Red Hat Linux - FTP

CHAPTER 14
File Transfer Protocol

File Transfer Protocol (FTP) is one of the oldest and most commonly used
protocols found on the Internet today. Its purpose is to reliably transfer files
between computer hosts on a network without requiring the user to log directly
into the remote host or have knowledge of how to use the remote system. It
allows users to access files on remote systems using a standard set of simple
commands.
The Very Secure FTP Daemon (vsftpd) is designed from the ground up to be
fast, stable, and, most importantly, secure. Its ability to handle large numbers
of connections efficiently and securely is why vsftpd is the only stand-alone
FTP distributed with Red Hat Enterprise Linux.

In Red Hat Enterprise Linux, the vsftpd package provides the Very Secure FTP
daemon. Run the rpm -q vsftpdcommand to see if vsftpd is installed:
# rpm -q vsftpd

If you want an FTP server and the vsftpd package is not installed, run the
following command as the root user to install it:
# yum install vsftpd
Or
# rpm –ivh vsftpd*
Profile of the FTP server
Package :vsftpd
Daemon :vsftpd
Script :/etc/initd/vsftpd
Port 21,20 and >1024
Configuration files :/etc/vsftpd/vsftpd.conf, /etc/vsftpd/user_list,
:/etc/vsftpd/ftpusers, /etc/pam.d/vsftpd
Document root :/var/ftp
Home Directory :/var/ftp
Steps:1
Install FTP packages
Step:2
Create some files in /var/ftp/pub directory
# touch /var/ftp/pub/test{1..4}
Step:3 Restart the FTP service
# service vsftpd restart
Step:4
Make the service enabled across the reboot
Red Hat Linux - FTP

# chkconfig vsftpd on
Step:5 (Client Side)
Connection from the client and access to the files and download.
To access the ftp server the client should have “FTP” packages installed.
# rpm –q ftp
# rpm –ivh ftp-0.17-51.1.el6.x86.rpm
Downloading a files
Connect to the FTP server as Anonymous or ftp user
# ftp 192.168.10.90
# cd /pub
User options at ftp (bin – to transfer data in binary, prompt – for non-
interactive mod)
# get filename (to get a single file and user mget to get multiple files)
# mget filename1 filename2
# bye (to exit or goodbye or quit)
Uploading files
Create upload directory on FTP server
Server side
# mkdir /var/ftp/upload
# change the group to ftp and give the read, write permissions
# chgrp ftp /var/ftp/upload
# chmod a+w /var/ftp/upload
Client Side
# connect to FTP server
# ftp 192.168.10.90
# username: anonymous
# nopasswd
# cd upload
# mput test1 test2
If you get permission denied enable
# anon_upload_enable=YES
# service vsftpd restart
If you get error like ‘Could not create a file’
# getsebool –a| grep ftp
# setsebool –P allow_ftpd_anon_write on
Also change the context of upload directory
# chcon –t public_content_rw_t
If you connect as root and you may get below errors
Permission denied
# comment the root user in /etc/vsftpd/ftpusers and /etc/vsftpd/user_list
Can not chage directory:/root
Red Hat Linux - FTP

# getsebool –a | grep ftp

# setsebool –P ftp_home_dir on

FTP and SELinux

The vsftpd FTP daemon runs confined by default. SELinux policy defines how
vsftpd interacts with files, processes, and with the system in general. For
example, when an authenticated user logs in via FTP, they cannot read from
or write to files in their home directories: SELinux prevents vsftpd from
accessing user home directories by default. Also, by default, vsftpd does not
have access to NFS or CIFS volumes, and anonymous users do not have write
access, even if such write access is configured in /etc/vsftpd/vsftpd.conf.
Booleans can be enabled to allow the previously mentioned access.
The following example demonstrates an authenticated user logging in, and an
SELinux denial when trying to view files in their home directory:
1. Run the rpm -q ftp command to see if the ftp package is installed. If it is not,
run the yum install ftpcommand as the root user to install it.
2. Run the rpm -q vsftpd command to see if the vsftpd package is installed. If it
is not, run the yum install vsftpd command as the root user to install it.
3. In Red Hat Enterprise Linux, vsftpd only allows anonymous users to log in
by default. To allow authenticated users to log in, edit /etc/vsftpd/vsftpd.conf
as the root user. Make sure the local_enable=YES option is uncommented:

# Uncomment this to allow local users to log in.

local_enable=YES

4. Run the service vsftpd start command as the root user to start vsftpd. If the
service was running before editing vsftpd.conf, run the service vsftpd restart
command as the root user to apply the configuration changes:

