FTP) is one of the oldest and most commonly used protocols found on the Internet today. Its purpose is to reliably transfer files between computer hosts on a network without requiring the user to log directly in to the remote host or to have knowledge of how to use the remote system. It allows users to access files on remote systems using a standard set of simple commands.
FTPprotocol and introduces
vsftpd, which is the preferred
FTPserver in Red Hat Enterprise Linux.
15.2.1. The File Transfer Protocol
TCPnetwork protocol. Because
FTPis a rather old protocol, it uses unencrypted user name and password authentication. For this reason, it is considered an insecure protocol and should not be used unless absolutely necessary. However, because
FTPis so prevalent on the Internet, it is often required for sharing files to the public. System administrators, therefore, should be aware of
FTP's unique characteristics.
TLSand how to secure an
FTPserver with the help of SELinux. A good substitute for
FTPis sftp from the OpenSSH suite of tools. For information about configuring OpenSSH and about the
SSHprotocol in general, refer to Chapter 11, OpenSSH.
FTPrequires multiple network ports to work properly. When an
FTPclient application initiates a connection to an
FTPserver, it opens port
21on the server — known as the command port. This port is used to issue all commands to the server. Any data requested from the server is returned to the client via a data port. The port number for data connections, and the way in which data connections are initialized, vary depending upon whether the client requests the data in active or passive mode.
- active mode
- Active mode is the original method used by the
FTPprotocol for transferring data to the client application. When an active-mode data transfer is initiated by the
FTPclient, the server opens a connection from port
20on the server to the
IPaddress and a random, unprivileged port (greater than
1024) specified by the client. This arrangement means that the client machine must be allowed to accept connections over any port above
1024. With the growth of insecure networks, such as the Internet, the use of firewalls for protecting client machines is now prevalent. Because these client-side firewalls often deny incoming connections from active-mode
FTPservers, passive mode was devised.
- passive mode
- Passive mode, like active mode, is initiated by the
FTPclient application. When requesting data from the server, the
FTPclient indicates it wants to access the data in passive mode and the server provides the
IPaddress and a random, unprivileged port (greater than
1024) on the server. The client then connects to that port on the server to download the requested information.While passive mode does resolve issues for client-side firewall interference with data connections, it can complicate administration of the server-side firewall. You can reduce the number of open ports on a server by limiting the range of unprivileged ports on the
FTPserver. This also simplifies the process of configuring firewall rules for the server.
15.2.2. The vsftpd Server
vsftpd) is designed from the ground up to be fast, stable, and, most importantly, secure.
vsftpdis the only stand-alone
FTPserver distributed with Red Hat Enterprise Linux, due to its ability to handle large numbers of connections efficiently and securely.
vsftpdhas three primary aspects:
- Strong separation of privileged and non-privileged processes — Separate processes handle different tasks, and each of these processes runs with the minimal privileges required for the task.
- Tasks requiring elevated privileges are handled by processes with the minimal privilege necessary — By taking advantage of compatibilities found in the
libcaplibrary, tasks that usually require full root privileges can be executed more safely from a less privileged process.
- Most processes run in a
chrootjail — Whenever possible, processes are change-rooted to the directory being shared; this directory is then considered a
chrootjail. For example, if the
/var/ftp/directory is the primary shared directory,
/var/ftp/to the new root directory, known as
/. This disallows any potential malicious hacker activities for any directories not contained in the new root directory.
vsftpddeals with requests:
- The parent process runs with the least privileges required — The parent process dynamically calculates the level of privileges it requires to minimize the level of risk. Child processes handle direct interaction with the
FTPclients and run with as close to no privileges as possible.
- All operations requiring elevated privileges are handled by a small parent process — Much like the Apache
vsftpdlaunches unprivileged child processes to handle incoming connections. This allows the privileged, parent process to be as small as possible and handle relatively few tasks.
- All requests from unprivileged child processes are distrusted by the parent process — Communication with child processes is received over a socket, and the validity of any information from child processes is checked before being acted on.
