1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23

sudo vim /etc/vsftpd.conf
# line 19: change
write_enable=YES
# line 53: uncomment (Allow local users to log into FTP if they are on the user list)
local_enable=YES
# line 62: uncomment (enable chroot)
chroot_local_user=NO
# line 80: change (no anonymous)
anonymous_enable=NO
# line 184: change as needed (if vsftpd should listen to connections only using IPv4 protocol)
listen=YES
# line 189: change as needed (if vsftpd should listen to connections also using IPv6 protocol)
listen_ipv6=NO
# line 217: uncomment (disable seccomp filter)
seccomp_sandbox=NO

# add at the end of the file

# use local time
use_localtime=YES

# restrict FTP users to their home directory and allow them to write files only there
allow_writeable_chroot=YES

1
2
3
4
5
6

sudo vim /etc/vsftpd.conf
# change ports 30000 and 31000 to those below
# add PASV ports to enable FTP access using PASV
pasv_enable=YES
pasv_min_port=21000
pasv_max_port=21010

1
2
3
4
5

sudo useradd -d /srv/www/ftp1 ftp1
sudo passwd ftp1

sudo useradd -d /srv/www/ftp2 ftp2
sudo passwd ftp2

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16

sudo vim /etc/vsftpd.conf

# Enable user list
userlist_enable=YES

# Configure the user list to act as a whitelist (only allow users who are listed there)
userlist_deny=NO

# User list file
userlist_file=/etc/vsftpd.userlist
 
# Allow virtual users to use the same privileges as local users
virtual_use_local_privs=YES
 
# Set configuration directory for virtual users
user_config_dir=/etc/vsftpd_user_config_dir/

1
2
3
4
5

sudo vim /etc/vsftpd.userlist

# add the following users
ftp1
ftp2

1
2
3

mkdir -p /etc/vsftpd_user_config_dir/
touch /etc/vsftpd_user_config_dir/ftp1
touch /etc/vsftpd_user_config_dir/ftp2

1
2
3

sudo vim /etc/vsftpd_user_config_dir/ftp1
local_root=/srv/www/ftp1
write_enable=YES

1
2
3

sudo vim /etc/vsftpd_user_config_dir/ftp2
local_root=/srv/www/ftp2
write_enable=YES