5. # service vsftpd start

6. Starting vsftpd for vsftpd: [ OK]
Red Hat Linux - FTP

5. Run the ftp localhost command as the user you are currently logged in with.
When prompted for your name, make sure your user name is displayed. If the
correct user name is displayed, press Enter, otherwise, enter the correct user
name:

# ftp localhost
Connected to localhost (127.0.0.1).
220 (vsFTPd 2.1.0)
Name (localhost:username):
331 Please specify the password.
Password: Enter your password
500 OOPS: cannot change directory:/home/username
Login failed.
ftp>

6. An SELinux denial similar to the following is logged:

7. setroubleshoot: SELinux is preventing the ftp daemon from reading users
home directories (username). For complete SELinux messages. run sealert -l
c366e889-2553-4c16-b73f-92f36a1730ce
7Access to home directories has been denied by SELinux. This can be fixed by
activating the ftp_home_dirBoolean. Enable this ftp_home_dir Boolean by
running the following command as the root user:

# setsebool -P ftp_home_dir=1

Types
By default, anonymous users have read access to files in /var/ftp/ when they
log in via FTP. This directory is labeled with the public_content_t type,
allowing only read access, even if write access is configured
in /etc/vsftpd/vsftpd.conf. The public_content_t type is accessible to other
services, such as Apache HTTP Server, Samba, and NFS.
Use one of the following types to share files through FTP:

public_content_t

Label files and directories you have created with the public_content_t type to
share them read-only through vsftpd. Other services, such as Apache HTTP
Server, Samba, and NFS, also have access to files labeled with this type. Files
labeled with the public_content_t type cannot be written to, even if Linux
permissions allow write access. If you require write access, use
the public_content_rw_t type.
Red Hat Linux - FTP

public_content_rw_t

Label files and directories you have created with the public_content_rw_t type
to share them with read and write permissions through vsftpd. Other services,
such as Apache HTTP Server, Samba, and NFS, also have access to files labeled
with this type. Remember that Booleans for each service must be enabled before
they can write to files labeled with this type.

Booleans
SELinux is based on the least level of access required for a service to run.
Services can be run in a variety of ways; therefore, you need to specify how
you run your services. Use the following Booleans to set up SELinux:

allow_ftpd_anon_write

When disabled, this Boolean prevents vsftpd from writing to files and
directories labeled with the public_content_rw_t type. Enable this Boolean to
allow users to upload files via FTP. The directory where files are uploaded to
must be labeled with the public_content_rw_t type and Linux permissions set
accordingly.

allow_ftpd_full_access

When this Boolean is on, only Linux (DAC) permissions are used to control
access, and authenticated users can read and write to files that are not labeled
with the public_content_t or public_content_rw_t types.

allow_ftpd_use_cifs

Having this Boolean enabled allows vsftpd to access files and directories labeled
with the cifs_t type; therefore, having this Boolean enabled allows you to share
file systems mounted via Samba through vsftpd.

allow_ftpd_use_nfs

Having this Boolean enabled allows vsftpd to access files and directories labeled
with the nfs_t type; therefore, having this Boolean enabled allows you to share
file systems mounted via NFS through vsftpd.

ftp_home_dir
Red Hat Linux - FTP

Having this Boolean enabled allows authenticated users to read and write to
files in their home directories. When this Boolean is off, attempting to download
a file from a home directory results in an error such as 550 Failed to open file.
An SELinux denial is logged.

ftpd_connect_db

Allow FTP daemons to initiate a connection to a database.

httpd_enable_ftp_server

Allow httpd to listen on the FTP port and act as a FTP server.

tftp_anon_write

Having this Boolean enabled allows TFTP access to a public directory, such as
an area reserved for common files that otherwise has no special access
restrictions.
Uploading to an FTP site
The following example creates an FTP site that allows a dedicated user to
upload files. It creates the directory structure and the required SELinux
configuration changes:
Run the setsebool ftp_home_dir=1 command as the root user to enable access to
FTP home directories.

