Veilige FTP toegang met vsftpd

Installatie van vsftpd

Installeer vsftpd onder SlugOS met:

$ opkg install vsftpd

Of onder Ubuntu/Debian:

$ apt-get install vsftpd

Configuratie van vsftpd

$ vi /etc/vsftpd.conf

# Example config file /etc/vsftpd.conf  
#  
# The default compiled in settings are fairly paranoid. This sample file  
# loosens things up a bit, to make the ftp daemon more usable.  
# Please see vsftpd.conf.5 for all compiled in defaults.  
#  
# READ THIS: This example file is NOT an exhaustive list of vsftpd options.  
# Please read the vsftpd.conf.5 manual page to get a full idea of vsftpd's  
# capabilities.  

# run standalone  
listen=YES  

# Allow anonymous FTP? (Beware - allowed by default if you comment this out).  
anonymous_enable=NO  

#  
# Uncomment this to allow local users to log in.  
local_enable=YES  

#  
# Uncomment this to enable any form of FTP write command.  
# write_enable=YES  
#  
# Default umask for local users is 077. You may wish to change this to 022,  
# if your users expect that (022 is used by most other ftpd's)  
#local_umask=022  
#  
# Activate directory messages - messages given to remote users when they  
# go into a certain directory.  
dirmessage_enable=YES  
#  
# Activate logging of uploads/downloads.  
xferlog_enable=YES  
#  
# Make sure PORT transfer connections originate from port 20 (ftp-data).  
connect_from_port_20=YES  
#  
# If you want, you can arrange for uploaded anonymous files to be owned by  
# a different user. Note! Using "root" for uploaded files is not  
# recommended!  
chown_uploads=YES  
chown_username=arjan  
#  
# You may override where the log file goes if you like. The default is shown below.  
#xferlog_file=/var/log/vsftpd.log  
#  
# You may change the default value for timing out an idle session.  
#idle_session_timeout=600  
# You may change the default value for timing out a data connection.  
#data_connection_timeout=120  
#  
# It is recommended that you define on your system a unique user which the  
# ftp server can use as a totally isolated and unprivileged user.  
#nopriv_user=ftpsecure  
#  
ftpd_banner=Welcome to FTP  
#  
# You may specify an explicit list of local users to chroot() to their home  
# directory. If chroot_local_user is YES, then this list becomes a list of  
# users to NOT chroot().  
# chroot_list_enable=YES  
# (default follows)  
chroot_list_file=/etc/vsftpd.chroot_list

Zet alle users in de file /etc/vsftpd.chroot_list, welke buiten de HOME directory mogen gaan:

$ vi /etc/vsftpd.chroot_list
arjan_ftproot  

root-> alleen als de ftp poort niet via internet te bereiken is, anders root weghalen

Opmerking:

• Zorg ervoor dat je binnen Ubuntu geen Sudo user een ftp toegang geeft. Hiermee gaat het sudo password onbeveiligd over het netwerk/internet. Maak in dit geval een aparte ftp user aan met een password die ongelijk is aan het root password.
• De FTP poort van de router hoeft niet opengezet te worden. Je kunt ook met PuTTY via SSH inloggen en via een tunnel de FTP poort bereiken.

Nu de vsftpd service herstarten om de instellingen door te voeren:

$ /etc/init.d/vsftpd restart