FTP Setup

Overview

vsftpd (Very Secure FTP Daemon) provides FTP access to the same file directory used by WebDAV. Users are chroot-jailed to the WebDAV root directory.

  • Port 21 — FTP control connection

  • Ports 49000-55000 — FTP passive data connections

Automatic Installation

FTP is configured as part of the main install script:

sudo ./install-debian.sh --domain files.example.com --user friendly

What the Script Does

  1. Installs vsftpd

  2. Creates configuration directories under /etc/vsftpd/

  3. Deploys vsftpd.conf from the appropriate template (Debian or CentOS)

  4. Creates user list, chroot list, and ftpusers files

  5. Creates a system user with /usr/sbin/nologin shell

  6. Configures per-user settings pointing to the WebDAV root

  7. Disables pam_shells.so in PAM to allow nologin users

  8. Enables and starts the vsftpd service

Configuration Files

File Purpose

/etc/vsftpd.conf (Debian)
/etc/vsftpd/vsftpd.conf (CentOS)

Main vsftpd configuration

/etc/vsftpd/user_list

Allowed FTP users (whitelist)

/etc/vsftpd/ftpusers

Denied FTP users (blacklist)

/etc/vsftpd/chroot_list

Users exempt from chroot jail

/etc/vsftpd/users/<username>

Per-user settings (e.g., local_root)

Key Settings

# Security
anonymous_enable=NO          # No anonymous access
local_enable=YES             # Allow local users
chroot_local_user=YES        # Jail users to their home directory
allow_writeable_chroot=YES   # Allow writes in chroot directory

# User filtering
userlist_enable=YES          # Enable user whitelist
userlist_deny=NO             # Whitelist mode (only listed users allowed)

# Passive mode
pasv_min_port=49000          # Passive port range start
pasv_max_port=55000          # Passive port range end

# Permissions
local_umask=0000             # No umask restriction
file_open_mode=0777          # Full permissions on created files
force_dot_files=YES          # Show hidden files

Passive Mode Note

FTP passive mode requires the client to connect back to the server on a port from the configured range (49000-55000). This range must be open in the firewall.

For high-concurrency scenarios (e.g., 5000+ concurrent firmware transfers), each active transfer uses one passive port. The default range of 6001 ports supports up to 6001 simultaneous transfers.

Verification

# Connect via FTP
ftp files.example.com

# Or use lftp for scripted access
lftp -u friendly,password ftp://files.example.com/