Elastic Compute Service:Build an FTP server on a Linux instance

Step 1: Install vsftpd

1. Update system packages and install vsftpd.

   sudo yum update -y
   sudo yum install vsftpd -y

2. Start vsftpd and enable it to start on boot.

   sudo systemctl start vsftpd
   sudo systemctl enable vsftpd

3. Verify the service is running.

   netstat -antup | grep ftp

   If the output is similar to the following, vsftpd has started successfully. At this point, vsftpd runs in anonymous mode by default. Anonymous users can connect without a password but cannot upload or modify files.

   

Step 2: Configure vsftpd

1. Create a dedicated FTP user and set a password. This topic uses ftpuser as an example.

   sudo useradd -d /data/ftp -s /sbin/nologin ftpuser  # Set home directory; disable shell access
   sudo passwd ftpuser

2. Create the FTP directory and set ownership and permissions.

   vsftpd requires that the chroot root directory is not writable by the FTP user. Setting permissions to 750 (owner has write access; FTP user does not) satisfies this requirement. If you need the directory to be writable, add allow_writeable_chroot=YES to the configuration file in the next step. This resolves the 500 OOPS: vsftpd: refusing to run with writable root error.

   sudo mkdir -p /data/ftp
   sudo chown ftpuser:ftpuser /data/ftp
   sudo chmod 750 /data/ftp    # Must be 755 or 750; see note below

3. Back up the configuration file.

   sudo cp /etc/vsftpd/vsftpd.conf /etc/vsftpd/vsftpd.conf.bak

4. Open the configuration file for editing.

   sudo vim /etc/vsftpd/vsftpd.conf

5. Set the basic security parameters.

   listen=YES                   # Enable IPv4 listener
   anonymous_enable=NO          # Disable anonymous access
   local_enable=YES             # Enable local user logon
   write_enable=YES             # Allow file uploads
   chroot_local_user=YES        # Lock users to their home directory
   allow_writeable_chroot=YES   # Resolve chroot write errors

6. Add passive mode settings at the end of the file.

   Passive mode is recommended because most client machines are behind firewalls or network address translation (NAT) and cannot receive inbound connections required by active mode.

   pasv_enable=YES              # Enable passive mode
   pasv_min_port=40000          # Lower bound of the passive port range
   pasv_max_port=40100          # Upper bound of the passive port range
   pasv_address=<public_ip_address>   # Replace with your instance's public IP address

7. Restart vsftpd to apply the configuration.

   sudo systemctl restart vsftpd

Step 3: Open security group ports

Add inbound rules to the security group of your ECS instance. For instructions, see Add a security group rule.

• Passive mode (recommended): Allow TCP traffic on port 21 and ports 40000–40100. For information about why a port range is required for FTP passive mode and configuration recommendations, see Recommendations for FTP passive mode port configuration.

• Active mode: Allow TCP traffic on port 21 only.

If you use active mode, clients in a local area network (LAN) must obtain their real public IP address before connecting, or the connection will fail.

Step 4: Verify the FTP service

Verify the service using an FTP client, a browser, or a file explorer.

1. Test the local connection from the instance.

   ftp ftpuser@localhost

   A Login successful message confirms the connection works.

   

2. Test the client connection from a remote machine. On the client computer, open the file explorer and go to the FTP address shown in the figure. Enter the FTP username and password in the logon dialog box. After logging in, you can upload and download files.

   

Step 1: Install vsftpd

1. Update system packages and install vsftpd.

   sudo apt update && sudo apt upgrade -y
   sudo apt install vsftpd -y

2. Start vsftpd and enable it to start on boot.

   sudo systemctl start vsftpd
   sudo systemctl enable vsftpd

Step 2: Configure vsftpd

1. Create a dedicated FTP user.

   sudo useradd -m -s /bin/bash ftpuser   # Create the user and generate a home directory
   sudo passwd ftpuser                     # Set a strong password

2. Create a file storage directory inside the user's home directory and set permissions.

   sudo mkdir /home/ftpuser/ftp-files
   sudo chown ftpuser:ftpuser /home/ftpuser/ftp-files
   sudo chmod 755 /home/ftpuser/ftp-files

3. Back up the configuration file.

   sudo cp /etc/vsftpd.conf /etc/vsftpd.conf.bak

4. Open the configuration file for editing.

   sudo nano /etc/vsftpd.conf

5. Set the basic security parameters.

   listen=YES
   anonymous_enable=NO          # Disable anonymous access
   local_enable=YES             # Allow local user logon
   write_enable=YES             # Enable write permissions
   chroot_local_user=YES        # Lock users in their home directory

6. Add the following settings at the end of the file.

   allow_writeable_chroot=YES                    # Allow writing to the chroot directory
   local_root=/home/ftpuser/ftp-files            # Set the FTP user's root directory
   
   # Passive mode configuration
   pasv_enable=YES
   pasv_address=<your_public_ip_address>         # Replace with your instance's public IP address
   pasv_min_port=40000
   pasv_max_port=40100

7. Restart vsftpd to apply the configuration.

   sudo systemctl restart vsftpd

8. After installation, a default user named ftp is created with no password. Set a password for this user.

   sudo passwd ftp

9. Add the ftp user to the allowed users list.

   echo "ftp" | sudo tee -a /etc/vsftpd.userlist

10. Create an FTP directory for the ftp user and grant permissions.

     sudo mkdir /home/ftp
     sudo chmod 777 /home/ftp

Step 3: Open security group ports

Add inbound rules to the security group of your ECS instance. For instructions, see Add a security group rule.

• Passive mode (recommended): Allow TCP traffic on port 21 and ports 40000–40100.

• Active mode: Allow TCP traffic on port 21 only.

If you use active mode, clients in a LAN must obtain their real public IP address before connecting, or the connection will fail.

Step 4: Verify the FTP service

1. Test the local connection from the instance.

   ftp ftpuser@localhost

   A Login successful message confirms the connection works.

   

2. Test the client connection from a remote machine. On the client computer, open the file explorer and go to the FTP address shown in the figure. Enter the FTP username and password in the logon dialog box. After logging in, you can upload and download files.