FTP (File Transfer Protocol) is an older networking protocol to, you guessed it, transfer files. Due to the way FTP works, there is a 'data channel' and a 'command channel'. The Command Channel runs on Port 21 and is used to pass information about the session, while the Data Channel is where the file transfer actually happens.
Due to this two-channel setup, the inherent insecurities of a non-encrypted data stream, and the complexities of a Firewall and the NAT system and whatnot, FTP is slowly being replaced by SFTP which uses a single port (22) and the SSH protocol to transfer files. But since SFTP isn't everywhere (especially on Windows machines), FTP is still needed.
Let's add some more complexities: Active vs Passive FTP. In Active FTP, the Data Channel is on Port 20 and it is initiated by the FTP Server. This is nice because the Server's firewall has a known port (port 20) that needs to be opened. Unfortunately, this requires the client's firewall be wide open to listen for that incoming connection, which may be blocked. Some firewalls will expect these connections, however, and permit the access.
Passive FTP, on the other hand, has the
client initiate the data connection. This works to not open wide the firewall on the client network, but requires that the FTP Server's firewall has holes. Since the server will only be set up once for multiple clients, this can be a better method than expecting everyone to open their firewall.
An issue with Passive FTP behind a firewall, however, is that the server is initiating the connection using its own, private IP. With normal FTP, apparently the firewall may rewrite these packets. But with FTPS, which is secured using an SSL certificate, this data is encrypted and the firewall cannot make those packet changes.
VSFTP on Debian GNU/Linux allows us to set up Passive FTP on a NAT system with FTPS (or FTPES, meaning "explicit SSL" which is Port 21 still. There is also FTPS on port 990, which uses implicit SSL, and this HowTo doesn't cover that.)
First install VSFTP:
# aptitude update# aptitude install vsftpd
Now we'll make a self-signed SSL Certificate:
# mkdir /etc/vsftpd# cd /etc/vsftpd# openssl req -new -x509 -days 9999 -nodes -out vsftpd.pem -keyout vsftpd.pem
Answer the questions and when you're done you'll have a file named
/etc/vsftpd/vsftpd.pem
Edit the
/etc/vsftpd.conf file to have these options, which of course you can adjust:
listen=YES
anonymous_enable=NO
local_enable=YES
write_enable=YES
local_umask=022
dirmessage_enable=YES
xferlog_enable=YES
pasv_enable=YES
pasv_address=66.44.55.66
pasv_min_port=24000
pasv_max_port=24100
syslog_enable=NO
log_ftp_protocol=YES
chroot_local_user=YES
secure_chroot_dir=/var/run/vsftpd
pam_service_name=vsftpd
ssl_enable=YES
rsa_cert_file=/etc/vsftpd/vsftpd.pem
force_local_data_ssl=YES
allow_anon_ssl=NO
force_local_data_ssl=YES
force_local_logins_ssl=YES
ssl_tlsv1=YES
ssl_sslv2=YES
ssl_sslv3=YES
ssl_ciphers=HIGH
Note this line (below); this will allow VSFTP to rewrite its own passive packets to allow for that data channel to function. Set this as the firewall's external IP, not the 66.44.55.66 example I have here:
pasv_address=66.44.55.66
In your firewall, allow these ports through and port-forward them to this same internal server:
pasv_min_port=24000pasv_max_port=24100
Now you need to add a user to your system:
adduser ftpusername
If you want to prevent this user from logging in with SSH or at a console, you'll need to set this user to not have a shell (aka, set to /bin/false ) in
/etc/passwd:
ftpusername:1001:1001::/home/ftpusername:/bin/false
and make sure that is a valid (even though fake) shell option in
/etc/shells:
....../bin/false...
Finally, we'll turn off VSFTP's checking of the shell access in the file
/etc/pam.d/vsftpd by commenting out (putting a #) the line:
#auth required pam_shells.so
We'll restart VSFTP
# /etc/init.d/vsftpd restart
and we should now be able to use FTPS from another computer, assuming you have your Firewall and Port Forwarding set up correctly for port 21 and ports 24000-24100 (or whatever you set in vsftpd.conf).
Instructions for connecting with various options (Dolphin, FileZilla, and cURL) can be found here.
More about FTP here
More about FTPS in VSFTP here
More about VSFTP logging here and conf options here
More about disabling PAM authentication to allow VSFTP to use /bin/false here
Thanks everyone who has written about this elsewhere and thanks to the developers of VSFTP.
