FTP access is something that is one of the most common requirements. I wanted to set it up so that I could:
Restrict FTP accounts to certain folders and not let them roam around the entire directory structure.
Make sure that files that were being uploaded through FTP were being assigned the appropriate permissions -- in my case -rwxr-xr-x (If you donāt know what this is, check out this post on groups and permissions).
Have the ability to have a master FTP account which is allowed to browse all folders.
I decided to go with vsftpd for a couple of reasons. The biggest of course being that my friend Nestea recommended it. That pretty much holds enough weight to justify the selection right there, but it was also the most recommended one at trusted sources such as /r/linux and Serverfault.Ā
To install, simply execute:Ā
sudo apt-get install vsftpd
Before we move on to configuration, always make a backup copy of the original config:
sudo cp /etc/vsftpd.conf /etc/vsftpd.conf.original
Now edit the /etc/vsftpd.conf file to customize the following:
2) Disable anonymous login, enable local users to login and give them write permissions:Ā
# No anonymous login
anonymous_enable=NO
# Let local users login
# If you connect from the internet with local users, you should enable TLS/SSL/FTPS
local_enable=YES
# Write permissions
write_enable=YES
3) Restrict all users to their home directory, unless specified otherwise in the list:Ā
# Just some users are "free":
chroot_local_user=YES
chroot_list_enable=YES
# Create the file /etc/vsftpd.chroot_list with a list of the "free" users.
4) Create a group for FTP Logins and user accounts with access to a particular directories:Ā Ā
sudo groupadd FTPLogins
sudo useradd -d /var/www/mydomain.com/public_html -g FTPLogins FTPJim
This creates an account with the username FTPJim and adds it to the group FTPLogins. FTPJim will be restricted to the root of mydomain.com and itās subfolders.
5) Assign permissions the files uploaded via FTP will possess:
When a file is uploaded, by default it will contain the permissions "-rw-------" which of course is no good for us. So in order to rectify this, we once again edit our /etc/vsftpd.conf file and make the following modifications:
Ā file_open_mode=0644
local_umask=022
You can play with the values (use octal representations) but this will essentially get you to have the permissions -rw-r--r-- which is a start.
6) Apply configurations and go!
/etc/init.d/vsftpd restart
