: Trebuchet, 'Trebuchet MS', Arial, Verdana, sans-serif; font-size: 16px; line-height: 30px;">
<br /><code style="background-color: #0e0e0e; border-radius: 5px; display: block; font-family: Verdana, 'MS Sans Serif', sans-serif, serif; font-size: 14px; line-height: 25px; padding: 4px;"><span style="color: white;">[root@hackthesec ~]# groupadd </span><span style="color: lime;">ftpaccess</span></code><br /><strong style="color: #222222;">Step 8 </strong><strong style="color: #222222;">:</strong><span style="color: #222222;"> Now open </span><strong><span style="color: red;">/etc/ssh/sshd_config</span></strong><span style="color: #222222;"> file and make changes as below.</span><br /><span style="color: #222222;">Find and comment the below line ( Line no : 147 ).</span></div>
<div style="background-color: white; font-family: Trebuchet, 'Trebuchet MS', Arial, Verdana, sans-serif; font-size: 16px; line-height: 30px;">
<br /><code style="background-color: #0e0e0e; border-radius: 5px; display: block; font-family: Verdana, 'MS Sans Serif', sans-serif, serif; font-size: 14px; line-height: 25px; padding: 4px;"><span style="color: white;">#Subsystem sftp /usr/libexec/openssh/</span><span style="color: lime;">sftp-server</span></code></div>
<div style="background-color: white; color: #222222; font-family: Trebuchet, 'Trebuchet MS', Arial, Verdana, sans-serif; font-size: 16px; line-height: 30px;">
<br /></div>
<span style="color: #222222;">and add these lines below.</span><br />
<div style="background-color: white; font-family: Trebuchet, 'Trebuchet MS', Arial, Verdana, sans-serif; font-size: 16px; line-height: 30px;">
<br /><code style="background-color: #0e0e0e; border-radius: 5px; display: block; font-family: Verdana, 'MS Sans Serif', sans-serif, serif; font-size: 14px; line-height: 25px; padding: 4px;"><span style="color: white;">Subsystem sftp internal-sftp</span><br /><span style="color: lime;">Match group ftpaccess</span><span style="color: white;">ChrootDirectory %h</span><br /><span style="color: white;">X11Forwarding no</span><br /><span style="color: lime;">AllowTcpForwarding no</span><span style="color: white;">ForceCommand internal-sftp</span></code><br /><strong style="color: #222222;">Step 9 </strong><strong style="color: #222222;">:</strong><span style="color: #222222;"> Now restart sshd service.</span></div>
<div style="background-color: white; font-family: Trebuchet, 'Trebuchet MS', Arial, Verdana, sans-serif; font-size: 16px; line-height: 30px;">
<br /><code style="background-color: #0e0e0e; border-radius: 5px; display: block; font-family: Verdana, 'MS Sans Serif', sans-serif, serif; font-size: 14px; line-height: 25px; padding: 4px;"><span style="color: white;">[root@hackthesec ~]# </span><span style="color: lime;">systemctl restart sshd</span></code><span style="color: #222222;">Now your SFTP server is configured and ready .</span></div>
<div style="background-color: white; color: #222222; font-family: Trebuchet, 'Trebuchet MS', Arial, Verdana, sans-serif; font-size: 16px; line-height: 30px;">
<br /></div>
<h1 style="background-color: white; clear: both; font-family: Trebuchet, 'Trebuchet MS', Arial, Verdana, sans-serif; font-size: 30px; font-weight: normal; height: auto; line-height: 31px; margin: 0px; padding: 0px; width: 614px;">
<span style="color: #0b5394;">User creation</span><span style="color: #222222;"><a href="https://www.blogger.com/null" name="user"></a></span></h1>
<div style="background-color: white; color: #222222; font-family: Trebuchet, 'Trebuchet MS', Arial, Verdana, sans-serif; font-size: 16px; line-height: 30px;">
<strong>Step 10 </strong><strong>:</strong> Create user jack with /sbin/nologin shell and ftpaccess group</div>
<div style="background-color: white; font-family: Trebuchet, 'Trebuchet MS', Arial, Verdana, sans-serif; font-size: 16px; line-height: 30px;">
<br /><code style="background-color: #0e0e0e; border-radius: 5px; display: block; font-family: Verdana, 'MS Sans Serif', sans-serif, serif; font-size: 14px; line-height: 25px; padding: 4px;"><span style="color: white;">[root@hackthesec ~]# </span><span style="color: lime;">useradd -m jack -s /sbin/nologin -g ftpaccess</span><br /><span style="color: white;">[root@hackthesec ~]# passwd jack</span></code></div>
