Red Hat / CentOS VSFTPD FTP Server Configuration

by on May 21, 2009 · 44 comments· LAST UPDATED November 16, 2013

in , ,

Vsftpd (Very Secure FTP Daemon) is an FTP server for UNIX-like systems, including CentOS / RHEL / Fedora and other Linux distributions. It supports IPv6, SSL, locking users to their home directories and many other advanced features.

In this guide you will learn:

  1. Setup vsftpd to provide FTP service.
  2. Configure vsftpd.
  3. Configure Firewalls to protect the FTP server.
  4. Configure vsftpd with SSL/TLS.
  5. Setup vsftpd as download only anonymous internet server.
  6. Setup vsftpd with virtual users and more.


VSFTPD offer security, performance and stability over other servers. A quick list of vsftpd features:

  1. Virtual IP configurations
  2. Virtual users
  3. Run as standalone or inetd / xinetd operation
  4. Per-user configuration
  5. Bandwidth throttling
  6. Per-source-IP configurability
  7. Per-source-IP limits
  8. IPv6 ready
  9. Encryption support through SSL integration
  10. And much more.

Install Vsftpd FTP Server

Install the vsftpd package via yum command:
# yum install vsftpd

Vsftpd Defaults

  1. Default port: TCP / UDP - 21 and 20
  2. The main configuration file: /etc/vsftpd/vsftpd.conf
  3. Users that are not allowed to login via ftp: /etc/vsftpd/ftpusers

Configure Vsftpd Server

Open the configuration file, type:
# vi /etc/vsftpd/vsftpd.conf

Turn off standard ftpd xferlog log format:

xferlog_std_format=NO

Turn on verbose vsftpd log format. The default vsftpd log file is /var/log/vsftpd.log:

log_ftp_protocol=YES

Above two directives will enable logging of all FTP transactions. To lock down users to their home directories, edit/append directives as follows:

chroot_local_user=YES

Create warning banners for all FTP users:

banner_file=/etc/vsftpd/issue

Create /etc/vsftpd/issue file with a message compliant with the local site policy or a legal disclaimer:

NOTICE TO USERS
Use of this system constitutes consent to security monitoring and testing.
All activity is logged with your host name and IP address.

Turn On Vsftpd Service

Turn on vsftpd on boot:
# chkconfig vsftpd on
Start the service:
# service vsftpd start
# netstat -tulpn | grep :21

Configure Iptables To Protect The FTP Server

Open file /etc/sysconfig/iptables, enter:
# vi /etc/sysconfig/iptables
Add the following lines, ensuring that they appear before the final LOG and DROP lines for the RH-Firewall-1-INPUT:

-A RH-Firewall-1-INPUT -m state --state NEW -p tcp --dport 21 -j ACCEPT

Open file /etc/sysconfig/iptables-config, enter:
# vi /etc/sysconfig/iptables-config
Ensure that the space-separated list of modules contains the FTP connection tracking module:

IPTABLES_MODULES="ip_conntrack_ftp"

Save and close the file. Restart firewall:
# service iptables restart

Tip: View FTP Log File

Type the following command:
# tail -f /var/log/vsftpd.log
Sample output:

