FTP site setup FAQ - Elastic Compute Service - Alibaba Cloud Documentation Center

This topic lists common issues and solutions for setting up a File Transfer Protocol (FTP) site. This guide helps you troubleshoot problems related to FTP installation, configuration, security, and connections to ensure that your site runs smoothly and your data is secure.

What do I do if I cannot download files from the FTP server?

Follow these steps to enable download permissions in Internet Explorer.

On your local host, open Internet Explorer.
In the upper-right corner of the browser, click the icon, and then select Internet Options.
At the top of the Internet Options dialog box, click the Security tab.
In the Select a zone to view or change security settings area, click Internet. Then, under Security level for this zone, click Custom level.
Select Downloads > File download > Enable, and then click OK.
Click Apply and then click OK.

What do I do if an error occurs when I connect to the FTP server?

You can troubleshoot the issue based on the FTP error message. If the error is difficult to resolve, you can use a third-party FTP client, such as FileZilla. You can download it from the FileZilla. This example shows how to use FileZilla to connect to an FTP server in anonymous mode.

Configure vsftpd for anonymous mode.
1. Run the following command to modify the /etc/vsftpd/vsftpd.conf configuration file.
  If you used the apt install vsftpd command to install vsftpd, the configuration file is located at /etc/vsftpd.conf.
```
sudo vim /etc/vsftpd/vsftpd.conf
```
2. Press i to enter edit mode.
3. Uncomment the anonymous upload permission setting and change it to anon_upload_enable=YES.
4. Press Esc to exit edit mode. Then, enter :wq and press Enter to save and close the file.
  
  The modified configuration file is shown in the following figure.
5. Run the following command to change the permissions of the /var/ftp/pub directory and grant write permissions to the FTP user.
  /var/ftp/pub is the default file directory for the FTP service.
```
sudo chmod o+w /var/ftp/pub/
```
6. Run the following command to reload the configuration file.
```
sudo systemctl restart vsftpd
```
Download and install FileZilla.

Connect to the FTP server in anonymous mode using FileZilla.

Open the FileZilla client.
From the top menu bar, choose File > Site Manager.
In the lower-left corner of the Site Manager dialog box, click New site.
Enter a name for the new site and complete the site configuration.

Note
The following interface is for FileZilla 3.64.0. The interface may vary for other versions.
The configuration items are described as follows:
- New site name: A custom name for your site. For example, test-01.
- Protocol: FTP - File Transfer Protocol.
- Host: The public IP address of the FTP server. In this example, use the public IP address of the Linux instance, such as 121.43.XX.XX.
- Port: 21.
- Logon Type: Anonymous.
  
  This example connects to the FTP server in anonymous mode. To connect to the FTP server using a username and password, set Logon Type to Normal and configure the user and password.

Click Connect.

After the connection is established, you can upload, download, and delete files. The following figure shows the FileZilla interface. The table below describes the different areas of the interface.

Number	Description
①	Displays commands, FTP connection status, and task execution results.
②	Local site area. Displays the directory information of the local host.
③	Remote site area. Displays the directory information of the FTP server. In anonymous mode, the default directory is `/pub`.
④	Log area. View queue and log information for FTP tasks.

What do I do if the Everyone option is missing in folder permissions?

If the Everyone user is not available on the Security tab when you set folder properties, follow these steps to add the Everyone user.

On the Security tab, click Edit.
In the new window, click Add.
In the new window, click Advanced.
In the new window, click Find Now, select Everyone from the search results, and click OK.
Click OK to return to the permissions window.
Click OK to confirm.

How do I create a server certificate?

To use a secure FTP protocol, such as FTPS or SFTP, you need a server certificate to encrypt the FTP session. This protects your data from being intercepted or tampered with during transmission. Follow these steps to create a server certificate.

In Server Manager, select Dashboard > Tools > Internet Information Services (IIS) Manager.
In the list on the left, click the server ID. On the server homepage, in the IIS area, double-click Server Certificates to open the Server Certificates page.
Click Create Self-Signed Certificate.
Enter a certificate name, select a certificate store type, and click OK.
After the certificate is created, it appears on the Server Certificates page.

Recommendations for FTP passive mode port configuration

When you configure FTP passive mode, select a range of ports instead of a single port. This configuration balances performance, concurrency, and security. The main reasons for opening a port range are as follows.

Support for concurrent connections:
- A port range allows multiple clients to transfer data at the same time. Each data transfer requires a dedicated port, so a range of ports allows for multiple concurrent connections.
- If your FTP server needs to serve many concurrent users for tasks such as file downloads or uploads, a wide port range is important to avoid delays or connection rejections.
Network flexibility:
- In a large, high-traffic environment, such as an enterprise or a data center, ports sometimes need to be dynamically allocated to handle different types of requests and traffic patterns.
- A wider range of ports ensures stable connections under different network conditions, such as during load balancing or across different subnets.

Configuration recommendations

Evaluate concurrency needs:
- Estimate the maximum number of concurrent connections you need to support. If you have many users or large data transfers, a wider port range is more suitable.
- For small networks or those with only a few users, consider using a smaller port range.
Select a reasonable port range:
- For small and medium-sized enterprises, a range of 100 to 200 ports is usually sufficient to handle common concurrency needs.
- For environments with higher traffic, you can use a larger port range. You can also use load testing to determine the appropriate size.
Security considerations:
- Use firewall rules to restrict access to the specified port range. Accept connections only from trusted hosts or networks.
- Enable IP and user blacklists and whitelists to enhance security.
Monitoring and adjustment:
- Implement real-time monitoring of network port usage. Use tools and log analysis to detect abnormal activities and traffic patterns.
- Adjust the port range size or policies based on monitoring data to better match business requirements.
Automation and simplified management:
- Use configuration management tools, such as Ansible or Puppet, to automate port settings and security policy deployments. This reduces the risk of errors from manual management.
- Include the port range configuration in your regular review and update process. This ensures that it can adapt to changing business needs.
Secure protocols:
- If possible, set up FTPS (FTP Secure) or SFTP (SSH File Transfer Protocol) to encrypt data transmissions. This enhances data confidentiality, especially when you transfer sensitive data.