2009-07-27, 10:15 AM
Some good advice in other threads, so I thought I'd consolidate it here:
Firstly, consider:
<ol style="list-style-type: decimal">
[*]WHY set one up? (read/write/delete permissions, and who?)
[*]WHO is using it? (authenticated/guest/anonymous)
[*]HOW is it being used? (quota checking, secure connections, archiving old files, port numbers)
[*]WHAT will the end users use for client connectivity? (FTP client/command-line/sftp etc)
</ol>
Some simple answers are:
- I'm setting one up for friends to share photos. Each friend will have upload/download access to a shared area, but not be able to delete anything. For reasons of security, they will not be able to navigate out of this area either.
- I'm running a gaming server and I want two admins to be able to drop new maps and mods into a directory that anyone can download. For security, FTPS need to be enabled so that the admin username/passes aren't transmitted plain-text, but anonymous access will not require encrypted connections - but will be subject to quota controls to prevent bandwidth-hogging.
These are what people refer to as "problem specification" - without making it clear what your end objectives are, you may well end up with something hastily-configured that's leaving you open for attack.
Some security considerations are:
- FTPS = uses secure (encrypted) connections over FTP, has a slight performance overhead with the encryption/decryption process.
- SFTP = can use ordinary SSH/SCP so don't need an FTP server, but means potentially giving shell access to a user.
- Port num: port 20 and 21 are commonly used for FTP servers, and get regularly sniffed. Consider binding the port number to something different, such as 12321, 54321, 21021 etc, to move it out of the range of impatient port-scanners.
- PASV/PORT connections: may need to punch a hole in your firewall - or advertise which port is in use - for transfer to work properly
- Capacity planning: is it possible for someone to fill up your filesystem, or have you got quota management on?
- Permissions: group users into roles (uploader/downloader/manager/viewer etc) then assign privs per role.
- Auditing: check logfiles (use logwatch) to monitor activity, particularly for nefarious behaviour. Consider using something like AWStats to report usage.
- User mapping: every file/directory under Linux is owned by a user and group; if you have virtual FTP users, who will be the eventual owner of uploaded content?
Considerations such as the above will determine your choice of FTP software. Largely speaking, there are four to choose from:
<ol style="list-style-type: decimal">
[*]WU_FTP (Wisconsin FTP) - basic, feature-light.. don't use it.
[*]vsFTPD - Very Secure FTPD.
[*]ProFTPD
[*]Pure-FTPd - my choice.
</ol>