Thu May 21 11:40:31 2009 [pid 42298] FTP response: Client "10.1.3.108", "530 Please login with USER and PASS."
Thu May 21 11:40:36 2009 [pid 42298] FTP command: Client "10.1.3.108", "USER vivekda"
Thu May 21 11:40:36 2009 [pid 42298] [vivek] FTP response: Client "10.1.3.108", "331 Please specify the password."
Thu May 21 11:40:38 2009 [pid 42298] [vivek] FTP command: Client "10.1.3.108", "PASS "
Thu May 21 11:40:38 2009 [pid 42297] [vivek] OK LOGIN: Client "10.1.3.108"
Thu May 21 11:40:38 2009 [pid 42299] [vivek] FTP response: Client "10.1.3.108", "230 Login successful."
Thu May 21 11:40:38 2009 [pid 42299] [vivek] FTP command: Client "10.1.3.108", "SYST"
Thu May 21 11:40:38 2009 [pid 42299] [vivek] FTP response: Client "10.1.3.108", "215 UNIX Type: L8"
Thu May 21 11:40:39 2009 [pid 42299] [vivek] FTP command: Client "10.1.3.108", "PORT 10,1,3,108,162,253"
Thu May 21 11:40:39 2009 [pid 42299] [vivek] FTP response: Client "10.1.3.108", "200 PORT command successful. Consider using PASV."
Thu May 21 11:41:05 2009 [pid 42299] [vivek] FTP response: Client "10.1.3.108", "150 Ok to send data."
Thu May 21 11:41:06 2009 [pid 42299] [vivek] OK UPLOAD: Client "10.1.3.108", "/windows-7-too-many-programs.png", 8957 bytes, 6.70Kbyte/sec
Thu May 21 11:41:06 2009 [pid 42299] [vivek] FTP response: Client "10.1.3.108", "226 File receive OK."
Thu May 21 11:41:10 2009 [pid 42299] [vivek] FTP command: Client "10.1.3.108", "TYPE A"
Thu May 21 11:41:10 2009 [pid 42299] [vivek] FTP response: Client "10.1.3.108", "200 Switching to ASCII mode."
Thu May 21 11:41:11 2009 [pid 42299] [vivek] FTP command: Client "10.1.3.108", "PORT 10,1,3,108,217,96"
Thu May 21 11:41:11 2009 [pid 42299] [vivek] FTP response: Client "10.1.3.108", "200 PORT command successful. Consider using PASV."
Thu May 21 11:41:11 2009 [pid 42299] [vivek] FTP command: Client "10.1.3.108", "LIST"
Thu May 21 11:41:11 2009 [pid 42299] [vivek] FTP response: Client "10.1.3.108", "150 Here comes the directory listing."
Thu May 21 11:41:11 2009 [pid 42299] [vivek] FTP response: Client "10.1.3.108", "226 Directory send OK."

Tip: Restrict Access to Anonymous User Only

Edit the vsftpd configuration file /etc/vsftpd/vsftpd.conf and add the following:

local_enable=NO

Tip: Disable FTP Uploads

Edit the vsftpd configuration file /etc/vsftpd/vsftpd.conf and add the following:

write_enable=NO

Security Tip: Place the FTP Directory on its Own Partition

Separation of the operating system files from FTP users files may result into a better and secure system. Restrict the growth of certain file systems is possible using various techniques. For e.g., use /ftp partition to store all ftp home directories and mount ftp with nosuid, nodev and noexec options. A sample /etc/fstab enter:

/dev/sda5  /ftp          ext3    defaults,nosuid,nodev,noexec,usrquota 1 2

Disk quota must be enabled to prevent users from filling a disk used by FTP upload services. Edit the vsftpd configuration file. Add or correct the following configuration options to represents a directory which vsftpd will try to change into after an anonymous login:
anon_root=/ftp/ftp/pub

TwitterFacebookGoogle+PDF versionFound an error/typo on this page? Help us!

{ 44 comments… read them below or add one }

1 Emil CHERICHEȘ May 22, 2009 at 5:19 am

ip_conntrack_ftp is used for ftp tracking when used thru NAT.
I don’t belive it’s necessary here.

Reply

2 nixCraft May 22, 2009 at 10:15 am

The ip conntrack ftp module is used by iptables to listen to traffic and allow connections to the data ports (20). This allows an FTP server to operate on a machine which is running a firewall. Without this option passive ftp will not work.

Another option is just skip this module assign min and max pass ranges in vsftpd and open those ports (see “Vsftpd Set Download Only Anonymous Internet Server”).

