Master FTP: Configure, Secure, and Manage File Transfers on Linux

FTP File Transfer Protocol

FTP (File Transfer Protocol) is a client‑server protocol that supports file upload and download.

FTP uses two TCP ports: 20 for data transfer and 21 for command exchange.

Working Modes

Active mode: Client contacts server on port 21, then server opens a data connection to the client on port 20.
Passive mode: Client requests a data port; the server opens a random port and the client connects to it.

Authentication modes supported by FTP:
- Anonymous: no verification required.
- Local users: use Linux system accounts.
- Virtual users: created solely for FTP access.

Downloading Files with wget

wget ftp://user1:[email protected]/1.txt

Local Mode Setup

# Restart vsftpd service
systemctl restart vsftpd.service

# Create a user
useradd user1
# Set password for the user (example)
passwd user1

# Client login using lftp
lftp 192.168.5.101
user user1
Password: ******
ls
pwd

# Upload a file
put /etc/passwd

# Download a file
get passwd

Anonymous Login

# Enable anonymous login in vsftpd.conf
anonymous_enable=YES

# Connect from client
ftp 192.168.5.101
Name (192.168.5.101:root): anonymous
Password:
Login successful.

Anonymous Upload

# Allow anonymous upload in vsftpd.conf
anon_upload_enable=YES

# Change directory permissions (avoid 777 on root)
chmod 777 /var/ftp/pub

# Upload a file
lftp 192.168.5.101:/pub
put passwd

Anonymous Delete

# Enable delete permissions in vsftpd.conf
anon_mkdir_write_enable=YES
anon_other_write_enable=YES

# Delete a file
rm passwd

Changing Local and Anonymous User Roots

# Add to vsftpd.conf
anon_root=/mnt
local_root=/mnt

# Adjust directory permissions
chmod 777 /mnt/data/

Downloading Files from FTP

# Set umask for anonymous uploads
anon_umask=022

# Download a file
lftp 192.168.5.101
cd data/
get passwd

Restricting Login to a Specific User

# Enable user list and set deny to NO
userlist_enable=YES
userlist_deny=NO

# Add allowed users to /etc/vsftpd/user_list (e.g., user1)

Chroot Restrictions (Prevent/Allow Escaping Root Directory)

# Prevent all users from leaving their FTP root
chroot_local_user=YES

# Allow specific users to escape the chroot
chroot_list_enable=YES
chroot_list_file=/etc/vsftpd/chroot_list
# Add user1 to chroot_list to allow escape

Configuring Virtual Users in vsftpd

# Example virtual user setup
guest_enable=YES
guest_username=vuser666
allow_writeable_chroot=YES
anon_upload_enable=YES

# Create virtual user database
vim /etc/vsftpd/logins.txt   # list of usernames and passwords
db_load -T -t hash -f /etc/vsftpd/logins.txt /etc/vsftpd/user.db

# Minimal PAM config for vsftpd
auth required pam_userdb.so db=/etc/vsftpd/user
account required pam_userdb.so db=/etc/vsftpd/user

# Test login
lftp 192.168.6.4
user zhangsan
cd redhat/
put /etc/profile