Andrew Hudson - Fedora™ Unleashed, 2008 edition

# /etc/rc.d/init.d/xinetd restart

Stopping xinetd: [ OK ]

Starting xinetd: [ OK ]

After it is restarted, the FTP server is accessible to all incoming requests.

Previous versions of Red Hat's Linux distributions required you to edit a file named vsftpunder the /etc/xinetd.ddirectory to enable and start the Very Secure FTP server, vsftpd. With Fedora, you can now simply use the system-config-servicesclient or servicecommand to start vsftpd. For example, start the server using the servicecommand like this:

# service vsftpd start

Starting vsftpd for vsftpd: [ OK ]

Use the system-config-servicesclient or servicecommand to start, stop, or restart the vsftpdserver. Do not run two FTP servers on your system at the same time!

You can also use the shell script named vsftpdunder the /etc/rc.d/init.ddirectory to start, stop, restart, and query the vsftpdserver. You must have root permission to use the vsftpdscript to control the server, but any user can query the server (to see whether it is running and to see its process ID number) using the statuskeyword like this:

$ /etc/rc.d/init.d/vsftpd status

The vsftpdserver, although not as popular as wu-ftpd, is used by Red Hat, Inc. for its FTP server operations. (The vsftpdserver home page is located at http://vsftpd.beasts.org/.) The server offers features such as simplicity, security, and speed. It has been used by a number of sites, such as ftp.debian.org, ftp.gnu.org, rpmfind.net, and ftp.gimp.org. Note that despite its name, the Very Secure FTP server does not enable use of encrypted user- names or passwords.

Its main configuration file is vsftpd.conf, which resides under the /etc/vsftpddirectory. The server has a number of features and default policies, but you can override them by changing the installed configuration file.

By default, anonymous logins are enabled, but users are not allowed to upload files, create new directories, or delete or rename files. The configuration file installed by Fedora allows local users (that is, users with a login and shell account) to log in and access their home directories. This configuration presents potential security risks because usernames and passwords are passed without encryption over a network. The best policy is to deny your users access to the server from their user accounts. The standard vsftpdconfiguration disables this feature.

You an toggle anonymous access features for your FTP server by editing the vsftpd.conffile and changing related entries to YESor NOin the file. Settings to control how the server works for anonymous logins include:

► anonymous_enable— Enabled by default. Use a setting of NO, and then restart the server to turn off anonymous access.

► anon_mkdir_write_enable— Allows or disallows creating of new directories.

► anon_other_write_enable— Allows or disallows deleting or renaming of files and directories.

► anon_upload_enable— Controls whether anonymous users can upload files (also depends on the global write_enablesetting). This is a potential security and liability hazard and should rarely be used; if enabled, consistently monitor any designated upload directory.

► anon_world_readable_only— Allows anonymous users to download only files with world-readable (444) permission.

After making any changes to your server configuration file, make sure to restart the server; doing so forces vsftpdto reread its settings.

You can edit vsftpd.confto enable, disable, and configure many features and settings of the vsftpdserver, such as user access, filtering of bogus passwords, and access logging. Some features might require the creation and configuration of other files, such as:

► /etc/vsftpd.user_list— Used by the userlist_enableand/or the userlist_deny options; the file contains a list of usernames to be denied access to the server.

► /etc/vsftpd.chroot_list— Used by the chroot_list_enableand/or chroot_local_user options, this file contains a list of users who are either allowed or denied access to a home directory. You can specify an alternative file by using the chroot_list_fileoption.

► /etc/vsftpd.banned_emails— A list of anonymous password entries used to deny access if the deny_email_enable setting is enabled. You can specify an alternative file by using the banned_emailoption.

► /var/log/vsftpd.log— Data transfer information is captured to this file if you enable logging by using the xferlog_enable setting.

Before editing the FTP server files, make a backup file first. Also, it is always a good idea to comment out (using a pound sign at the beginning of a line) what is changed instead of deleting or overwriting entries. Follow these comments with a brief description explaining why the change was made. This leaves a nice audit trail of what was done, by whom, when, and why. If you have any problems with the configuration, these comments and details can help you troubleshoot and return to valid entries if necessary. You can use the rpmcommand or other Linux tools (such as mc) to extract a fresh copy of a configuration file from the software's RPM archive. Be aware, however, that the extracted version replaces the current version and overwrites your configuration changes.

The contents of a file named . message(if it exists in the current directory) are displayed when a user enters the directory. This feature is enabled in the installed configuration file, but disabled by the daemon. FTP users are also not allowed to perform recursive directory listings, which can help reduce bandwidth use.

The PASV data connection method is enabled to let external users know the IP address of the FTP server. This is a common problem when using FTP from behind a firewall/gateway that uses IP masquerading or when incoming data connections are disabled. For example, here is a connection to an FTP server (running ProFTPD), an attempt to view a directory listing, and the resulting need to use ftp's internal passivecommand:

$ ftp ftp.tux.org

Connected to gwyn.tux.org.

220 ProFTPD 1.2.5rc1 Server (ProFTPD on ftp.tux.org) [gwyn.tux.org]

500 AUTH not understood.

KERBEROS_V4 rejected as an authentication type

Name (ftp.tux.org:gbush): gbush

331 Password required for gbush. Password:

230 User gbush logged in.

Remote system type is UNIX.

Using binary mode to transfer files.

ftp> cd public_html

250 CWD command successful.

ftp> ls