Set up an FTP server on a Linux instance

Step 1: Install vsftpd

1. Update the system and install vsftpd.

   sudo yum update -y 
   sudo yum install vsftpd -y

2. Start vsftpd and enable it on boot.

   sudo systemctl start vsftpd
   sudo systemctl enable vsftpd 

3. Verify the service is running.

   netstat -antup | grep ftp

   The following output confirms vsftpd is running.

   [root@xxx ~]# systemctl start vsftpd
   [root@xxx ~]# netstat -antup | grep ftp
   tcp6       0      0 :::21                   :::*                    LISTEN      16387/vsftpd

   By default, vsftpd allows anonymous read-only access.

Step 2: Configure vsftpd

1. Create an FTP user. This example uses ftpuser.

   sudo useradd -d /data/ftp -s /sbin/nologin ftpuser  # Specify the home directory and disable shell access
   sudo passwd ftpuser 

2. Create the FTP directory and set permissions.

   sudo mkdir -p /data/ftp      # Create a custom storage directory
   sudo chown ftpuser:ftpuser /data/ftp
   sudo chmod 750 /data/ftp    # Permissions must be 755 or 750

3. Edit the vsftpd configuration file.

   Note

   Use passive mode. Most clients are behind firewalls or NAT and cannot expose real IP addresses.

   1. Back up the vsftpd configuration file.

      sudo cp /etc/vsftpd/vsftpd.conf  /etc/vsftpd/vsftpd.conf.bak

   2. Edit the configuration file.

      sudo vim /etc/vsftpd/vsftpd.conf

   3. Set the basic security configuration.

      listen=YES                   # Enable IPv4 listener
      anonymous_enable=NO          # Disable anonymous access
      local_enable=YES             # Enable local user logon
      write_enable=YES             # Allow file uploads
      chroot_local_user=YES        # Lock users to their home directory
      allow_writeable_chroot=YES   # Resolve chroot write errors

   4. Append the passive mode configuration.

      pasv_enable=YES              # Enable passive mode
      pasv_min_port=40000          # Lower limit of the passive port range
      pasv_max_port=40100          # Upper limit of the passive port range
      pasv_address=public_ip_address      # Must be set to the server's public IP address

4. Restart vsftpd.

   sudo systemctl restart vsftpd

Step 3: Set security group rules

Add inbound security group rules for the FTP mode you configured. Add a security group rule.

In active mode, clients behind NAT must expose real IP addresses, which may cause connection failures.

• Active mode: Allow traffic on port 21.

• Passive mode: Allow traffic on port 21 and ports 40000–40100 (pasv_min_port to pasv_max_port in /etc/vsftpd/vsftpd.conf). Configuring FTP passive mode ports.

Step 4: Verify the FTP service

Verify the FTP service using an FTP client, browser, or file explorer. This example uses the file explorer.

1. Test the local connection.

   Run the following command on the server.

   ftp ftpuser@localhost 

   A Login successful message confirms the connection.

   # ftp ftpuser@localhost
   Connected to localhost.
   220 (vsFTPd 3.0.5)
   331 Please specify the password.
   Password:
   230 Login successful.
   Remote system type is UNIX.
   Using binary mode to transfer files.

2. Test the client connection.

   On your client machine, open the file explorer and enter the FTP address in the address bar.

   The address format is ftp://<FTP_server_public_IP_address>:21. After a successful connection, the file explorer will display the files in the FTP server's directory.

   Enter the FTP username and password to log on. You can then upload and download files.

Step 1: Install vsftpd

1. Update the system and install vsftpd.

   sudo apt update && sudo apt upgrade -y
   sudo apt install vsftpd -y

2. Start vsftpd and enable it on boot.

   sudo systemctl start vsftpd
   sudo systemctl enable vsftpd

Step 2: Configure vsftpd

1. Create a dedicated FTP user.

   sudo useradd -m -s /bin/bash ftpuser  # Create a user and automatically generate a home directory
   sudo passwd ftpuser  # Set the user password (a strong password is recommended)

2. Create the file storage directory and set permissions.

   sudo mkdir /home/ftpuser/ftp-files
   sudo chown ftpuser:ftpuser /home/ftpuser/ftp-files
   sudo chmod 755 /home/ftpuser/ftp-files

3. Back up the original configuration file.

   sudo cp /etc/vsftpd.conf /etc/vsftpd.conf.bak

4. Edit the configuration file.

   sudo nano /etc/vsftpd.conf

   Apply the following settings:

   # Basic configuration
   listen=YES
   anonymous_enable=NO          # Disable anonymous access
   local_enable=YES             # Allow local user logon
   write_enable=YES             # Enable write permissions
   chroot_local_user=YES        # Lock users in their home directory

   Append the following:

   allow_writeable_chroot=YES   # Allow writing to the chroot directory
   local_root=/home/ftpuser/ftp-files  # Specify the root directory for the ftp user
   # Passive mode configuration (to resolve external network connection issues)
   pasv_enable=YES
   pasv_address=  # Replace with your public IP address
   pasv_min_port=40000
   pasv_max_port=40100

5. Restart vsftpd.

   sudo systemctl restart vsftpd

6. vsftpd creates a default ftp user without a password. Set a password for this user.

    sudo passwd ftp

   Set a strong password and skip all other prompts.

7. Add the user to the FTP user allowlist.

    echo "ftp" | sudo tee -a /etc/vsftpd.userlist

8. Create an FTP directory and set permissions.

   1. Create an FTP folder.

       sudo mkdir /home/ftp

   2. Set folder permissions.

      This grants full permissions (777). Adjust as needed.

       sudo chmod 777 /home/ftp

Step 3: Set security group rules

Add inbound security group rules for the FTP mode you configured. Add a security group rule.

In active mode, clients behind NAT must expose real IP addresses, which may cause connection failures.

• Active mode: Allow traffic on port 21.

• Passive mode: Allow traffic on port 21 and ports 40000–40100 (pasv_min_port to pasv_max_port in /etc/vsftpd/vsftpd.conf). Set up an FTP site on Windows.