FTP Server Installation

Installing ProFTPD:

Debian/Ubuntu systems:

apt-get install proftpd

CentOS:

yum install epel-release
yum install proftpd

If the server did not start automatically, use the following command to start it manually:

service proftpd start

Restricting FTP users to their home directories

This article assumes you are working with the default ProFTPD configuration. In this case, a user can move outside their home directory and, although they will most likely not have permissions to work with other folders, an insufficiently strict server configuration may pose a security risk. You can solve this problem by adding a single line to the proftpd.conf file:

DefaultRoot ~

You can add this line at the end of the file. After saving, restart the FTP server:

service proftpd restart

Location of proftpd.conf:

The proftpd.conf configuration file may be located in different paths, depending on your OS version:

Creating a new FTP user:

Regular FTP users do not need access to a command shell. Before you start creating new users, run the following command:

echo '/bin/false' >> /etc/shells

Create a new user:

useradd username -d /home/folder_name -m -s /bin/false
passwd username

With the commands above, we created a user (replace username with an unused name) and the corresponding group, assigned and created (the -m flag can be omitted if the directory already exists) the home directory /home/folder_name, and also set /bin/false as the user shell, effectively disabling shell access for security reasons. With the passwd command, we set the required password for the user.

Additional information:

If you still want to grant the user access to a command shell, you must specify the path to any valid shell instead of /bin/false, for example:

/bin/sh

or:

/bin/bash

Users of the regular FTP protocol do not need shell access, so it is safer not to provide it.

If necessary, you can remove write permissions for the user, for example in their home directory, and leave write access only in an internal folder such as upload.

As the superuser, change the permissions:

chmod 555 /home/folder_name
mkdir /home/folder_name/upload
chown username:username /home/folder_name/upload

In this case, the second occurrence of username is the group name, which by default matches the username you created.

Thus, in a short time and with just a few steps, you can create a secure basic FTP user and start working with FTP on your server.