1

sudo mkdir -p /srv/www/{ftp1,ftp2}

1
2

sudo chown -R ftp1:users /srv/www/ftp1
sudo chown -R ftp2:users /srv/www/ftp2

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238

# Example config file /etc/vsftpd.conf
#
# The default compiled in settings are fairly paranoid. This sample file
# loosens things up a bit, to make the ftp daemon more usable.
# Please see vsftpd.conf.5 for all compiled in defaults.
#
# If you do not change anything here you will have a minimum setup for an
# anonymus FTP server.
#
# READ THIS: This example file is NOT an exhaustive list of vsftpd options.
# Please read the vsftpd.conf.5 manual page to get a full idea of vsftpd's
# capabilities.
#
# ################
# General Settings
# ################
#
# Uncomment this to enable any form of FTP write command.
write_enable=YES
#
# Activate directory messages - messages given to remote users when they
# go into a certain directory.
dirmessage_enable=YES
#
# It is recommended that you define on your system a unique user which the
# ftp server can use as a totally isolated and unprivileged user.
#nopriv_user=ftpsecure
#
# You may fully customise the login banner string:
#ftpd_banner=Welcome to blah FTP service.
#
# You may activate the "-R" option to the builtin ls. This is disabled by
# default to avoid remote users being able to cause excessive I/O on large
# sites. However, some broken FTP clients such as "ncftp" and "mirror" assume
# the presence of the "-R" option, so there is a strong case for enabling it.
#ls_recurse_enable=YES
#
# You may specify a file of disallowed anonymous e-mail addresses. Apparently
# useful for combatting certain DoS attacks.
#deny_email_enable=YES
# (default follows)
#banned_email_file=/etc/vsftpd.banned_emails
#
# If  enabled,  all  user  and  group  information in
# directory listings will be displayed as "ftp".
#hide_ids=YES
#
# #######################
# Local FTP user Settings
# #######################
#
# Uncomment this to allow local users to log in.
local_enable=YES
#
# Default umask for local users is 077. You may wish to change this to 022,
# if your users expect that (022 is used by most other ftpd's)
#local_umask=022
#
# You may specify an explicit list of local users to chroot() to their home
# directory. If chroot_local_user is YES, then this list becomes a list of
# users to NOT chroot().
chroot_local_user=NO
#chroot_list_enable=YES
# (default follows)
#chroot_list_file=/etc/vsftpd.chroot_list
#
# Performs chroot with original (non-root) credentials. This is usefull on nfs with squash_root,
# where root becomes nobody and would need -x access.
#allow_root_squashed_chroot=YES
#
# The maximum data transfer rate permitted, in bytes per second, for
# local authenticated users. The default is 0 (unlimited).
#local_max_rate=7200
#
# ##########################
# Anonymus FTP user Settings
# ##########################
#
# Allow anonymous FTP? (Beware - allowed by default if you comment this out).
anonymous_enable=NO
#
# The maximum data transfer rate permitted, in bytes per second, for anonymous
# authenticated users. The default is 0 (unlimited).
#anon_max_rate=7200
#
# Anonymous users will only be allowed to download files which are
# world readable.
anon_world_readable_only=YES
#
# Default umask for anonymus users is 077. You may wish to change this to 022,
# if your users expect that (022 is used by most other ftpd's)
#anon_umask=022
#
# Uncomment this to allow the anonymous FTP user to upload files. This only
# has an effect if the above global write enable is activated. Also, you will
# obviously need to create a directory writable by the FTP user.
#anon_upload_enable=YES
#
# Uncomment this if you want the anonymous FTP user to be able to create
# new directories.
#anon_mkdir_write_enable=YES
#
# Uncomment this to enable anonymus FTP users to perform other write operations
# like deletion and renaming.
#anon_other_write_enable=YES
#
# If you want, you can arrange for uploaded anonymous files to be owned by
# a different user. Note! Using "root" for uploaded files is not
# recommended!
#chown_uploads=YES
#chown_username=whoever
#
# ############
# Log Settings
# ############
#
# Log to the syslog daemon instead of using an logfile.
syslog_enable=NO
#
# Uncomment this to log all FTP requests and responses.
log_ftp_protocol=YES
#
# Activate logging of uploads/downloads.
xferlog_enable=YES
#
# You may override where the log file goes if you like. The default is shown
# below.
#
vsftpd_log_file=/var/log/vsftpd.log
#
# If you want, you can have your log file in standard ftpd xferlog format.
# Note that the default log file location is /var/log/xferlog in this case.
xferlog_std_format=YES
#
# You may override where the log file goes if you like. The default is shown
# below.
xferlog_file=/var/log/vsftpd.log
#
# Enable this to have booth logfiles. Standard xferlog and vsftpd's own style log.
dual_log_enable=YES
#
# Uncomment this to enable session status information in the system process listing.
setproctitle_enable=YES
#
# #################
# Transfer Settings
# #################
#
# Make sure PORT transfer connections originate from port 20 (ftp-data).
connect_from_port_20=YES
#
# You may change the default value for timing out an idle session.
#idle_session_timeout=600
#
# You may change the default value for timing out a data connection.
#data_connection_timeout=120
#
# Enable this and the server will recognise asynchronous ABOR requests. Not
# recommended for security (the code is non-trivial). Not enabling it,
# however, may confuse older FTP clients.
#async_abor_enable=YES
#
# By default the server will pretend to allow ASCII mode but in fact ignore
# the request. Turn on the below options to have the server actually do ASCII
# mangling on files when in ASCII mode.
# Beware that on some FTP servers, ASCII support allows a denial of service
# attack (DoS) via the command "SIZE /big/file" in ASCII mode. vsftpd
# predicted this attack and has always been safe, reporting the size of the
# raw file.
# ASCII mangling is a horrible feature of the protocol.
#ascii_upload_enable=YES
#ascii_download_enable=YES
#
# Set to NO if you want to disallow the  PASV  method of obtaining a data
# connection.
pasv_enable=YES
#
# PAM setting. Do NOT change this unless you know what you do!
pam_service_name=vsftpd
#
# When "listen" directive is enabled, vsftpd runs in standalone mode and
# listens on IPv4 sockets. This directive cannot be used in conjunction
# with the listen_ipv6 directive.
listen=YES
#
# This directive enables listening on IPv6 sockets. To listen on IPv4 and IPv6
# sockets, you must run two copies of vsftpd with two configuration files.
# Make sure, that one of the listen options is commented !!
listen_ipv6=NO
#
# Set "ssl_enable=YES" to enable SSL support and configure the location of
# your local certificate (RSA, DSA, or both). Note that vsftpd won't start
# if either of the "xxx_cert_file" options sets a path that doesn't exist.
ssl_enable=NO
rsa_cert_file=
dsa_cert_file=
#
# Limit passive ports to this range to assis firewalling
pasv_min_port=21000
pasv_max_port=21010

### security features that are incompatible with some other settings. ###

# isolate_network ensures the vsftpd subprocess is started in own network
# namespace (see CLONE_NEWNET in clone(2)). It however disables the
# authentication methods needs the network access (LDAP, NIS, ...).
#isolate_network=NO

# seccomp_sanbox add an aditional security layer limiting the number of a
# syscalls can be performed via vsftpd. However it might happen that a
# whitelist don't allow a legitimate call (usually indirectly triggered by
# third-party library like pam, or openssl) and the process is being killed by kernel.
#
# Therefor if your server dies on common situations (file download, upload),
# uncomment following line and don't forget to open  bug at
# https://bugzilla.novell.com
seccomp_sandbox=NO

# use local time
use_localtime=YES

# Enable the userlist
userlist_enable=YES

# Configure the userlist to act as a whitelist (only allow users who are listed there)
userlist_deny=NO

# Userlist file
userlist_file=/etc/vsftpd.userlist

# Allow virtual users to use the same privileges as local users
virtual_use_local_privs=YES

# Setup the virtual users config folder
user_config_dir=/etc/vsftpd_user_config_dir/

#restrict FTP users to their /home directory and allow them to write there
allow_writeable_chroot=YES