Reply

3 Damian Myerscough May 22, 2009 at 11:04 am

Hello Vivek,

I noticed you a mount argument you put noexe

/dev/sda5 /ftp ext3 defaults,nosuid,nodev,noexe,usrquota 1 2

This should be modified to noexec

/dev/sda5 /ftp ext3 defaults,nosuid,nodev,noexec,usrquota 1 2

Nice guide though :)

Reply

4 nixCraft May 22, 2009 at 12:28 pm

Thanks for the heads-up!

Reply

5 chika May 23, 2009 at 7:52 am

proftpd LoL

Reply

6 Usman May 28, 2009 at 9:51 am

Nice Tutorial but you didn’t talked about point “Setup vsftpd With Virtual Users and Much More” in above tutorial!

Reply

7 nixCraft May 28, 2009 at 11:18 am

Vsftpd virtual user tutorial is covered here.

Reply

8 fabian June 6, 2009 at 12:28 pm

Can you mention the difference b/w vsftpd and pure-ftp. Which is better?

Reply

9 nixCraft June 6, 2009 at 1:50 pm

It is hard to say as we don’t know anything about your setup. vsftpd is in base RHEL system and there is no need to compile pure-ftp or 3rd party rpms. I will stick to vsftpd as it is part of os itself and updated and patched by Red Hat as and when required.

Reply

10 Amritesh June 8, 2009 at 12:28 pm

I have followed the process i am able to log in via ftp but i am not able to run any command like ls, get ,put etc plz guide me…..
error is as following

[root@localhost ~]# ftp 10.100.100.200
Connected to 10.100.100.200.
220 Welcome to AmritesH’s FTP service.
530 Please login with USER and PASS.
530 Please login with USER and PASS.
KERBEROS_V4 rejected as an authentication type
Name (10.100.100.200:root): amritesh
331 Please specify the password.
Password:
230 Login successful.
ftp> ls
550 Permission denied.
Passive mode refused. Turning off passive mode.
550 Permission denied.
ftp: bind: Address already in use

Reply

11 nixCraft June 8, 2009 at 1:50 pm

a) Do you have firewall configured? If so make sure it is working correctly.

b) What about file permissions?

Reply

12 Bun Kimmeng July 6, 2010 at 10:25 am

hello SIR or MADAM

please ,.help me i have problem with ftp
i do not know why some erorre

thank so much

“ftp.sh” 23L, 299C written
[root@localhost cdr]# chmod +x http://ftp.sh
[root@localhost cdr]# ./ftp.sh
Connected to 203.233.42.1.
220 (vsFTPd 2.0.5)
530 Please login with USER and PASS.
530 Please login with USER and PASS.
KERBEROS_V4 rejected as an authentication type
331 Please specify the password.
230 Login successful.
200 Switching to Binary mode.
Verbose mode off.

Reply

13 Amritesh June 10, 2009 at 10:31 am

thx vivek i m giving u firewall and vsftpd.config files details..

I have set the permission to 777
my iptable file is

# Generated by iptables-save v1.3.5 on Wed Jun 10 21:13:16 2009
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [423:45748]
:RH-Firewall-1-INPUT – [0:0]
-A INPUT -j RH-Firewall-1-INPUT
-A FORWARD -j RH-Firewall-1-INPUT
-A RH-Firewall-1-INPUT -i lo -j ACCEPT
-A RH-Firewall-1-INPUT -p icmp -m icmp –icmp-type any -j ACCEPT
-A RH-Firewall-1-INPUT -p esp -j ACCEPT
-A RH-Firewall-1-INPUT -p ah -j ACCEPT
-A RH-Firewall-1-INPUT -d 224.0.0.251 -p udp -m udp –dport 5353 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp -m udp –dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m tcp –dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -m state –state RELATED,ESTABLISHED -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state –state NEW -m tcp –dport 20 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state –state NEW -m tcp –dport 21 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state –state NEW -m tcp –dport 22 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state –state NEW -m tcp –dport 23 -j ACCEPT
-A RH-Firewall-1-INPUT -j REJECT –reject-with icmp-host-prohibited
COMMIT

and
vsftpd.config is

#Examplempe vsftpd config file
#
# See man 5 vsftpd.conf for more information.
#
# $Header: /var/cvsroot/gentoo-x86/net-ftp/vsftpd/files/vsftpd.conf,v 1.6 2005/08/03 09:38:31 uberlord Exp $

