Elastic Compute Service:Manually build an FTP site on a CentOS 8 instance

Step 1: Install vsftpd

1. Connect to the Linux instance.
   For more information about how to connect to a Linux instance, see Connection methods.
2. Change the CentOS 8 repository address.

   CentOS 8 has reached its end of life (EOL). In accordance with Linux community rules, all content has been removed from the following CentOS 8 repository address: http://mirror.centos.org/centos/8/. If you continue to use the default CentOS 8 repository configurations on Alibaba Cloud, an error is reported. To use specific installation packages of CentOS 8, change the CentOS 8 repository address. For more information, see Change CentOS 8 repository addresses .

3. Run the following command to install vsftpd:

   dnf install -y vsftpd

   A command output similar to the following one indicates that vsftpd is installed.
4. Run the following command to enable the FTP service to automatically start on system startup:

   systemctl enable vsftpd.service

5. Run the following command to start the FTP service:

   systemctl start vsftpd.service

   Note If the system returns the Job for vsftpd.service failed because the control process exited with error code error message when the preceding command is run, check whether the following problems occur and troubleshoot them.

   • If the network environment does not support IPv6 addresses, run the vim /etc/vsftpd/vsftpd.conf command to change the value of listen_ipv6 from YES to NO.
   • When the MAC address set for a network interface controller (NIC) in the /etc/sysconfig/network-scripts/ifcfg-xxx configuration file does not match the actual MAC address of the NIC, run the ifconfig command to query the MAC addresses of NICs. Then, add HWADDR=<Actual MAC address of the NIC> to the file or change HWADDR in the file to the actual MAC address of the NIC.
6. Run the following command to query the listening port of the FTP service:

   netstat -antup | grep ftp

   A command output similar to the following one indicates that the FTP service is started and listens to port 21.

   By default, local user mode is enabled. To use the FTP service, you must specify more configurations.

Step 2: Configure vsftpd

In this example, vsftpd is configured in passive and local user mode to ensure data security.

1. Run the following command to create a Linux user for the FTP service. In this example, the ftptest username is used.

   adduser ftptest

2. Run the following command. Follow the instructions in the command line to modify the password of the ftptest user.

   passwd ftptest
3. Run the following command to create a file directory for the FTP service:

   mkdir /var/ftp/test

4. Run the following command to create a test file.
   This test file is used when the FTP client accesses the FTP server.

   touch /var/ftp/test/testfile.txt

5. Run the following command to change the owner of the /var/ftp/test directory to ftptest:

   chown -R ftptest:ftptest /var/ftp/test

6. Modify the vsftpd.conf configuration file.
   1. Run the following command to open the configuration file of vsftpd.
      If you use the apt install vsftpd command to install vsftpd, the path of the configuration file is /etc/vsftpd.conf.

      vim /etc/vsftpd/vsftpd.conf

   2. Press the I key to enter the edit mode.
   3. Enable passive mode for the FTP server.
      Configure the following parameters:

      Important When you modify or add information in the configuration file, take note of the format. For example, an extra space may cause the service to fail to restart.

      #Use the default values for all parameters except the following parameters: 
      
      #Modify the values of the following parameters:
      #Disallows anonymous users to log on to the FTP server. 
      anonymous_enable=NO
      #Allows local users to log on to the FTP server. 
      local_enable=YES
      #Listens to IPv4 sockets. 
      listen=YES
      
      #Add a number sign (#) to the beginning of the row to comment out the following parameter:
      #Disables listening to IPv6 sockets. 
      #listen_ipv6=YES
      
      #Add the following parameters at the end of the configuration file:
      #Specifies the directory to which local users are directed after they log on. 
      local_root=/var/ftp/test
      #Limits all users to their home directory after they log on. 
      chroot_local_user=YES
      #Uses a list to specify exception users. Exception users are not limited to the home directory after they log on. 
      chroot_list_enable=YES
      #Specifies a file to contain the list of exception users. 
      chroot_list_file=/etc/vsftpd/chroot_list
      #Enables passive mode. 
      pasv_enable=YES
      allow_writeable_chroot=YES
      #In this topic, the public IP address of the Linux instance is used. 
      pasv_address=<The public IP address of the FTP server>
      #Specifies the minimum port number of the port range that can be used to transmit data in passive mode. 
      We recommend that you use ports in a high number range, such as 50000 to 50010. These ports provide more secure access to the FTP server. 
      pasv_min_port=<port number>
      #Specifies the maximum port number of the port range that can be used to transmit data in passive mode. 
      pasv_max_port=<port number>

      For more information, see vsftpd configuration file and parameters.

   4. Press the Esc key to exit the edit mode. Enter :wq and press the Enter key to save and close the file.
7. Create the chroot_list file, and write the list of exception users to the file.
   1. Run the following command to create the chroot_list file:

      vim /etc/vsftpd/chroot_list

   2. Press the I key to enter the edit mode.
   3. Enter the list of exception users. Exception users are not limited to the home directory and have access to other directories.
   4. Press the Esc key to exit the edit mode. Enter :wq and press the Enter key to save and close the file.
   Important If exception users do not exist, you must still create the chroot_list file. The file can be empty.
8. Run the following command to restart vsftpd:

   systemctl restart vsftpd.service

Step 3: Configure security groups

Step 4: Check whether you can access the FTP server from the client

To check whether FTP servers are accessible, you can use FTP clients, Windows command-line tools, or browsers. In this example, a host that runs Windows Server 2012 R2 64-bit operating system is used to describe how to access an FTP server.

1. On the local host, open This Computer.
2. In the address bar, enter ftp://<The public IP address of the FTP server>:<The FTP port>. In this example, the following public IP address of the Linux instance is used: ftp:// 121.43.XX.XX:21
3. In the Log on as dialog box, enter the FTP username and password that you configured, and then click Logon.
   After you log on, you can view the files under the specified directory in the FTP server, for example, the test file named testfile.txt.

vsftpd configuration file and parameters