220.127.116.11. Anonymous Access
The presence of the
/var/ftp/directory activates the anonymous account.
The easiest way to create this directory is to install the
vsftpdpackage. This package establishes a directory tree for anonymous users and configures the permissions on directories to read-only for anonymous users.
By default the anonymous user cannot write to any directories.
If enabling anonymous access to an FTP server, be aware of where sensitive data is stored.
Procedure 2.1. Anonymous Upload
- To allow anonymous users to upload files, it is recommended to create a write-only directory within the
/var/ftp/pub/directory. Run the following command as root to create such directory named
- Next, change the permissions so that anonymous users cannot view the contents of the directory:
chmod 730 /var/ftp/pub/uploadA long format listing of the directory should look like this:
ls -ld /var/ftp/pub/uploaddrwx-wx---. 2 root ftp 4096 Nov 14 22:57 /var/ftp/pub/upload
NoteAdministrators who allow anonymous users to read and write in directories often find that their servers become a repository of stolen software.
vsftpd, add the following line to the
- In Red Hat Enterprise Linux, the SELinux is running in Enforcing mode by default. Therefore, the
allow_ftpd_anon_writeBoolean must be enabled in order to allow
vsftpdto upload files:
setsebool -P allow_ftpd_anon_write=1
- Label the
/upload/directory and its files with the
semanage fcontext -a -t public_content_rw_t '/var/ftp/pub/upload(/.*)'
semanageutility is provided by the policycoreutils-python package, which is not installed by default. To install it, use the following command as root:
yum install policycoreutils-python
- Use the
restoreconutility to change the type of
/upload/and its files:
restorecon -R -v /var/ftp/pub/uploadThe directory is now properly labeled with
public_content_rw_tso that SELinux in Enforcing mode allows anonymous users to upload files to it:
ls -dZ /var/ftp/pub/uploaddrwx-wx---. root root unconfined_u:object_r:public_content_t:s0 /var/ftp/pub/upload/