FTP server is used to exchange files between computers over network . This guide helps you to setup ftp server on centos 7 . This guide contains configuration steps for both FTP and SFTP as well as user creation . Here i’ve used VSFTP package which is secure and less vulnerable .
1. FTP Server
2. SFTP Server
3. User creation
Setup FTP server on centos 7
Step 1 » Update your repository and install VSFTPD package .
[root@krizna ~]# yum check-update
[root@krizna ~]# yum -y install vsftpd
Step 2 » After installation you can find /etc/vsftpd/vsftpd.conf file which is the main configuration file for VSFTP.
Take a backup copy before making changes .
[root@krizna ~]# mv /etc/vsftpd/vsftpd.conf /etc/vsftpd/vsftpd.conf.org
Now open the file and make changes as below
[root@krizna ~]# nano /etc/vsftpd/vsftpd.conf
Find this line anonymous_enable=YES ( Line no : 12 ) and change value to NO to disable anonymous FTP access.
anonymous_enable=NO
Uncomment the below line ( Line no : 100 ) to restrict users to their home directory.
chroot_local_user=YES
and add the below lines at the end of the file to enable passive mode and allow chroot writable.
allow_writeable_chroot=YES
pasv_enable=Yes
pasv_min_port=40000
pasv_max_port=40100
Step 3 » Now restart vsftpd service and make it start automatically after reboot.
[root@krizna ~]# systemctl restart vsftpd.service
[root@krizna ~]# systemctl enable vsftpd.service
Step 4 » Add FTP service in firewall to allow ftp ports .
[root@krizna ~]# firewall-cmd --permanent --add-service=ftp
[root@krizna ~]# firewall-cmd --reload
Step 5 » Setup SEinux to allow ftp access to the users home directories .
[root@krizna ~]# setsebool -P ftp_home_dir on
Step 6 » Now create an User for ftp access. Here /sbin/nologin shell is used to prevent shell access to the server .
[root@krizna ~]# useradd -m dave -s /sbin/nologin
Now user dave can able to login ftp on port 21 .
[root@krizna ~]# passwd dave
You can filezilla or winscp client for accessing files.
SFTP server
SFTP ( Secure File Transfer Protocol ) is used to encrypt connections between clients and the FTP server. It is highly recommended to use SFTP because data is transferred over encrypted connection using SSH-tunnel on port 22 .
Basically we need openssh-server package to enable SFTP .
Install openssh-server package, if its not already installed.
[root@krizna ~]# yum -y install openssh-server
Step 7 » Create a separate group for FTP access.
[root@krizna ~]# groupadd ftpaccess
Step 8 » Now open /etc/ssh/sshd_config file and make changes as below.
Find and comment the below line ( Line no : 147 ).
#Subsystem sftp /usr/libexec/openssh/sftp-server
and add these lines below.
Subsystem sftp internal-sftp
Match group ftpaccess
ChrootDirectory %h
X11Forwarding no
AllowTcpForwarding no
ForceCommand internal-sftp
Step 9 » Now restart sshd service.
[root@krizna ~]# systemctl restart sshd
Now your SFTP server is configured and ready .
User creation
Step 10 » Create user jack with /sbin/nologin shell and ftpaccess group
[root@krizna ~]# useradd -m jack -s /sbin/nologin -g ftpaccess
Now assign root ownership for the home directory for chroot access and modify permission.
[root@krizna ~]# passwd jack
[root@krizna ~]# chown root /home/jack
Create a directory www inside home directory for writing and modify ownership .
[root@krizna ~]# chmod 750 /home/jack
[root@krizna ~]# mkdir /home/jack/www
[root@krizna ~]# chown jack:ftpaccess /home/jack/www
Now jack can use both ftp and sftp services . He can upload files in www directory .
If you are going to use FTP and SFTP together in the same server, you should follow above steps while creating users . For existing users add them to ftpaccess and make below changes.
[root@krizna ~]# usermod dave -g ftpaccess
[root@krizna ~]# chown root /home/dave
[root@krizna ~]# chmod 750 /home/dave
[root@krizna ~]# mkdir /home/dave/www
[root@krizna ~]# chown dave:ftpaccess /home/dave/www
Also see :
» Setup FTP server on ubuntu 16.04
» Setup FTP server on ubuntu 14.04
» Configure ftp server on centos 6
Have a nice day.
Tks very much..!! Jhon – Bogotá, Colombia.
I followed the section on setting up SFTP, but I still can’t connect with filezilla (after password entry – Error: Network error: Software caused connection abort; Error: Could not connect to server) and Putty closes with the same error as soon as I hit return on the password. I can connect to other servers on my network and remotely, so not sure what the issue is. And I can access the server directly with those user credentials, so not clear what is going on. And I am a member of the group ftpaccess.
If I undo the customization of /etc/ssh/sshd_config, then it works.
Please add some purpose of each command so that We’ll know more about it before we install it in our server.. thanks….
Please add some purpose of each command so that We’ll know more about it before we install it in our server.. thanks… 🙂
I had to skip step 8. The changes to sshd_config prevented all access over ssh. Not sure why.
Modify the the /etc/ssh/sshd_config file and comment out the following line:
#Subsystem sftp /usr/libexec/openssh/sftp-server
Next, add the following line to the /etc/ssh/sshd_config file
Subsystem sftp internal-sftp
this is whats missing
never told us to comment out the first line
I commented out “Subsystem sftp /usr/libexec/openssh/sftp-server”
But still get the following error while trying to connect via a SFTP client :
The user name or password was not accepted by the server.
Additionally, I see in /var/log/secure
“Jun 14 19:16:34 localhost sshd[20114]: Connection closed by xxx.xxx.xxx.xxx [preauth]”
Any suggestions will be truly appreciated
Thanks
Thanks! Worked like a charm.
But there’s a small error in Step 2:
Take a backup copy before making changes .
[WRONG]
[root@krizna ~]# mv /etc/vsftpd/vsftpd.conf /etc/vsftpd/vsftpd.conf.org”
In order to backup the file you should copy it. And not move it.
[RIGHT]
[root@krizna ~]# cp /etc/vsftpd/vsftpd.conf /etc/vsftpd/vsftpd.conf.org
No such thing as a vsftpd.conf in my /etc/vsftpf/ directory
Good article. I’m wondering what is better? Vsftpd or Proftpd?
I installed proftpd from an article I found on the Rosehosting blog, but now that i’ve stumbled upon yours I wonder what is better.
Which FTP service is better and more secure?
Where can i download the installation from? Please help me..
Thanks for this great tut…
It worked like a charm.. I just need to know how would I monitor the real time log just as in e.g. filezilla, bulletproof server that scrolls up or shows the screen logs when somebody connects to the FTP?
This is good for me so I can easily monitor the server if running or not and address the issues immediately.
Appreciate much your comments and advises.
🙂
Got error
[root@XXXXXXXXX vsftpd]# setsebool -P ftp_home_dir on
Boolean ftp_home_dir is not defined
looks like it’s changed http://linux.die.net/man/8/ftpd_selinux Use this command instead
setsebool -P allow_ftpd_full_access 1
open file SELINUX file and disable it manually by:
#vi /etc/sysconfig/selinux
Edit:
SELINUX=disable
Then reboot OS