Skip to content

Commit 7e6ef62

Browse files
committed
Allow initial install of NOT secure ftp before securing it via ssh
1 parent c2cd25a commit 7e6ef62

6 files changed

+169
-14
lines changed

config/ftp/vsftpd.chroot_list

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1 +1,2 @@
11
# add list of ftp users here!
2+
# BUT its really better not to - just use ssh keys
Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
# add list of ftp users here!
2+
sean
3+

config/ftp/vsftpd.conf.NOT-secure

Lines changed: 155 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,155 @@
1+
# Example config file /etc/vsftpd.conf
2+
#
3+
# The default compiled in settings are fairly paranoid. This sample file
4+
# loosens things up a bit, to make the ftp daemon more usable.
5+
# Please see vsftpd.conf.5 for all compiled in defaults.
6+
#
7+
# READ THIS: This example file is NOT an exhaustive list of vsftpd options.
8+
# Please read the vsftpd.conf.5 manual page to get a full idea of vsftpd's
9+
# capabilities.
10+
#
11+
#
12+
# Run standalone? vsftpd can run either from an inetd or as a standalone
13+
# daemon started from an initscript.
14+
listen=NO
15+
#
16+
# This directive enables listening on IPv6 sockets. By default, listening
17+
# on the IPv6 "any" address (::) will accept connections from both IPv6
18+
# and IPv4 clients. It is not necessary to listen on *both* IPv4 and IPv6
19+
# sockets. If you want that (perhaps because you want to listen on specific
20+
# addresses) then you must run two copies of vsftpd with two configuration
21+
# files.
22+
listen_ipv6=YES
23+
#
24+
# Allow anonymous FTP? (Disabled by default).
25+
anonymous_enable=NO
26+
#
27+
# Uncomment this to allow local users to log in.
28+
local_enable=YES
29+
#
30+
# Uncomment this to enable any form of FTP write command.
31+
write_enable=YES
32+
#
33+
# Default umask for local users is 077. You may wish to change this to 022,
34+
# if your users expect that (022 is used by most other ftpd's)
35+
#local_umask=022
36+
#
37+
# Uncomment this to allow the anonymous FTP user to upload files. This only
38+
# has an effect if the above global write enable is activated. Also, you will
39+
# obviously need to create a directory writable by the FTP user.
40+
#anon_upload_enable=YES
41+
#
42+
# Uncomment this if you want the anonymous FTP user to be able to create
43+
# new directories.
44+
#anon_mkdir_write_enable=YES
45+
#
46+
# Activate directory messages - messages given to remote users when they
47+
# go into a certain directory.
48+
dirmessage_enable=YES
49+
#
50+
# If enabled, vsftpd will display directory listings with the time
51+
# in your local time zone. The default is to display GMT. The
52+
# times returned by the MDTM FTP command are also affected by this
53+
# option.
54+
use_localtime=YES
55+
#
56+
# Activate logging of uploads/downloads.
57+
xferlog_enable=YES
58+
#
59+
# Make sure PORT transfer connections originate from port 20 (ftp-data).
60+
connect_from_port_20=YES
61+
#
62+
# If you want, you can arrange for uploaded anonymous files to be owned by
63+
# a different user. Note! Using "root" for uploaded files is not
64+
# recommended!
65+
#chown_uploads=YES
66+
#chown_username=whoever
67+
#
68+
# You may override where the log file goes if you like. The default is shown
69+
# below.
70+
#xferlog_file=/var/log/vsftpd.log
71+
#
72+
# If you want, you can have your log file in standard ftpd xferlog format.
73+
# Note that the default log file location is /var/log/xferlog in this case.
74+
#xferlog_std_format=YES
75+
#
76+
# You may change the default value for timing out an idle session.
77+
#idle_session_timeout=600
78+
#
79+
# You may change the default value for timing out a data connection.
80+
#data_connection_timeout=120
81+
#
82+
# It is recommended that you define on your system a unique user which the
83+
# ftp server can use as a totally isolated and unprivileged user.
84+
#nopriv_user=ftpsecure
85+
#
86+
# Enable this and the server will recognise asynchronous ABOR requests. Not
87+
# recommended for security (the code is non-trivial). Not enabling it,
88+
# however, may confuse older FTP clients.
89+
#async_abor_enable=YES
90+
#
91+
# By default the server will pretend to allow ASCII mode but in fact ignore
92+
# the request. Turn on the below options to have the server actually do ASCII
93+
# mangling on files when in ASCII mode.
94+
# Beware that on some FTP servers, ASCII support allows a denial of service
95+
# attack (DoS) via the command "SIZE /big/file" in ASCII mode. vsftpd
96+
# predicted this attack and has always been safe, reporting the size of the
97+
# raw file.
98+
# ASCII mangling is a horrible feature of the protocol.
99+
#ascii_upload_enable=YES
100+
#ascii_download_enable=YES
101+
#
102+
# You may fully customise the login banner string:
103+
#ftpd_banner=Welcome to blah FTP service.
104+
#
105+
# You may specify a file of disallowed anonymous e-mail addresses. Apparently
106+
# useful for combatting certain DoS attacks.
107+
#deny_email_enable=YES
108+
# (default follows)
109+
#banned_email_file=/etc/vsftpd.banned_emails
110+
#
111+
# You may restrict local users to their home directories. See the FAQ for
112+
# the possible risks in this before using chroot_local_user or
113+
# chroot_list_enable below.
114+
chroot_local_user=YES
115+
#
116+
# You may specify an explicit list of local users to chroot() to their home
117+
# directory. If chroot_local_user is YES, then this list becomes a list of
118+
# users to NOT chroot().
119+
# (Warning! chroot'ing can be very dangerous. If using chroot, make sure that
120+
# the user does not have write access to the top level directory within the
121+
# chroot)
122+
chroot_local_user=YES
123+
chroot_list_enable=YES
124+
# (default follows)
125+
chroot_list_file=/etc/vsftpd.chroot_list
126+
#
127+
# You may activate the "-R" option to the builtin ls. This is disabled by
128+
# default to avoid remote users being able to cause excessive I/O on large
129+
# sites. However, some broken FTP clients such as "ncftp" and "mirror" assume
130+
# the presence of the "-R" option, so there is a strong case for enabling it.
131+
#ls_recurse_enable=YES
132+
#
133+
# Customization
134+
#
135+
# Some of vsftpd's settings don't fit the filesystem layout by
136+
# default.
137+
#
138+
# This option should be the name of a directory which is empty. Also, the
139+
# directory should not be writable by the ftp user. This directory is used
140+
# as a secure chroot() jail at times vsftpd does not require filesystem
141+
# access.
142+
secure_chroot_dir=/var/run/vsftpd/empty
143+
#
144+
# This string is the name of the PAM service vsftpd will use.
145+
pam_service_name=vsftpd
146+
#
147+
# This option specifies the location of the RSA certificate to use for SSL
148+
# encrypted connections.
149+
rsa_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem
150+
rsa_private_key_file=/etc/ssl/private/ssl-cert-snakeoil.key
151+
ssl_enable=NO
152+
153+
#
154+
# Uncomment this to indicate that vsftpd use a utf8 filesystem.
155+
#utf8_filesystem=YES

