Setting up vsftpd with SELinux on CentOS requires configuring the FTP server, adjusting SELinux booleans, and opening firewall ports. This guide walks you through installing vsftpd, disabling anonymous access, enabling local user logins, and configuring both SELinux and iptables to allow FTP connections while maintaining server security.
Vsftpd (Very Secure FTP Daemon) is a lightweight, fast FTP server designed with security as a top priority. It provides a reliable way to transfer files to and from your server while protecting against common FTP vulnerabilities.
Installing vsftpd with YUM
Since vsftpd is available in the default CentOS repositories, you can install it quickly using the yum package manager. Run the following command as root or with sudo privileges:
yum install vsftpd -y
This command downloads and installs vsftpd along with all required dependencies. Once installation completes, the FTP server is ready for configuration.
Configuring vsftpd for Security
The default vsftpd configuration allows anonymous users, which poses a security risk. You should disable this feature and enable local user access instead.
Open the vsftpd configuration file:
vim /etc/vsftpd/vsftpd.conf
Locate and modify the following settings:
- Set anonymous_enable=NO to disable anonymous FTP access
- Set chroot_local_user=YES to restrict users to their home directories
The chroot setting prevents users from navigating outside their home directories, adding an important security layer.
Starting and Enabling vsftpd
After configuring vsftpd, restart the service to apply your changes:
service vsftpd restart
To ensure vsftpd starts automatically when your server boots, run:
chkconfig vsftpd on
Configuring SELinux for FTP Access
SELinux (Security-Enhanced Linux) enforces strict access controls that can block FTP operations by default. You need to adjust specific SELinux booleans to allow vsftpd to function properly.
First, check the current SELinux FTP settings:
getsebool -a | grep ftp
This command displays all FTP-related SELinux booleans and their current states. You should see options like ftp_home_dir, ftpd_use_passive_mode, and others, typically set to "off" by default.
Enabling Required SELinux Booleans
To allow users to access their home directories via FTP and enable passive mode connections, run these commands:
setsebool -P ftp_home_dir on
setsebool -P ftpd_use_passive_mode on
The -P flag makes these changes persistent across server reboots. Without it, the settings would revert after restarting your system.
Configuring iptables Firewall Rules
The Linux firewall (iptables) blocks FTP ports by default. You must open the necessary ports to allow FTP connections.
Opening Port 21 for FTP Control Connections
Port 21 handles FTP command and control traffic. Allow connections on this port with:
/sbin/iptables -A INPUT -p tcp --sport 21 -m state --state ESTABLISHED -j ACCEPT
/sbin/iptables -A OUTPUT -p tcp --dport 21 -m state --state NEW,ESTABLISHED -j ACCEPT
Allowing Active FTP Data Connections
Active FTP mode uses port 20 for data transfer. Configure iptables to allow these connections:
/sbin/iptables -A INPUT -p tcp --sport 20 -m state --state ESTABLISHED,RELATED -j ACCEPT
/sbin/iptables -A OUTPUT -p tcp --dport 20 -m state --state ESTABLISHED -j ACCEPT
Enabling Passive FTP Connections
Passive FTP mode uses high-numbered ports (1024 and above) for data transfer. Allow these connections with:
/sbin/iptables -A INPUT -p tcp --sport 1024: --dport 1024: -m state --state ESTABLISHED -j ACCEPT
/sbin/iptables -A OUTPUT -p tcp --sport 1024: --dport 1024: -m state --state ESTABLISHED,RELATED -j ACCEPT
Saving iptables Rules
After adding all firewall rules, save them to ensure they persist after reboot:
/etc/init.d/iptables save
This writes your current iptables configuration to disk so the rules reload automatically when your server restarts.
Testing Your FTP Server
After completing the configuration, test your FTP server by connecting with an FTP client. Create a test user account if you haven't already, and attempt to log in using their credentials. Verify that the user can upload and download files but cannot access directories outside their home folder.
Frequently Asked Questions
Why should I disable anonymous FTP access?
Anonymous FTP allows anyone to connect without credentials, creating a significant security risk. Disabling anonymous access ensures only authorized users with valid accounts can access your server, protecting your data from unauthorized access and potential misuse.
What is the difference between active and passive FTP modes?
Active FTP requires the server to initiate data connections back to the client, which often fails through firewalls. Passive FTP lets the client initiate all connections, making it more firewall-friendly. Most modern FTP clients use passive mode by default, so enabling both modes ensures maximum compatibility.
Do I need to configure both SELinux and iptables?
Yes, both provide different security layers. SELinux controls what applications can do on your system (mandatory access control), while iptables controls network traffic (firewall rules). Both must be configured correctly for vsftpd to function on a secured CentOS server.
How can I restrict FTP users to specific directories?
The chroot_local_user=YES setting automatically restricts users to their home directories. For more granular control, you can use the chroot_list_file option to specify which users should be chrooted and configure individual user permissions.
If you need assistance configuring vsftpd or have questions about FTP server setup, the OBHost support team is available 24/7. Contact us at https://www.obhost.net/contact or email support@obhost.org for expert help.
