Linucate
~ Linucate_

212.2 Managing FTP servers

All Levels

Introduction

FTP uses a control connection and separate data connections, which makes firewalling more complex than many modern protocols. Plain FTP does not protect credentials or content; prefer SFTP or another encrypted transfer method when possible.

What you should be able to do after this lesson:

  • Explain active and passive FTP.
  • Configure basic vsftpd behavior.
  • Control local and anonymous users.
  • Secure an anonymous upload area.
  • Recognize Pure-FTPd and ProFTPD roles.
  • Diagnose data-channel and permission failures.

Big Idea: FTP Negotiates a Second Connection

Authentication and directory listing do not travel entirely over one connection. The control session negotiates a separate data path. Diagnose them independently:

TCP 21 control and login -> active or passive negotiation -> separate data connection

This explains why a client can log in successfully but hang when listing or transferring files.

Control and Data Connections

The client opens the control connection to TCP port 21.

  • In active mode, the server initiates the data connection back to a client-provided address and port.
  • In passive mode, the server listens on a selected high port and the client opens the data connection.

Passive mode usually works more predictably through client-side NAT and firewalls, but the server firewall must permit the configured passive port range.

Basic vsftpd Configuration

The main file is commonly /etc/vsftpd.conf or /etc/vsftpd/vsftpd.conf.

listen=YES
anonymous_enable=NO
local_enable=YES
write_enable=YES
chroot_local_user=YES
pasv_min_port=30000
pasv_max_port=30100

Validate paths, ownership, and distribution-specific service behavior before restart.

Anonymous Access

Read-only anonymous downloads are safer than uploads. If uploads are required:

  • use a dedicated directory not readable or executable by anonymous users
  • prevent uploaded files from being served or executed directly
  • apply quotas and file-size limits
  • scan and moderate content
  • log and monitor abuse

Never make the FTP service root broadly writable merely to fix an upload error.

TLS and Alternatives

FTPS adds TLS to FTP but retains separate data-channel complexity. SFTP is a different protocol carried through SSH and does not use an FTP daemon.

Other Servers

Pure-FTPd uses configuration files or command-line options depending on packaging. Important startup choices control anonymous access, chroot behavior, passive port ranges, authentication backends, and limits. Inspect the actual service command line because wrapper scripts may translate individual config files into options. ProFTPD provides an Apache-like configuration style. Security principles remain consistent: least privilege, encrypted authentication, restricted roots, and explicit network policy.

Troubleshooting

  1. Confirm control connection and authentication.
  2. Determine active or passive mode.
  3. Inspect the negotiated data address and port.
  4. Check firewall and NAT behavior.
  5. Verify chroot paths and filesystem permissions.
  6. Review service logs.

Guided Practice: Observe Active and Passive Modes

Use only an isolated FTP lab with test credentials. Capture the server while a client logs in and lists a directory:

sudo tcpdump -ni <interface> 'tcp port 21 or tcp portrange 30000-30100'

Force passive mode first and identify the server's advertised address and high port. Verify that the client initiates both control and data connections. Then test active mode and observe the server initiate the data connection toward the client.

Create separate read-only download and isolated upload directories for an anonymous test. Confirm that uploaded files cannot be executed or immediately downloaded by another anonymous client.

Troubleshooting Scenario

Remote users authenticate successfully but directory listings time out. The server advertises its private address in passive replies and the firewall blocks its passive range.

Configure the externally reachable passive address where required, define a bounded passive range, allow that range through NAT/firewall, and capture again. Resetting user passwords would not affect the separate data connection.

Exam Focus

  • Distinguish active and passive data-connection direction.
  • Know common vsftpd.conf controls and important Pure-FTPd startup choices.
  • Design anonymous downloads and uploads with different risk controls.
  • Recognize ProFTPD and remember that SFTP is an SSH protocol, not FTP over SSH.

Recap

  • FTP needs separate control and data paths.
  • Passive mode requires an allowed server-side port range.
  • Anonymous uploads need isolation and monitoring.
  • SFTP is part of SSH, not a secure mode of FTP.
🎯

Test Your Knowledge

Complete the quiz to assess your understanding of this course's concepts.

Back home