- Most interactions with
FTPclients are handled by unprivileged child processes in a
chrootjail — Because these child processes are unprivileged and only have access to the directory being shared, any crashed processes only allow the attacker access to the shared files.
126.96.36.199. Starting and Stopping vsftpd
vsftpdservice in the current session, type the following at a shell prompt as
systemctl start vsftpd.service
systemctl stop vsftpd.service
vsftpdservice, run the following command as
systemctl restart vsftpd.service
vsftpdservice, which is the most efficient way to make configuration changes take effect after editing the configuration file for this
FTPserver. Alternatively, you can use the following command to restart the
vsftpdservice only if it is already running:
systemctl try-restart vsftpd.service
vsftpdservice does not start automatically at boot time. To configure the
vsftpdservice to start at boot time, type the following at a shell prompt as
systemctl enable vsftpd.serviceCreated symlink from /etc/systemd/system/multi-user.target.wants/vsftpd.service to /usr/lib/systemd/system/vsftpd.service.
188.8.131.52. Starting Multiple Copies of vsftpd
FTPdomains. This is a technique called multihoming. One way to multihome using
vsftpdis by running multiple copies of the daemon, each with its own configuration file.
IPaddresses to network devices or alias network devices on the system. For more information about configuring network devices, device aliases, and additional information about network configuration scripts, see the Red Hat Enterprise Linux 7 Networking Guide.
FTPdomains must be configured to reference the correct machine. For information about BIND, the
DNSprotocol implementation used in Red Hat Enterprise Linux, and its configuration files, see the Red Hat Enterprise Linux 7 Networking Guide.
vsftpdto answer requests on different
IPaddresses, multiple copies of the daemon must be running. To facilitate launching multiple instances of the
vsftpddaemon, a special systemd service unit (
vsftpd@.service) for launching
vsftpdas an instantiated service is supplied in the vsftpd package.
vsftpdconfiguration file for each required instance of the
FTPserver must be created and placed in the
/etc/vsftpd/directory. Note that each of these configuration files must have a unique name (such as
/etc/vsftpd/vsftpd-site-2.conf) and must be readable and writable only by the
FTPserver listening on an
IPv4network, the following directive must be unique:
IPaddress for the
FTPsite being served. If the site is using
IPv6, use the
/etc/vsftpd/directory, individual instances of the
vsftpddaemon can be started by executing the following command as
systemctl start firstname.lastname@example.org
vsftpd-site-2. Note that the configuration file's
.confextension should not be included in the command.
vsftpddaemon at once, you can make use of a systemd target unit file (
vsftpd.target), which is supplied in the vsftpd package. This systemd target causes an independent
vsftpddaemon to be launched for each available
vsftpdconfiguration file in the
/etc/vsftpd/directory. Execute the following command as
rootto enable the target:
systemctl enable vsftpd.targetCreated symlink from /etc/systemd/system/multi-user.target.wants/vsftpd.target to /usr/lib/systemd/system/vsftpd.target.
vsftpdservice (along with the configured
vsftpdserver instances) at boot time. To start the service immediately, without rebooting the system, execute the following command as
systemctl start vsftpd.target
184.108.40.206. Encrypting vsftpd Connections Using TLS
FTP, which transmits user names, passwords, and data without encryption by default, the
vsftpddaemon can be configured to utilize the
TLSprotocol to authenticate connections and encrypt all transfers. Note that an
FTPclient that supports
TLSis needed to communicate with
SSL(Secure Sockets Layer) is the name of an older implementation of the security protocol. The new versions are called
TLS(Transport Layer Security). Only the newer versions (
TLS) should be used as
SSLsuffers from serious security vulnerabilities. The documentation included with the vsftpd server, as well as the configuration directives used in the
vsftpd.conffile, use the
SSLname when referring to security-related matters, but
TLSis supported and used by default when the
ssl_enabledirective is set to
ssl_enableconfiguration directive in the
YESto turn on
TLSsupport. The default settings of other
TLS-related directives that become automatically active when the
ssl_enableoption is enabled provide for a reasonably well-configured
TLSset up. This includes, among other things, the requirement to only use the
TLSv1 protocol for all connections (the use of the insecure
SSLprotocol versions is disabled by default) or forcing all non-anonymous logins to use
TLSfor sending passwords and data transfers.