done.sh

Lines changed: 0 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1 @@
11
ifconfig
2-
3-
echo FTP setup for user `echo $USER`
4-
5-
echo To add another ftp user, then run this command
6-
echo ' sudo pico /etc/vsftpd.chroot_list'
7-
8-
echo Then you can ftp into this IP address
9-
10-
echo You may need to restart this terminal OR execute:
11-
echo ' source ~/.profile'
12-
13-
Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
echo === secure the vsftpd for ftp server ===
2+
3+
sudo cp ./config/ftp/vsftpd.conf.NOT-secure /etc/vsftpd.conf
4+
sudo cp ./config/ftp/vsftpd.chroot_list.NOT-secure /etc/vsftpd.chroot_list
5+
6+
sudo systemctl restart vsftpd
7+
8+
echo You still need to install ssh!

extra-install-ftp-server.sh renamed to extra-install-ftp-server-NOT-secure.sh

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,8 +3,8 @@ sudo apt --yes --allow-downgrades install vsftpd
33

44
sudo apt-get --yes --allow-downgrades install filezilla
55

6-
sudo cp ./config/ftp/vsftpd.conf /etc/vsftpd.conf
7-
sudo cp ./config/ftp/vsftpd.chroot_list /etc/vsftpd.chroot_list
6+
#sudo cp ./config/ftp/vsftpd.conf /etc/vsftpd.conf
7+
#sudo cp ./config/ftp/vsftpd.chroot_list /etc/vsftpd.chroot_list
88

99
sudo systemctl restart vsftpd
1010

0 commit comments

Comments
 (0)