> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/linux-server-administrator/servers-configurations-centos7/file-transfer-protocol-ftp.md).

# File Transfer Protocol (FTP)

File Transfer Protocol (FTP) is a standard network protocol used to transfer files between a client and a server over a TCP-based network, such as the internet. The default port for FTP servers is TCP port 21.

***

### FTP Client Tool

* **Install FTP client tool:**

  ```bash
  yum install ftp
  ```
* **Connect to an FTP server:**

  ```bash
  ftp ftp_connection_ip
  ```

### FTP Server Tool

* **Install vsftpd:**

  ```bash
  yum install vsftpd
  ```

### Configuration Files

* **Main configuration file:**

  ```bash
  /etc/vsftpd/vsftpd.conf
  ```
* **Public file directory for anonymous users:**

  ```bash
  /var/ftp/pub
  ```

### Enable Passive Mode

Passive mode allows the client to initiate the data connection to the server rather than the server initiating the connection.

* **Edit vsftpd.conf:**

  ```bash
  vim /etc/vsftpd/vsftpd.conf
  ```
* **Add the following lines:**

  ```
  pasv_enable=YES
  pasv_min_port=55000
  pasv_max_port=55999
  ```

### Allow Ports in iptables

* **Edit the iptables file:**

  ```bash
  vim /etc/sysconfig/iptables
  ```
* **Add the following rules:**

  ```
  -A INPUT -p tcp --dport 21 -j ACCEPT
  -A INPUT -p tcp --dport 55000:55999 -j ACCEPT
  ```
* **Restart iptables service:**

  ```bash
  systemctl restart iptables.service
  ```

#### Start vsftpd Service

* **Start vsftpd service:**

  ```bash
  systemctl start vsftpd
  ```
* **Enable vsftpd to start automatically at boot time:**

  ```bash
  systemctl enable vsftpd
  ```
* **Default users:**
  * `anonymous`
  * `ftp`

### Block Default User

* **Edit the configuration file:**

  ```bash
  vim /etc/vsftpd/vsftpd.conf
  ```
* **Search for `anonymous_enable=YES` and change it to `anonymous_enable=NO`.**

### Unlock Default User

* **Edit the configuration file:**

  ```bash
  vim /etc/vsftpd/vsftpd.conf
  ```
* **Search for `anonymous_enable=NO` and change it to `anonymous_enable=YES`.**
* **Restart the service:**

  ```bash
  systemctl restart vsftpd.service
  ```

#### Unblock Regular User

* **Edit the configuration file:**

  ```bash
  vim /etc/vsftpd/vsftpd.conf
  ```
* **Uncomment the following line:**

  ```
  chroot_local_user=YES
  ```
* **Add the following line at the end:**

  ```
  allow_writeable_chroot=YES
  ```
* **Restart the service:**

  ```bash
  systemctl restart vsftpd.service
  ```

#### Unblock Root User

* **Comment out the root user in the following files:**

  ```bash
  vim /etc/vsftpd/user_list
  vim /etc/vsftpd/ftpusers
  ```
* **Restart the service:**

  ```bash
  systemctl restart vsftpd.service
  ```

### Block Root User

* **Uncomment the root user in the following files:**

  ```bash
  vim /etc/vsftpd/user_list
  vim /etc/vsftpd/ftpusers
  ```
* **Restart the service:**

  ```bash
  systemctl restart vsftpd.service
  ```

### Change Default Directory

* **Create a folder for users:**

  ```bash
  mkdir /folder_name
  ```
* **Edit the vsftpd.conf file:**

  ```bash
  vim /etc/vsftpd/vsftpd.conf
  ```
* **Add the following line:**

  ```
  local_root=/folder_name
  ```
* **Restart the service:**

  ```bash
  systemctl restart vsftpd.service
  ```

### Deny List

A deny list is a list of users who are not allowed to access the FTP server.

* **Edit the following files:**

  ```bash
  vim /etc/vsftpd/user_list
  vim /etc/vsftpd/ftpusers
  ```
* **Restart the service:**

  ```bash
  systemctl restart vsftpd.service
  ```

### Allow List

To configure an allow list:

* **Create an allow users file:**

  ```bash
  vim /etc/vsftpd/allow_users
  ```
* **Add users to this file.**
* **Edit the main configuration file:**

  ```bash
  vim /etc/vsftpd/vsftpd.conf
  ```
* **Search for `chroot_local_user=YES` and comment out this line.**
* **Add the following lines:**

  ```
  userlist_enable=YES
  userlist_file=/etc/vsftpd/allow_users
  userlist_deny=NO
  ```
* **Restart the service:**

  ```bash
  systemctl restart vsftpd.service
  ```