# Enable vsftpd to run as a standalone daemon
# Comment these two out to run under inetd or xinetd
#background=YES
listen=YES

# Allow anonymous FTP?
#anonymous_enable=YES

# Uncomment this to allow local users to log in.
local_enable=YES

# Uncomment this to enable any form of FTP write command.
write_enable=YES

# Default umask for local users is 077. You may wish to change this to 022,
# if your users expect that (022 is used by most other ftpd’s)
local_umask=022

# Uncomment this to allow the anonymous FTP user to upload files. This only
# has an effect if the above global write enable is activated. Also, you will
# obviously need to create a directory writable by the FTP user.
#anon_upload_enable=YES

# Uncomment this if you want the anonymous FTP user to be able to create
# new directories.
#anon_mkdir_write_enable=YES

# Activate directory messages – messages given to remote users when they
# go into a certain directory.
dirmessage_enable=YES

# Make sure PORT transfer connections originate from port 20 (ftp-data).
connect_from_port_20=YES

# If you want, you can arrange for uploaded anonymous files to be owned by
# a different user. Note! Using “root” for uploaded files is not
# recommended!
chown_uploads=YES
chown_username=ftp
# Activate logging of uploads/downloads.
#xferlog_enable=YES

# If you want, you can have your log file in standard ftpd xferlog format
xferlog_std_format=YES

# You may override where the log file goes if you like.
xferlog_file=/var/log/vsftpd.log

# You may change the default value for timing out an idle session.
#idle_session_timeout=600

# You may change the default value for timing out a data connection.
#data_connection_timeout=120

# It is recommended that you define on your system a unique user which the
# ftp server can use as a totally isolated and unprivileged user.
#nopriv_user=nobody

# Enable this and the server will recognise asynchronous ABOR requests. Not
# recommended for security (the code is non-trivial). Not enabling it,
# however, may confuse older FTP clients.
#async_abor_enable=YES

# By default the server will pretend to allow ASCII mode but in fact ignore
# the request. Turn on the below options to have the server actually do ASCII
# mangling on files when in ASCII mode.
# Beware that turning on ascii_download_enable enables malicious remote parties
# to consume your I/O resources, by issuing the command “SIZE /big/file” in
# ASCII mode.
# These ASCII options are split into upload and download because you may wish
# to enable ASCII uploads (to prevent uploaded scripts etc. from breaking),
# without the DoS risk of SIZE and ASCII downloads. ASCII mangling should be
# on the client anyway..
#ascii_upload_enable=YES
#ascii_download_enable=YES

# You may fully customise the login banner string:
ftpd_banner=Welcome to AmritesH’s FTP service.

# You may specify a file of disallowed anonymous e-mail addresses. Apparently
# useful for combatting certain DoS attacks.
#deny_email_enable=YES
# (default follows)
#banned_email_file=/etc/vsftpd/banned_emails

# You may specify an explicit list of local users to chroot() to their home
# directory. If chroot_local_user is YES, then this list becomes a list of
# users to NOT chroot().
#chroot_list_enable=YES
# (default follows)
#chroot_list_file=/etc/vsftpd/chroot_list

