Build a FTP Server on GCP VM with vsftpd

Introduction

Here are what this tutorial will cover

1. How to config vsftpd
2. Build a specific user that the FTP user only allows for accessing.
3. Config firewall-rules with gcloud shell

Environment

• GCP VM
• ubuntu 18.04

Install vsftpd

sudo apt install vsftpd

Config

• Open config file

  sudo vim /etc/vsftpd.conf

• The configuration

  # Example config file /etc/vsftpd.conf
  #
  # The default compiled in settings are fairly paranoid. This sample file
  # loosens things up a bit, to make the ftp daemon more usable.
  # Please see vsftpd.conf.5 for all compiled in defaults.
  #
  # READ THIS: This example file is NOT an exhaustive list of vsftpd options.
  # Please read the vsftpd.conf.5 manual page to get a full idea of vsftpd's
  # capabilities.
  #
  #
  # Run standalone?  vsftpd can run either from an inetd or as a standalone
  # daemon started from an initscript.
  listen=YES
  #
  # This directive enables listening on IPv6 sockets. By default, listening
  # on the IPv6 "any" address (::) will accept connections from both IPv6
  # and IPv4 clients. It is not necessary to listen on *both* IPv4 and IPv6
  # sockets. If you want that (perhaps because you want to listen on specific
  # addresses) then you must run two copies of vsftpd with two configuration
  # files.
  listen_ipv6=NO
  #
  # Allow anonymous FTP? (Disabled by default).
  anonymous_enable=NO
  #
  # Uncomment this to allow local users to log in.
  local_enable=YES
  #
  # Uncomment this to enable any form of FTP write command.
  write_enable=YES
  #
  # Default umask for local users is 077. You may wish to change this to 022,
  # if your users expect that (022 is used by most other ftpd's)
  local_umask=002
  #
  # Uncomment this to allow the anonymous FTP user to upload files. This only
  # has an effect if the above global write enable is activated. Also, you will
  # obviously need to create a directory writable by the FTP user.
  #anon_upload_enable=YES
  #
  # Uncomment this if you want the anonymous FTP user to be able to create
  # new directories.
  #anon_mkdir_write_enable=YES
  #
  # Activate directory messages - messages given to remote users when they
  # go into a certain directory.
  dirmessage_enable=YES
  #
  # If enabled, vsftpd will display directory listings with the time
  # in  your  local  time  zone.  The default is to display GMT. The
  # times returned by the MDTM FTP command are also affected by this
  # option.
  use_localtime=YES
  #
  # Activate logging of uploads/downloads.
  xferlog_enable=YES
  #
  # Make sure PORT transfer connections originate from port 20 (ftp-data).
  connect_from_port_20=NO
  #
  #Set to NO if you want to disallow the PASV method of obtaining a data connection.
  #Default: YES
  pasv_enable=YES
  # If you want, you can arrange for uploaded anonymous files to be owned by
  # a different user. Note! Using "root" for uploaded files is not
  # recommended!
  #chown_uploads=YES
  #chown_username=whoever
  #
  # You may override where the log file goes if you like. The default is shown
  # below.
  xferlog_file=/var/log/vsftpd.log
  #
  # If you want, you can have your log file in standard ftpd xferlog format.
  # Note that the default log file location is /var/log/xferlog in this case.
  xferlog_std_format=YES
  #
  # You may change the default value for timing out an idle session.
  #idle_session_timeout=600
  #
  # You may change the default value for timing out a data connection.
  #data_connection_timeout=120
  #
  # It is recommended that you define on your system a unique user which the
  # ftp server can use as a totally isolated and unprivileged user.
  #nopriv_user=ftpsecure
  #
  # Enable this and the server will recognise asynchronous ABOR requests. Not
  # recommended for security (the code is non-trivial). Not enabling it,
  # however, may confuse older FTP clients.
  #async_abor_enable=YES
  #
  # By default the server will pretend to allow ASCII mode but in fact ignore
  # the request. Turn on the below options to have the server actually do ASCII
  # mangling on files when in ASCII mode.
  # Beware that on some FTP servers, ASCII support allows a denial of service
  # attack (DoS) via the command "SIZE /big/file" in ASCII mode. vsftpd
  # predicted this attack and has always been safe, reporting the size of the
  # raw file.
  # ASCII mangling is a horrible feature of the protocol.
  #ascii_upload_enable=YES
  #ascii_download_enable=YES
  #
  # You may fully customise the login banner string:
  ftpd_banner="Welcome to QCDN's FTP server, feel free to upload whatever you would like to deploy on Website."
  #
  # You may specify a file of disallowed anonymous e-mail addresses. Apparently
  # useful for combatting certain DoS attacks.
  #deny_email_enable=YES
  # (default follows)
  #banned_email_file=/etc/vsftpd.banned_emails
  #
  # You may restrict local users to their home directories.  See the FAQ for
  # the possible risks in this before using chroot_local_user or
  # chroot_list_enable below.
  #chroot_local_user=YES
  #
  # You may specify an explicit list of local users to chroot() to their home
  # directory. If chroot_local_user is YES, then this list becomes a list of
  # users to NOT chroot().
  # (Warning! chroot'ing can be very dangerous. If using chroot, make sure that
  # the user does not have write access to the top level directory within the
  # chroot)
  chroot_local_user=YES
  chroot_list_enable=YES
  # (default follows)
  chroot_list_file=/etc/vsftpd.chroot_list
  #
  # You may activate the "-R" option to the builtin ls. This is disabled by
  # default to avoid remote users being able to cause excessive I/O on large
  # sites. However, some broken FTP clients such as "ncftp" and "mirror" assume
  # the presence of the "-R" option, so there is a strong case for enabling it.
  #ls_recurse_enable=YES
  #
  # Customization
  #
  # Some of vsftpd's settings don't fit the filesystem layout by
  # default.
  #
  # This option should be the name of a directory which is empty.  Also, the
  # directory should not be writable by the ftp user. This directory is used
  # as a secure chroot() jail at times vsftpd does not require filesystem
  # access.
  secure_chroot_dir=/var/run/vsftpd/empty
  #
  # This string is the name of the PAM service vsftpd will use.
  pam_service_name=vsftpd
  #
  # This option specifies the location of the RSA certificate to use for SSL
  # encrypted connections.
  rsa_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem
  rsa_private_key_file=/etc/ssl/private/ssl-cert-snakeoil.key
  ssl_enable=NO
  
  # Uncomment this to indicate that vsftpd use a utf8 filesystem.
  #utf8_filesystem=YES
  #
  #This option is useful is conjunction with virtual users. It is used to automatically generate a home directory for each virtual  user,  based
  #on a template. For example, if the home directory of the real user specified via guest_username is /home/virtual/$USER, and user_sub_token is
  #set to $USER, then when virtual user fred logs in, he will end up (usually chroot()'ed) in the  directory  /home/virtual/fred.   This  option
  #also takes affect if local_root contains 
  #Default: (none)
  user_sub_token=$USER
  
  #This option represents a directory which vsftpd will try to change into after  a  local  (i.e.  non-anonymous)  login.  Failure  is  silently
  #ignored.
  #Default: (none)
  local_root=/home/$USER/ftp
  
  #If vsftpd is in standalone mode, this is the port it will listen on for incoming FTP 
  #Default: 21
  listen_port=21212
  
  #The minimum port to allocate for PASV style data connections. Can be used to specify a narrow port range to assist firewalling.
  #Default: 0 (use any port)
  pasv_min_port=40000
  
  #The maximum port to allocate for PASV style data connections. Can be used to specify a narrow port range to assist firewalling.
  #Default: 0 (use any port)
  pasv_max_port=50000
  
  #If  enabled,  vsftpd will load a list of usernames, from the filename given by userlist_file.  If a user tries to log in using a name in this
  #file, they will be denied before they are asked for a password. This may be useful in preventing cleartext passwords being  transmitted.  See
  #also userlist_deny.
  #Default: NO
  userlist_enable=YES
  
  #This option is the name of the file loaded when the userlist_enable option is active.
  #Default: /etc/vsftpd.user_list
  userlist_file=/etc/vsftpd.userlist
  
  #This  option  is  examined  if  userlist_enable  is activated. If you set this setting to NO, then users will be denied login unless they are
  #explicitly listed in the file specified by userlist_file.  When login is denied, the denial is issued before the user is asked  for  a  pass‐
  #word.
  #Default: YES
  userlist_deny=NO
  
  #The maximum data transfer rate permitted, in bytes per second, for local authenticated users.
  #Default: 0 (unlimited)
  local_max_rate=10000000
  
  #Allow chroot have write permission
  allow_writeable_chroot=YES
  
  #If vsftpd is in standalone mode, this is the maximum number of clients which may be connected. Any additional clients connecting will get  an
  #error message.
  #Default: 0 (unlimited)
  max_clients=50
  
  #If vsftpd is in standalone mode, this is the maximum number of clients which may be connected from the same source internet address. A client
  #will get an error message if they go over this limit.
  #Default: 0 (unlimited)
  max_per_ip=5
  
  #If enabled, and vsftpd was compiled with tcp_wrappers support, incoming connections will be fed through tcp_wrappers access control. Further‐
  #more, there is a mechanism for per-IP based configuration. If tcp_wrappers sets the VSFTPD_LOAD_CONF environment variable,  then  the  vsftpd
  #session will try and load the vsftpd configuration file specified in this variable.
  #Default: NO
  tcp_wrappers=YES
  
  #If  enabled,  two log files are generated in parallel, going by default to /var/log/xferlog and /var/log/vsftpd.log.  The former is a wu-ftpd
  #style transfer log, parseable by standard tools. The latter is vsftpd's own style log.
  #Default: NO
  dual_log_enable=YES
  
  #This  option  is  the  name of the file to which we write the vsftpd style log file. This log is only written if the option xferlog_enable is
  #set, and xferlog_std_format is NOT set. Alternatively, it is written if you have set the option dual_log_enable.  One further complication  -
  #if you have set syslog_enable, then this file is not written and output is sent to the system log instead.
  #Default: /var/log/vsftpd.log
  vsftpd_log_file=/var/log/vsftpd.log

Create a user

sudo adduser test

And then enter the password, in this tutorial, 1234

Create relative config file

sudo touch /etc/vsftpd.chroot_list && sudo mkdir /home/test/ftp && sudo touch /etc/vsftpd.userlist && sudo touch /var/log/vsftpd.log

Authority

• I built this FTP server for my Frontend coworker and so they could upload the file as deployment, and that’s why I would put www-data in the mutual group. You could skip this part as it doesn’t has much to do with FTP set up.

• Build a mutual group
  The ftp folder is supposed to be accessed by only www-data, and user test

  sudo groupadd ftp_access

• Add user test and www-data into this group

  sudo usermod -a -G ftp_access test && sudo usermod -a -G ftp_access www-data

• Set up authority

  sudo find /home/test/ftp -type d -exec chmod 2770 {} \; && sudo find /home/test/ftp -type f -exec chmod 0664 {} \; && sudo chmod /home/test/ftp test:ftp_access

Specify user with access

echo 'test' > /etc/vsftpd.userlist

GCP firewall-rules configuration

Add tag to VM

• Personally, I prefer gcloud shell to manage the instances, there are two ways to get started
  • Install SDK via official
  • Or you could use gcloud shell web version provided by Google, 快速教學 在此
• If you are not familiar with gcloud, you could also config firewall-rules via website UI interface
• I will skip instance creating and login because they are not covered in this tutorial
• Add tags to VM

  gcloud compute instances add-tags instanceName \
  --tags test

  Config firewall-rules

• Create new firewall-rules per tag, so the firewall-rule will not be effective to all VMs
• Create communication port

  gcloud compute firewall-rules create ftp-communication --allow tcp:21212 --target-tags test

• Create rules for passive port range

  gcloud compute firewall-rules create ftp-dataportrange --allow tcp:40000-50000 --target-tags test

FTP connection

Install

• mac

  brew install inetutils

• ubuntu
  It should be already accessible

Connection

ftp -p yourIP 21212

• Key in user: test
• Key in password: 1234
• Try to upload a file

  put whateverFile

Conclusion

I enjoy in the quest for technology. However, sometimes I want to kill myself when I get stuck
I mentioned www-data and did some config on it because actually why I built this FTP server was for simple deployment on Frontend. I would config my NginX to point to this folder as kind of reverse proxy.
However, I think it should not be covered in this tutorial, so I would skip the NginX part

Reference

• The Linux guru in Asia
  http://linux.vbird.org/linux_server/0410vsftpd.php
• The guru from Digital Ocean community
  https://www.digitalocean.com/community/questions/proper-permissions-for-web-server-s-directory