An Ultimate Guide to Setting Up FTP Server to Allow Anonymous Logins

Configuring the FTP Server in Linux

At any point, you can refer to man vsftpd.conf for further configuration options. We will set the most common options and mention their purpose in this guide.

As with any other configuration file, it is important to make a backup copy of the original before making changes:

# cp /etc/vsftpd/vsftpd.conf /etc/vsftpd/vsftpd.conf.orig

Then open /etc/vsftpd/vsftpd.conf (the main configuration file) and edit the following options as indicated:

1. Make sure you allow anonymous access to the server (we will use the /storage/ftp directory for this example – that’s where we will store documents for anonymous users to access) without password:

anonymous_enable=YES
no_anon_password=YES
anon_root=/storage/ftp/

If you omit the last setting, the ftp directory will default to /var/ftp (the home directory of the dedicated ftp user that was created during installation).

2. To enable read-only access (thus disabling file uploads to the server), set the following variable to NO:

write_enable=NO

Important: Only use steps #3 and #4 if you choose to disable the anonymous logins.

3. Likewise, you may want to also allow local users to login with their system credentials to the FTP server. Later on this article we will show you how to restrict them to their respective home directories to store and retrieve files using FTP:

local_enable=YES

If SELinux is in enforcing mode, you will also need to set the ftp_home_dir flag to on so that FTP is allowed to write and read files to and from their home directories:

# getsebool ftp_home_dir

If not, you can enable it permanently with:

# setsebool -P ftp_home_dir 1

The expected output is shown below:

SELinux - Enable FTP on Home Directories

SELinux – Enable FTP on Home Directories

4. In order to restrict authenticated system users to their home directories, we will use:

chroot_local_user=YES
chroot_list_enable=YES
chroot_list_file=/etc/vsftpd/chroot_list

With the above chroot settings and an empty /etc/vsftpd/chroot_list file (which YOU need to create), you will restrict ALL system users to their home directories.

Important: Please note this still requires that you ensure that none of them has write permissions to the top directory.

If you want to allow a specific user (or more) outside their home directories, insert the usernames in /etc/vsftpd/chroot_list, one per line.

Best Affordable Linux and WordPress Services For Your Business
Outsource Your Linux and WordPress Project and Get it Promptly Completed Remotely and Delivered Online.

If You Appreciate What We Do Here On TecMint, You Should Consider:

  1. Stay Connected to: Twitter | Facebook | Google Plus
  2. Subscribe to our email updates: Sign Up Now
  3. Get your own self-hosted blog with a Free Domain at ($3.45/month).
  4. Become a Supporter - Make a contribution via PayPal
  5. Support us by purchasing our premium books in PDF format.
  6. Support us by taking our online Linux courses

We are thankful for your never ending support.

Gabriel Cánepa

Gabriel Cánepa is a GNU/Linux sysadmin and web developer from Villa Mercedes, San Luis, Argentina. He works for a worldwide leading consumer product company and takes great pleasure in using FOSS tools to increase productivity in all areas of his daily work.

Your name can also be listed here. Got a tip? Submit it here to become an TecMint author.

RedHat RHCE and RHCSA Certification Book
Linux Foundation LFCS and LFCE Certification Preparation Guide

You may also like...

12 Responses

  1. ImranK says:

    Hello, Just concerned a little if configuring NFS, FTP and DNS servers are going to be a part of the exam. Please confirm so that I would start re-doing or practicing the methods thoroughly.

  2. Piotr says:

    Hi Gabriel,

    first of all thank you for such a comprehensive manuals – they are just great.

    I think I found a little typo:
    pasv_max_port=15000
    pasv_min_port=15500

    It should be in reversed order – max 15500 and min 15000.

  3. Jalal Hajigholamali says:

    Hi,

    Thanks a lot for nice article

    i think “#” does not need on page 4

    # get vsftpd.conf.pdf

    • @Jalal,
      The pound sign, as used here, is a write-up convention to indicate that’s a command that should be typed in the terminal.
      If you mean this specific command does not need to be run as root, you’re right.
      @Ravi
      Please confirm.

      • Ravi Saive says:

        @Jalal,

        Like @Gabriel, said the signs are used for command indication only and you’re absolutely right, the pound sign is not necessary to have when using with ftp commands.

      • Axel says:

        What I understand from Jalal’s comment, is that the get command is written inside the ftp console, so the pound sign cannot be there. Instead it should be “ftp> get vsftpd.conf.pdf”.

        Correct me if I’m mistaken.

        • Gabriel A. Cánepa says:

          I believe you’re right. Having the pound sign there may lead to confusion, as it is not actually a Linux command but a FTP one. Perhaps a clarification at the proper place in this article should do the trick.

  4. Alex says:

    Good stuff Mr. Gabriel. Thank you

Got something to say? Join the discussion.

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.