How to add user in vsftpd?

All you have to do is add the username to the file /etc/vsftpd/chroot_list, each user on their own line. That pretty much covers it for vsftpd, and at this point you should be able to create a new system user, set them up for vsftpd and do some basic tweaks to their access level.

Question : How to add FTP Users For VSFTP  Server ?

Answer :

Before you can add any users to VSFTP, the user must already exist on the  Linux server. If the user does not exist you will need to add the user.

Next you will need to find  the VSFTP configuration file. “vsftp.conf”  at “/etc/vsftp.conf“.

To create the new FTP user you must edit the “/etc/vsftp.conf” file and make the following changes:

save the file.

Next you will need to create the user file which will be called “vsftpd.chroot_list“. This will contain the users for the VSFTP server and will lock them down to their specific directly, which is done by name. Be sure to create this file in “/etc”.

Now that you created the user list, you will be able to add users to it directly. To add a user simply enter in the user that you already have on the server, one per line. An example of this would be as such. Example: User1 User2 User3 Lastly restart the VSFTP service by typing the following:

FTP, which is short for File Transfer Protocol, is a network protocol that was once widely used for moving files between a client and server. FTP is still used to support legacy applications and workflows with very specific needs. If you have a choice on protocol, consider modern options that are more efficient, secure, and convenient for delivering files. For example, Internet users who download directly from their web browser with https, and command line users who use secure protocols such as the scp or SFTP.

vsftpd, very secure FTP daemon, is an FTP server for many Unix-like systems, including Linux, and is often the default FTP server for many Linux distributions as well. vsftpd is beneficial for optimizing security, performance, and stability. It also provides strong protection against security problems found in other FTP servers. vsftpd can handle virtual IPD configurations, encryption support with SSL integration, and more.

In this tutorial, you’ll configure vsftpd to allow a user to upload files to their home directory using FTP with login credentials secured by SSL/TLS. You’ll also connect your server using FileZilla, an open-source FTP client, to test the TLS encryption.

To follow along with this tutorial you will need:

Start by updating your package list:

Next, install the vsftpd daemon:

When the installation is complete, copy the configuration file so you can start with a blank configuration, while also saving the original as a backup:

With a backup of the configuration in place, you’re ready to configure the firewall.

First, check the firewall status to see if it’s enabled. If it is, then you’ll make adjustments to ensure that FTP traffic is permitted so firewall rules don’t block the tests.

Check the firewall status:

This output reveals that the firewall is active and only SSH is allowed through:

You may have other rules in place or no firewall rules at all. Since only SSH traffic is permitted, you’ll need to add rules for FTP traffic.

Start by opening ports 20, 21, and 990 so they’re ready when you enable TLS:

Next, open ports 40000-50000 for the range of passive ports you will be setting in the configuration file:

Check the status of your firewall:

The output of your firewall rules should now appear as the following:

With vsftpd installed and the necessary ports open, now it’s time to create a dedicated FTP user.

In this step, you will create a dedicated FTP user. However, you may already have a user in need of FTP access. This guide outlines how to preserve an existing user’s access to their data, but, even so, we recommend that you start with a new dedicated FTP user until you’ve configured and tested your setup before reconfiguring any existing users.

Start by adding a test user:

Assign a password when prompted. Feel free to press ENTER to skip through the following prompts, as those details aren’t important for the purposes of this step.

FTP is generally more secure when users are restricted to a specific directory. vsftpd accomplishes this with chroot jails. When chroot is enabled for local users, they are restricted to their home directory by default. Since vsftpd secures the directory in a specific way, it must not be writable by the user. This is fine for a new user who should only connect via FTP, but an existing user may need to write to their home folder if they also have shell access.

In this example, rather than removing write privileges from the home directory, create an ftp directory to serve as the chroot and a writable files directory to hold the actual files.

Create the ftp folder:

Set its ownership:

Remove write permissions:

Verify the permissions:

Next, create the directory for file uploads:

Then assign ownership to the user:

A permissions check on the ftp directory should return the following output:

Finally, add a test.txt file to use for testing:

Now that you’ve secured the ftp directory and allowed the user access to the files directory, next you will modify our configuration.

In this step, you will allow a single user with a local shell account to connect with FTP. The two key settings for this are already set in vsftpd.conf. Open this file using your preferred text editor. Here, we’ll use nano:

Once you’ve opened the file, confirm that the anonymous_enable directive is set to NO and the local_enable directive is set to YES:

These settings prevent anonymous logins and permit local logins, respectively. Keep in mind that enabling local logins means that any normal user listed in the /etc/passwd file can be used to log in.

Some FTP commands allow users to add, change, or remove files and directories on the filesystem. Enable these commands by uncommenting the write_enable setting. You can do this by removing the pound sign (#) preceding this directive:

Uncomment the chroot to prevent the FTP-connected user from accessing any files or commands outside the directory tree:

Next, add a user_sub_token directive whose value is the $USER environment variable. Then add a local_root directive and set it to the path shown, which also includes the $USER environment variable. This setup ensures that the configuration will allow for this user and future users to be routed to the appropriate user’s home directory when logging in. Add these settings anywhere in the file:

Limit the range of ports that can be used for passive FTP to ensure enough connections are available:

To allow FTP access on a case-by-case basis, set the configuration so that users have access only when they are explicitly added to a list, rather than by default:

userlist_deny toggles the logic: when it is set to YES, users on the list are denied FTP access; when it is set to NO, only users on the list are allowed access.

