Howto Setup vsftp with SELinux
Vsftpd is a fast and secure FTP server. Installing an FTP server can assist you with uploading files to your droplet. This tutorial describes how to install and set up vsftpd on CentOS 6.
The first two letters of vsftpd stand for "very secure" and the program was built to have strongest protection against possible FTP vulnerabilities.
Step One: Install vsftpd with yum
Since vsftpd is included in the default yum repo's we will install this with yum.
yum install vsftpd -y
Once the files finish downloading, vsftpd will be on your server. Generally speaking, the server is already configured with a reasonable amount of security. However, it does provide access to anonymous users. We will not be needing the anonymous users, so we must disable this feature.
vim /etc/vsftpd/vsftpd.conf
To disable anonymous users with vsftpd adjust the following line to say NO.
anonymous_enable=NO
To enable local users to use vsftpd, you will need to change the following values.
chroot_local_user=YES
Now you will want to start the service and enable to auto start on bootup
service vsftpd restart
and
chkconfig vsftpd on
Configure SELinux for FTP
Lets first check and see what the SELinux options are and what the default values are.
getsebool -a | grep ftp
You should see something like the following
allow_ftpd_anon_write --> off allow_ftpd_full_access --> off allow_ftpd_use_cifs --> off allow_ftpd_use_nfs --> off ftp_home_dir --> off ftpd_connect_db --> off ftpd_use_fusefs --> off ftpd_use_passive_mode --> off httpd_enable_ftp_server --> off tftp_anon_write --> off tftp_use_cifs --> off tftp_use_nfs --> off
You will need to adjust the ftp_home_dir option and ftpd_use_passive_mode
setsebool -P ftp_home_dir on setsebool -P ftpd_use_passive_mode on
Configure IPTables for ftp
By default iptables only allows connections from port 22. This means that we will have to open port 21 and 20.
Allow FTP connections @ port 21
/sbin/iptables -A INPUT -p tcp --sport 21 -m state --state ESTABLISHED -j ACCEPT /sbin/iptables -A OUTPUT -p tcp --dport 21 -m state --state NEW,ESTABLISHED -j ACCEPT
Allow Active FTP Connections
/sbin/iptables -A INPUT -p tcp --sport 20 -m state --state ESTABLISHED,RELATED -j ACCEPT /sbin/iptables -A OUTPUT -p tcp --dport 20 -m state --state ESTABLISHED -j ACCEPT
Allow Passive FTP Connections
/sbin/iptables -A INPUT -p tcp --sport 1024: --dport 1024: -m state --state ESTABLISHED -j ACCEPT /sbin/iptables -A OUTPUT -p tcp --sport 1024: --dport 1024: -m state --state ESTABLISHED,RELATED -j ACCEPT
Now save them
/etc/init.d/iptables save