# You may activate the “-R” option to the builtin ls. This is disabled by
# default to avoid remote users being able to cause excessive I/O on large
# sites. However, some broken FTP clients such as “ncftp” and “mirror” assume
# the presence of the “-R” option, so there is a strong case for enabling it.
#ls_recurse_enable=YES

cmds_allowed=ls,pwd,dir,mkdir,rmdir,put,get,mget,prompt,cd ..,cd ~,ls -ltr
pam_service_name=vsftpd
tcp_wrappers=YES
#userlist_deny=NO
userlist_enable=NO
#userlist_file=/etc/vsftpd.user_list
#chmod_enable=YES
#chroot_list_enable=YES
#chroot_list_file=/etc/vsftpd.chroot_list
#local_root=/root/
#dirlist_enable=YES
#download_enable=YES
#chown_uploads=YES
#ftp_data_port=20
#port_enable=YES
pasv_enable=YES
#pasv_max_port=64000
#pasv_min_port=60000
#pasv_promiscuous=NO
cmds_allowed=PASV,RETR,QUIT,ls,dir

Reply

14 satrio September 27, 2009 at 9:58 am

do you now how to configuration for ip version 6?can you show me the configuration? thank you before :)

Reply

15 Vamsi October 16, 2009 at 7:42 am

Hi !
How to add users ?
please :D

Reply

16 Matthew August 12, 2010 at 5:17 pm

If you read the rest of the tutorial you would of seen the next page:

Linux Create An FTP User Account

Reply

17 vorf December 28, 2009 at 12:48 pm

mmm..interesting..

Reply

18 Prakash January 8, 2010 at 10:08 am

Very clearly you have explained configuration setup,
Thanks

Reply

19 Vishal March 11, 2010 at 11:04 am

I have installed RHEL5, installed VSFTP it is running fine in Linux but when i try this ftp site from windows pc the error is occured “530 Permission denied” but with anonymous access it is working i want authentication while using the ftp on both in windows and Linux, i have disabled anonymous access

Reply

20 sanjeev February 14, 2014 at 4:34 am

#setsebool -P ftp_home_dir on (try this command as root privileged)

Reply

21 Daniel March 18, 2010 at 2:19 pm

thanks men!!
there are pretty guides at internet, but this works perfect.

Reply

22 Nitin Banosd March 22, 2010 at 8:23 am

I want to restrict the user to their home directory.
they should not even able to read the other content in the server.

Please let me know how we can configure this.

Reply

23 Matthew August 12, 2010 at 5:16 pm

Read up on the area about chroot_local_user=YES

Reply

24 Anonymous March 23, 2010 at 8:02 am

Hi Vivek,
I have installed RHEL5, installed VSFTP it is running fine in Linux but when i try this ftp site from windows pc the error is occured “530 Permission denied” but with anonymous access it is working in Windows i want authentication while using the ftp server on both in windows and Linux, i have disabled anonymous access, how to resolve it.

Reply

25 Chewbaker August 11, 2010 at 2:42 pm

Great tut. I am new to the server world and was wondering how to specify where a user goes when they log in. Right now, they go to a weird //root directory with a .bash_history,.bash_logout,.bash_profile,.bashrc in it. I am using Cent OS 5.5 and followed the vspd setup and your tutorial to a tee. Any help would be great. I am thinking it might have to do with apache setup maybe, not sure.
thanks
chewbaker

Reply

26 Matthew August 12, 2010 at 5:15 pm

You need to set the local_root= to the directory of your server where you want them to access it, it is noted in the set up that you usually change this to your HTTP server root.

example:

local_root=/var/www/html

Reply

27 เช่าโฮสติ้ง December 9, 2010 at 3:33 am

thanks men!!

Reply

28 kashyap December 30, 2010 at 6:47 am

Hi can we allow a local user named “guest” to access only a particular directory?

Reply

29 Tahir Mehmood February 23, 2011 at 10:02 am

nice article for beginners, plz write something for virtual hosting perspective.

Reply

30 osearth April 3, 2011 at 4:38 am

For Local ftp users to use their own Home directory i had to run
setsebool -P ftp_home_dir=1

Reply

31 ptcat1 April 28, 2011 at 1:48 am

Hi,
I am new at this, I would like to know how i can create an ftp or some sort of download
a large file from my virtual desktop.

thanks

ptcat1

Reply

32 BMF July 27, 2011 at 6:04 pm

Hello everyone.
I dont like VSFTP server, another server you recommend for Red Hat 6?