<div style="background-color: white; color: #222222; font-family: Trebuchet, 'Trebuchet MS', Arial, Verdana, sans-serif; font-size: 16px; line-height: 30px;">
<br /></div>
<span style="color: #222222;">Now assign root ownership for the home directory for chroot access and modify permission.</span><br />
<div style="background-color: white; font-family: Trebuchet, 'Trebuchet MS', Arial, Verdana, sans-serif; font-size: 16px; line-height: 30px;">
<br /><code style="background-color: #0e0e0e; border-radius: 5px; display: block; font-family: Verdana, 'MS Sans Serif', sans-serif, serif; font-size: 14px; line-height: 25px; padding: 4px;"><span style="color: white;">[root@hackthesec ~]# chown root /home/jack<br />[root@hackthesec ~]# </span><span style="color: lime;">chmod 750 /home/jack</span></code></div>
<div style="background-color: white; color: #222222; font-family: Trebuchet, 'Trebuchet MS', Arial, Verdana, sans-serif; font-size: 16px; line-height: 30px;">
<br /></div>
<span style="color: #222222;">Create a directory </span><strong style="color: #222222;">www</strong><span style="color: #222222;"> inside home directory for writing and modify ownership .</span><br />
<div style="background-color: white; font-family: Trebuchet, 'Trebuchet MS', Arial, Verdana, sans-serif; font-size: 16px; line-height: 30px;">
<br /><code style="background-color: #0e0e0e; border-radius: 5px; display: block; font-family: Verdana, 'MS Sans Serif', sans-serif, serif; font-size: 14px; line-height: 25px; padding: 4px;"><span style="color: white;">[root@hackthesec ~]# mkdir /home/jack/www<br />[root@hackthesec ~]# chown </span><span style="color: lime;">jack:ftpaccess /home/jack/www</span></code><br /><span style="color: #222222;">Now jack can use both ftp and sftp services . He can upload files in </span><span style="color: red;"><strong>www</strong> </span><span style="color: #222222;">directory .</span></div>
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiqHadkjAgVk5SyUs3LkT37VDuWg1jmvuRj9h1ee1OivV7ZoVu6s_SibJocd30oQOJyyRznJ7LqOjjVUZrZHN3LAnxW3bbnDDRFJQ6psEUrkBdeqhOdZg8rueGorzRl8ZiuGim4g-ZSjvey/s1600/Setup-ftp-server-centos-7-1_www.hackthesec.co.in.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiqHadkjAgVk5SyUs3LkT37VDuWg1jmvuRj9h1ee1OivV7ZoVu6s_SibJocd30oQOJyyRznJ7LqOjjVUZrZHN3LAnxW3bbnDDRFJQ6psEUrkBdeqhOdZg8rueGorzRl8ZiuGim4g-ZSjvey/s1600/Setup-ftp-server-centos-7-1_www.hackthesec.co.in.png" /></a></div>
<div style="background-color: white; color: #222222; font-family: Trebuchet, 'Trebuchet MS', Arial, Verdana, sans-serif; font-size: 16px; line-height: 30px;">
If you are going to use FTP and SFTP together in the same server, you should follow above steps while creating users . For existing users add them to ftpaccess and make below changes.</div>
<div style="background-color: white; font-family: Trebuchet, 'Trebuchet MS', Arial, Verdana, sans-serif; font-size: 16px; line-height: 30px;">
<br /><code style="background-color: #0e0e0e; border-radius: 5px; display: block; font-family: Verdana, 'MS Sans Serif', sans-serif, serif; font-size: 14px; line-height: 25px; padding: 4px;"><span style="color: white;">[root@hackthesec ~]# usermod </span><span style="color: lime;">dave -g ftpaccess</span><br /><span style="color: white;">[root@hackthesec ~]# chown root /home/dave</span><br /><span style="color: white;">[root@hackthesec ~]# chmod </span><span style="color: lime;">750 /home/dave</span><br /><span style="color: white;">[root@hackthesec ~]# mkdir /home/dave/www</span><br /><span style="color: white;">[root@hackthesec ~]# </span><span style="color: lime;">chown dave:ftpaccess /home/dave/www</span></code><code style="background-color: #0e0e0e; border-radius: 5px; display: block; font-family: Verdana, 'MS Sans Serif', sans-serif, serif; font-size: 14px; line-height: 25px; padding: 4px;"><span style="color: lime;"><br /></span></code><code style="background-color: #0e0e0e; border-radius: 5px; display: block; font-family: Verdana, 'MS Sans Serif', sans-serif, serif; font-size: 14px; line-height: 25px; padding: 4px;"><span style="color: lime;"><a href="http://www.hackthesec.co.in/">Hack The Security</a><br /><a href="https://www.twitter.com/hackthesecurity">Hack The Security Twitter</a><br /><a href="http://facebook.com/htsecu">Hack The Security Facebook</a></span></code></div>
</div>