Example 15.14. Configuring vsftpd to Use TLS
SSLversions of the security protocol in the
ssl_enable=YES ssl_tlsv1=YES ssl_sslv2=NO ssl_sslv3=NO
vsftpdservice after you modify its configuration:
systemctl restart vsftpd.service
TLS-related configuration directives for fine-tuning the use of
220.127.116.11. SELinux Policy for vsftpd
vsftpddaemon (as well as other
ftpdprocesses), defines a mandatory access control, which, by default, is based on least access required. In order to allow the
FTPdaemon to access specific files or directories, appropriate labels need to be assigned to them.
public_content_tlabel must be assigned to the files and directories to be shared. You can do this using the
chcon -R -t public_content_t /path/to/directory
public_content_rw_tlabel. In addition to that, the
allow_ftpd_anon_writeSELinux Boolean option must be set to
1. Use the
rootto do that:
setsebool -P allow_ftpd_anon_write=1
FTP, which is the default setting on Red Hat Enterprise Linux 7, the
ftp_home_dirBoolean option needs to be set to
vsftpdis to be allowed to run in standalone mode, which is also enabled by default on Red Hat Enterprise Linux 7, the
ftpd_is_daemonoption needs to be set to
FTP. Also, see the Red Hat Enterprise Linux 7 SELinux User's and Administrator's Guide for more detailed information about SELinux in general.
15.2.3. Additional Resources
vsftpd, see the following resources.
18.104.22.168. Installed Documentation
/usr/share/doc/vsftpd-version-number/directory — Replace version-number with the installed version of the vsftpd package. This directory contains a
READMEfile with basic information about the software. The
TUNINGfile contains basic performance-tuning tips and the
SECURITY/directory contains information about the security model employed by
vsftpd-related manual pages — There are a number of manual pages for the daemon and the configuration files. The following lists some of the more important manual pages.
- Server Applications
- vsftpd(8) — Describes available command-line options for
- Configuration Files
- vsftpd.conf(5) — Contains a detailed list of options available within the configuration file for
- hosts_access(5) — Describes the format and options available within the
TCPwrappers configuration files:
- Interaction with SELinux
- ftpd_selinux(8) — Contains a description of the SELinux policy governing
ftpdprocesses as well as an explanation of the way SELinux labels need to be assigned and Booleans set.
22.214.171.124. Online Documentation
- About vsftpd and FTP in General
- Red Hat Enterprise Linux Documentation
- Red Hat Enterprise Linux 7 Networking Guide — The Networking Guide for Red Hat Enterprise Linux 7 documents relevant information regarding the configuration and administration of network interfaces, networks, and network services in this system. It provides an introduction to the
hostnamectlutility and explains how to use it to view and set host names on the command line, both locally and remotely.
- Red Hat Enterprise Linux 7 SELinux User's and Administrator's Guide — The SELinux User's and Administrator's Guide for Red Hat Enterprise Linux 7 describes the basic principles of SELinux and documents in detail how to configure and use SELinux with various services such as the Apache HTTP Server, Postfix, PostgreSQL, or OpenShift. It explains how to configure SELinux access permissions for system services managed by
- Red Hat Enterprise Linux 7 Security Guide — The Security Guide for Red Hat Enterprise Linux 7 assists users and administrators in learning the processes and practices of securing their workstations and servers against local and remote intrusion, exploitation, and malicious activity. It also explains how to secure critical system services.
- Relevant RFC Documents
- RFC 0959 — The original Request for Comments (RFC) of the
FTPprotocol from the IETF.
- RFC 1123 — The small
FTP-related section extends and clarifies RFC 0959.
- RFC 2228 —
FTPsecurity extensions. vsftpd implements the small subset needed to support TLS and SSL connections.
- RFC 2389 — Proposes
- RFC 2428 —