Run the mkdir -p /myftp/pub command as the root user to create a new top-
level directory.
Set Linux permissions on the /myftp/pub/ directory to allow a Linux user
write access. This example changes the owner and group from root to owner
user1 and group root. Replace user1 with the user you want to give write access
to:

# chown user1:root /myftp/pub

# chmod 775 /myftp/pub

The chown command changes the owner and group permissions. The chmod
command changes the mode, allowing the user1 user read, write, and execute
permissions, and members of the root group read, write, and execute
permissions. Everyone else has read and execute permissions: this is required to
allow the Apache HTTP Server to read files from this directory.
Red Hat Linux - FTP

When running SELinux, files and directories must be labeled correctly to allow
access. Setting Linux permissions is not enough. Files labeled with the
public_content_t type allow them to be read by FTP, Apache HTTP Server,
Samba, and rsync. Files labeled with the public_content_rw_t type can be
written to by FTP. Other services, such as Samba, require Booleans to be set
before they can write to files labeled with the public_content_rw_t type. Label
the top-level directory (/myftp/) with the public_content_t type, to prevent
copied or newly-created files under /myftp/ from being written to or modified
by services. Run the following command as the root user to add the label
change to file-context configuration:

# semanage fcontext -a -t public_content_t /myftp

Run the restorecon -R -v /myftp/ command to apply the label change:

# restorecon -R -v /myftp/

restorecon reset /myftp context unconfined_u:object_r:default_t:s0-

>system_u:object_r:public_content_t:s0
Confirm /myftp is labeled with the public_content_t type, and /myftp/pub/ is
labeled with the default_t type:

# ls -dZ /myftp/
drwxr-xr-x. root root system_u:object_r:public_content_t:s0 /myftp/

# ls -dZ /myftp/pub/
drwxrwxr-x. user1 root unconfined_u:object_r:default_t:s0 /myftp/pub/

FTP must be allowed to write to a directory before users can upload files via
FTP. SELinux allows FTP to write to directories labeled with the
public_content_rw_t type. This example uses /myftp/pub/ as the directory FTP
can write to. Run the following command as the root user to add the label
change to file-context configuration:

# semanage fcontext -a -t public_content_rw_t "/myftp/pub(/.*)?"

Run the restorecon -R -v /myftp/pub command as the root user to apply the
label change:

# restorecon -R -v /myftp/pub
restorecon reset /myftp/pub context system_u:object_r:default_t:s0-
>system_u:object_r:public_content_rw_t:s0
Red Hat Linux - FTP

The allow_ftpd_anon_write Boolean must be on to allow vsftpd to write to files

that are labeled with the public_content_rw_t type. Run the following
command as the root user to enable this Boolean:

# setsebool -P allow_ftpd_anon_write on

Do not use the -P option if you do not want changes to persist across reboots.
The following example demonstrates logging in via FTP and uploading a file.
This example uses the user1 user from the previous example, where user1 is the
dedicated owner of the /myftp/pub/ directory:
Run the cd ~/ command to change into your home directory. Then, run the
mkdir myftp command to create a directory to store files to upload via FTP.
Run the cd ~/myftp command to change into the ~/myftp/ directory. In this
directory, create an ftpupload file. Copy the following contents into this file:
File upload via FTP from a home directory.
Run the getsebool allow_ftpd_anon_write command to confirm the
allow_ftpd_anon_write Boolean is on:

# getsebool allow_ftpd_anon_write
allow_ftpd_anon_write --> on

If this Boolean is off, run the setsebool -P allow_ftpd_anon_write on command

as the root user to enable it. Do not use the -P option if you do not want the
change to persist across reboots.
Run the service vsftpd start command as the root user to start vsftpd:

# service vsftpd start

Starting vsftpd for vsftpd: [ OK ]

Run the ftp localhost command. When prompted for a user name, enter the
user name of the user who has write access, then, enter the correct password
for that user:

# ftp localhost
Connected to localhost (127.0.0.1).
220 (vsFTPd 2.1.0)
Name (localhost:username):
331 Please specify the password.
Password: Enter the correct password
230 Login successful.
Remote system type is UNIX.
Red Hat Linux - FTP

Using binary mode to transfer files.

ftp> cd myftp
250 Directory successfully changed.
ftp> put ftpupload
local: ftpupload remote: ftpupload
227 Entering Passive Mode (127,0,0,1,241,41).
150 Ok to send data.
226 File receive OK.
ftp> 221 Goodbye.
The upload succeeds as the allow_ftpd_anon_write Boolean is enabled.

MODES
Active FTP:
Active FTP connection mode is where command connection is initiated by the
client and data connection is initiated by the Server. The client opens up port
higher than 2014 and through it connects to the port 21 (command port) of the
server. Then the Server opens its port 20 and establishes a data connection to a
port higher than 1024 of the client.

Passive FTP:
In the Passive FTP the Server acts entirely passive as the Command connection
and Data connections are initiated and Established by the Client. In this mode,
Server listens for the incoming requests through 21 (command port) port and
when a request is received for a data connection from the Client, Server
randomly opens up one of its High ports. Then client initiates data connection
between the opened port of the Server and its own randomly selected port
higher than 1024.