When you’re done making the changes, save the file and exit the editor. If you used nano to edit the file, you can do so by pressing CTRL + X, Y, then ENTER.

Finally, add your user to /etc/vsftpd.userlist. Use the -a flag to append to the file:

Check that it was added as you expected:

Restart the daemon to load the configuration changes:

With the configuration in place, now you can test FTP access.

We’ve configured the server to allow only the user sammy to connect via FTP. Now we will make sure that this works as expected.

Since you’ve disabled anonymous access, you can test it by trying to connect anonymously. If the configuration is set up properly, anonymous users should be denied permission. Open another terminal window and run the following command. Be sure to replace 203.0.113.0 with your server’s public IP address:

When prompted for a username, try logging in as a nonexistent user such as anonymous and you will receive the following output:

Close the connection:

Users other than sammy should also fail to connect. Try connecting as your sudo user. They should also be denied access, and it should happen before they’re allowed to enter their password:

Close the connection:

The user sammy, on the other hand, should be able to connect, read, and write files. Make sure that your designated FTP user can connect:

Now change into the files directory:

Next, run get to transfer the test file you created earlier to your local machine:

Next, upload the file with a new name to test write permissions:

Close the connection:

Now that you’ve tested your configuration, next you’ll take steps to further secure your server.

Since FTP does not encrypt any data in transit, including user credentials, you can enable TLS/SSL to provide that encryption. The first step is to create the SSL certificates for use with vsftpd.

Use openssl to create a new certificate and use the -days flag to make it valid for one year. In the same command, add a private 2048-bit RSA key. By setting both the -keyout and -out flags to the same value, the private key and the certificate will be located in the same file:

You’ll be prompted to provide address information for your certificate. Substitute your own information for the highlighted values:

For more detailed information about the certificate flags, read OpenSSL Essentials: Working with SSL Certificates, Private Keys and CSRs.

Once you’ve created the certificates, open the vsftpd configuration file again:

Toward the bottom of the file, there will be two lines that begin with rsa_. Comment them out by preceding each line with a pound sign (#):

After those lines, add the following lines that point to the certificate and private key you created:

Now you will force the use of SSL, which will prevent clients that can’t handle TLS from connecting. This is necessary to ensure that all traffic is encrypted, but it may force your FTP user to change clients. Change ssl_enable to YES:

Next, add the following lines to explicitly deny anonymous connections over SSL and require SSL for both data transfer and logins:

Then configure the server to use TLS, the preferred successor to SSL, by adding the following lines:

Lastly, add two final options. The first will not require SSL reuse because it can break many FTP clients. The second will require “high” encryption cipher suites, which currently means key lengths equal to or greater than 128 bits:

Here is how this section of the file should appear after all of these changes have been made:

When you’re done, save and close the file. If you used nano, you can exit by pressing CTRL + X, Y, then ENTER.

Restart the server for the changes to take effect:

At this point, you’ll no longer be able to connect with an insecure command line client. If you tried, you’d get the following message:

Next, verify that you can connect using a client that supports TLS, such as FileZilla.

Most modern FTP clients can be configured to use TLS encryption. For our purposes, we will demonstrate how to connect with FileZilla because of its cross-platform support. Consult the documentation for other clients.

When you first open FileZilla, find the Site Manager icon located above the word Host, the leftmost icon on the top row. Click this button:

A new window will open. Click the New Site button in the bottom right corner:

Under My Sites a new icon with the words New Site will appear. You can name it now or return later and use the Rename button.

Fill out the Host field with the name or IP address. Under the Encryption drop-down menu, select Require explicit FTP over TLS.

For Logon Type, select Ask for password. Fill in your FTP user in the User field:

Click the Connect button at the bottom of the interface. You will be asked for the user’s password:

Select OK to connect. You should now be connected to your server with TLS/SSL encryption.

Next, you will be presented with a server certificate that looks like the following:

When you’ve accepted the certificate, double-click the files folder and drag upload.txt to the left to confirm that you’re able to download files:

When you’ve done that, right-click on the local copy, rename it to upload-tls.txt and drag it back to the server to confirm that you can upload files:

You’ve now confirmed that you can securely and successfully transfer files with SSL/TLS enabled.

If you’re unable to use TLS because of client requirements, you can gain some security by disabling the FTP user’s ability to log in any other way. One way to prevent it is by creating a custom shell. Although this will not provide any encryption, it may be worth doing so as to limit the access of a compromised account to files accessible by FTP.

First, open a file called ftponly in the bin directory:

Add a message telling the user why they are unable to log in:

Save the file and exit your editor. If you used nano, you can exit by pressing CTRL + X, Y, then ENTER.

Then, change the permissions to make the file executable:

Open the list of valid shells:

At the bottom add:

Update the user’s shell with the following command:

Now, try logging into your server as sammy:

You will receive the following message :

• Click on Hosting at the top of the page.
• Click on FTP Management.
• You can see any existing FTP user accounts and also add a new FTP user.
• Enter your new user information.
• When finished, click Create User.