Reply

33 Rijan August 12, 2011 at 2:08 am

Hi there…

I just read your article and It made me want do ask you. I want to have an FTP server where only certain people can have access on it. Should I turn off the anonymous user? what is the benefits of having anonymous user as enabled and not enabled ? what is the configuration so I can have users upload and download the file??

Reply

34 Einar August 16, 2011 at 5:25 pm

If I follow these steps to modify vsftpd.conf, the I get FAILED notes when I try to start the service. Does it matter where you put this lines in the config? I would think so but as far as I understand its just not working. “log_ftp_protocol” and “chroot_local_user” don’t exist in the config to begin with so I have no idea where to but them, ore why the service is failing but its only when I add these line that the service fails to start.

Reply

35 Prakash R September 30, 2011 at 6:54 am

Really this is very useful for me , Expecting more from you guys :) :)

Reply

36 qzi December 2, 2011 at 11:04 am

/etc/sysconfig/iptables

why do the directory leave blank?

Reply

37 Luis December 14, 2011 at 3:31 pm

Hi Vivek and company,

Great post, tahnk you very much!

Unfortunately I am getting the ugly “553 Could not create file.” (extract from the vsftpd.log) each time that I invoke the “put” command from my client.

I am being successfully logged in…

“USER lurodrig”
Wed Dec 14 15:17:41 2011 [pid 28055] [lurodrig] FTP response: Client “ftpServerIp”, “331 Please specify the password.”
Wed Dec 14 15:17:50 2011 [pid 28055] [lurodrig] FTP command: Client “ftpServerIp”, “PASS ”
Wed Dec 14 15:17:51 2011 [pid 28054] [lurodrig] OK LOGIN: Client “ftpServerIp”
Wed Dec 14 15:17:51 2011 [pid 28060] [lurodrig] FTP response: Client “ftpServerIp”, “230 Login successful.”

…And I am in my home directory:

user/l/lurodrig > ls -lrt
total 5
drwxr-xr-x 2 lurodrig it 2048 Jun 2 2011 private
drwxr-xr-x 3 lurodrig it 2048 Dec 13 09:16 public

But at the end: FAIL UPLOAD

Any ideas?

Thanks in advance,

Luis

Reply

38 manga online January 26, 2012 at 1:31 pm

how to check and create user and password on VSFTPD?

Reply

39 Ramki February 15, 2012 at 7:21 pm

Hi,
we have RHEL5 server running in one of test environment. is there way to stop ftp and sftp services, so that no file transfers happen from that box.

Thanks,
Ramki

Reply

40 sadou May 9, 2012 at 6:57 am

sorry but I can not find vsftpd.log in / var / log to help me thank you

Reply

41 snetch June 18, 2012 at 2:44 pm

>Above to directives will enable logging of all FTP transactions.
>Above to directives will enable logging
>Above to directives
>to directives
>to
o_O grammar nazi mode activated *rage*

Reply

42 Ganapathi September 10, 2012 at 6:55 am

Hi,

I have an user account “user1” and its directory is /home/user1/. But I need to restrict this user cant seen any other directories in the server ip(root,etc).That means user cant go back directory (.. or cd .. or cd \) from the /home/user1 directory. How to set these permission for the this user using acl or any other commands…

Reply

43 LiuYan刘研 November 30, 2012 at 10:30 am

Multibyte characters (such as Chinese) in the vsftpd.log file becomes ‘?’, how to let it log multibyte characters properly?

Reply

44 sathees March 23, 2013 at 7:53 am

Hello,
“ftp: connect: Invalid argument”
Getting the above error while doing “ls” in ftp passive mode.
Please help.

Reply

Leave a Comment

Tagged as: , , , , , , , , , , , ,

Previous post:

Next post: