Build a FTP Server on GCP VM with vsftpd

Introduction

Here are what this tutorial will cover

  1. How to config vsftpd
  2. Build a specific user that the FTP user only allows for accessing.
  3. Config firewall-rules with gcloud shell

Environment

  • GCP VM
  • ubuntu 18.04

Install vsftpd

sudo apt install vsftpd

Config

  • Open config file

    sudo vim /etc/vsftpd.conf
  • The configuration

    # Example config file /etc/vsftpd.conf
    #
    # The default compiled in settings are fairly paranoid. This sample file
    # loosens things up a bit, to make the ftp daemon more usable.
    # Please see vsftpd.conf.5 for all compiled in defaults.
    #
    # READ THIS: This example file is NOT an exhaustive list of vsftpd options.
    # Please read the vsftpd.conf.5 manual page to get a full idea of vsftpd's
    # capabilities.
    #
    #
    # Run standalone? vsftpd can run either from an inetd or as a standalone
    # daemon started from an initscript.
    listen=YES
    #
    # This directive enables listening on IPv6 sockets. By default, listening
    # on the IPv6 "any" address (::) will accept connections from both IPv6
    # and IPv4 clients. It is not necessary to listen on *both* IPv4 and IPv6
    # sockets. If you want that (perhaps because you want to listen on specific
    # addresses) then you must run two copies of vsftpd with two configuration
    # files.
    listen_ipv6=NO
    #
    # Allow anonymous FTP? (Disabled by default).
    anonymous_enable=NO
    #
    # Uncomment this to allow local users to log in.
    local_enable=YES
    #
    # Uncomment this to enable any form of FTP write command.
    write_enable=YES
    #
    # Default umask for local users is 077. You may wish to change this to 022,
    # if your users expect that (022 is used by most other ftpd's)
    local_umask=002
    #
    # Uncomment this to allow the anonymous FTP user to upload files. This only
    # has an effect if the above global write enable is activated. Also, you will
    # obviously need to create a directory writable by the FTP user.
    #anon_upload_enable=YES
    #
    # Uncomment this if you want the anonymous FTP user to be able to create
    # new directories.
    #anon_mkdir_write_enable=YES
    #
    # Activate directory messages - messages given to remote users when they
    # go into a certain directory.
    dirmessage_enable=YES
    #
    # If enabled, vsftpd will display directory listings with the time
    # in your local time zone. The default is to display GMT. The
    # times returned by the MDTM FTP command are also affected by this
    # option.
    use_localtime=YES
    #
    # Activate logging of uploads/downloads.
    xferlog_enable=YES
    #
    # Make sure PORT transfer connections originate from port 20 (ftp-data).
    connect_from_port_20=NO
    #
    #Set to NO if you want to disallow the PASV method of obtaining a data connection.
    #Default: YES
    pasv_enable=YES
    # If you want, you can arrange for uploaded anonymous files to be owned by
    # a different user. Note! Using "root" for uploaded files is not
    # recommended!
    #chown_uploads=YES
    #chown_username=whoever
    #
    # You may override where the log file goes if you like. The default is shown
    # below.
    xferlog_file=/var/log/vsftpd.log
    #
    # If you want, you can have your log file in standard ftpd xferlog format.
    # Note that the default log file location is /var/log/xferlog in this case.
    xferlog_std_format=YES
    #
    # You may change the default value for timing out an idle session.
    #idle_session_timeout=600
    #
    # You may change the default value for timing out a data connection.
    #data_connection_timeout=120
    #
    # It is recommended that you define on your system a unique user which the
    # ftp server can use as a totally isolated and unprivileged user.
    #nopriv_user=ftpsecure
    #
    # Enable this and the server will recognise asynchronous ABOR requests. Not
    # recommended for security (the code is non-trivial). Not enabling it,
    # however, may confuse older FTP clients.
    #async_abor_enable=YES
    #
    # By default the server will pretend to allow ASCII mode but in fact ignore
    # the request. Turn on the below options to have the server actually do ASCII
    # mangling on files when in ASCII mode.
    # Beware that on some FTP servers, ASCII support allows a denial of service
    # attack (DoS) via the command "SIZE /big/file" in ASCII mode. vsftpd
    # predicted this attack and has always been safe, reporting the size of the
    # raw file.
    # ASCII mangling is a horrible feature of the protocol.
    #ascii_upload_enable=YES
    #ascii_download_enable=YES
    #
    # You may fully customise the login banner string:
    ftpd_banner="Welcome to QCDN's FTP server, feel free to upload whatever you would like to deploy on Website."
    #
    # You may specify a file of disallowed anonymous e-mail addresses. Apparently
    # useful for combatting certain DoS attacks.
    #deny_email_enable=YES
    # (default follows)
    #banned_email_file=/etc/vsftpd.banned_emails
    #
    # You may restrict local users to their home directories. See the FAQ for
    # the possible risks in this before using chroot_local_user or
    # chroot_list_enable below.
    #chroot_local_user=YES
    #
    # You may specify an explicit list of local users to chroot() to their home
    # directory. If chroot_local_user is YES, then this list becomes a list of
    # users to NOT chroot().
    # (Warning! chroot'ing can be very dangerous. If using chroot, make sure that
    # the user does not have write access to the top level directory within the
    # chroot)
    chroot_local_user=YES
    chroot_list_enable=YES
    # (default follows)
    chroot_list_file=/etc/vsftpd.chroot_list
    #
    # You may activate the "-R" option to the builtin ls. This is disabled by
    # default to avoid remote users being able to cause excessive I/O on large
    # sites. However, some broken FTP clients such as "ncftp" and "mirror" assume
    # the presence of the "-R" option, so there is a strong case for enabling it.
    #ls_recurse_enable=YES
    #
    # Customization
    #
    # Some of vsftpd's settings don't fit the filesystem layout by
    # default.
    #
    # This option should be the name of a directory which is empty. Also, the
    # directory should not be writable by the ftp user. This directory is used
    # as a secure chroot() jail at times vsftpd does not require filesystem
    # access.
    secure_chroot_dir=/var/run/vsftpd/empty
    #
    # This string is the name of the PAM service vsftpd will use.
    pam_service_name=vsftpd
    #
    # This option specifies the location of the RSA certificate to use for SSL
    # encrypted connections.
    rsa_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem
    rsa_private_key_file=/etc/ssl/private/ssl-cert-snakeoil.key
    ssl_enable=NO

    # Uncomment this to indicate that vsftpd use a utf8 filesystem.
    #utf8_filesystem=YES
    #
    #This option is useful is conjunction with virtual users. It is used to automatically generate a home directory for each virtual user, based
    #on a template. For example, if the home directory of the real user specified via guest_username is /home/virtual/$USER, and user_sub_token is
    #set to $USER, then when virtual user fred logs in, he will end up (usually chroot()'ed) in the directory /home/virtual/fred. This option
    #also takes affect if local_root contains
    #Default: (none)
    user_sub_token=$USER

    #This option represents a directory which vsftpd will try to change into after a local (i.e. non-anonymous) login. Failure is silently
    #ignored.
    #Default: (none)
    local_root=/home/$USER/ftp

    #If vsftpd is in standalone mode, this is the port it will listen on for incoming FTP
    #Default: 21
    listen_port=21212

    #The minimum port to allocate for PASV style data connections. Can be used to specify a narrow port range to assist firewalling.
    #Default: 0 (use any port)
    pasv_min_port=40000

    #The maximum port to allocate for PASV style data connections. Can be used to specify a narrow port range to assist firewalling.
    #Default: 0 (use any port)
    pasv_max_port=50000

    #If enabled, vsftpd will load a list of usernames, from the filename given by userlist_file. If a user tries to log in using a name in this
    #file, they will be denied before they are asked for a password. This may be useful in preventing cleartext passwords being transmitted. See
    #also userlist_deny.
    #Default: NO
    userlist_enable=YES

    #This option is the name of the file loaded when the userlist_enable option is active.
    #Default: /etc/vsftpd.user_list
    userlist_file=/etc/vsftpd.userlist

    #This option is examined if userlist_enable is activated. If you set this setting to NO, then users will be denied login unless they are
    #explicitly listed in the file specified by userlist_file. When login is denied, the denial is issued before the user is asked for a pass‐
    #word.
    #Default: YES
    userlist_deny=NO

    #The maximum data transfer rate permitted, in bytes per second, for local authenticated users.
    #Default: 0 (unlimited)
    local_max_rate=10000000

    #Allow chroot have write permission
    allow_writeable_chroot=YES

    #If vsftpd is in standalone mode, this is the maximum number of clients which may be connected. Any additional clients connecting will get an
    #error message.
    #Default: 0 (unlimited)
    max_clients=50

    #If vsftpd is in standalone mode, this is the maximum number of clients which may be connected from the same source internet address. A client
    #will get an error message if they go over this limit.
    #Default: 0 (unlimited)
    max_per_ip=5

    #If enabled, and vsftpd was compiled with tcp_wrappers support, incoming connections will be fed through tcp_wrappers access control. Further‐
    #more, there is a mechanism for per-IP based configuration. If tcp_wrappers sets the VSFTPD_LOAD_CONF environment variable, then the vsftpd
    #session will try and load the vsftpd configuration file specified in this variable.
    #Default: NO
    tcp_wrappers=YES

    #If enabled, two log files are generated in parallel, going by default to /var/log/xferlog and /var/log/vsftpd.log. The former is a wu-ftpd
    #style transfer log, parseable by standard tools. The latter is vsftpd's own style log.
    #Default: NO
    dual_log_enable=YES

    #This option is the name of the file to which we write the vsftpd style log file. This log is only written if the option xferlog_enable is
    #set, and xferlog_std_format is NOT set. Alternatively, it is written if you have set the option dual_log_enable. One further complication -
    #if you have set syslog_enable, then this file is not written and output is sent to the system log instead.
    #Default: /var/log/vsftpd.log
    vsftpd_log_file=/var/log/vsftpd.log

Create a user

sudo adduser test

And then enter the password, in this tutorial, 1234

Create relative config file

sudo touch /etc/vsftpd.chroot_list && sudo mkdir /home/test/ftp && sudo touch /etc/vsftpd.userlist && sudo touch /var/log/vsftpd.log

Authority

  • I built this FTP server for my Frontend coworker and so they could upload the file as deployment, and that’s why I would put www-data in the mutual group. You could skip this part as it doesn’t has much to do with FTP set up.
  • Build a mutual group
    The ftp folder is supposed to be accessed by only www-data, and user test

    sudo groupadd ftp_access
  • Add user test and www-data into this group

    sudo usermod -a -G ftp_access test && sudo usermod -a -G ftp_access www-data
  • Set up authority

    sudo find /home/test/ftp -type d -exec chmod 2770 {} \; && sudo find /home/test/ftp -type f -exec chmod 0664 {} \; && sudo chmod /home/test/ftp test:ftp_access

Specify user with access

echo 'test' > /etc/vsftpd.userlist

GCP firewall-rules configuration

Add tag to VM

  • Personally, I prefer gcloud shell to manage the instances, there are two ways to get started
    • Install SDK via official
    • Or you could use gcloud shell web version provided by Google, 快速教學 在此
  • If you are not familiar with gcloud, you could also config firewall-rules via website UI interface
  • I will skip instance creating and login because they are not covered in this tutorial
  • Add tags to VM
    gcloud compute instances add-tags instanceName \
    --tags test

Config firewall-rules

  • Create new firewall-rules per tag, so the firewall-rule will not be effective to all VMs
  • Create communication port

    gcloud compute firewall-rules create ftp-communication --allow tcp:21212 --target-tags test
  • Create rules for passive port range

    gcloud compute firewall-rules create ftp-dataportrange --allow tcp:40000-50000 --target-tags test

FTP connection

Install

  • mac

    brew install inetutils
  • ubuntu
    It should be already accessible

Connection

ftp -p yourIP 21212
  • Key in user: test
  • Key in password: 1234
  • Try to upload a file
    put whateverFile

Conclusion

I enjoy in the quest for technology. However, sometimes I want to kill myself when I get stuck
I mentioned www-data and did some config on it because actually why I built this FTP server was for simple deployment on Frontend. I would config my NginX to point to this folder as kind of reverse proxy.
However, I think it should not be covered in this tutorial, so I would skip the NginX part

Reference

Automatically sign and renew SSL cert with Let's Encrypt pm2 - My learning note

Comments

Your browser is out-of-date!

Update your browser to view this website correctly. Update my browser now

×