View source for Setup vsftp with SELinux

==Howto Setup vsftp with SELinux==

Vsftpd is a fast and secure FTP server. Installing an FTP server can assist you with uploading files to your droplet. This tutorial describes how to install and set up vsftpd on CentOS 6.

The first two letters of vsftpd stand for "very secure" and the program was built to have strongest protection against possible FTP vulnerabilities. 

===Step One: Install vsftpd with yum===

Since vsftpd is included in the default yum repo's we will install this with yum.

 yum install vsftpd -y

Once the files finish downloading, vsftpd will be on your server. Generally speaking, the server is already configured with a reasonable amount of security. However, it does provide access to anonymous users. We will not be needing the anonymous users, so we must disable this feature.

 vim /etc/vsftpd/vsftpd.conf

To disable anonymous users with vsftpd adjust the following line to say NO.

 anonymous_enable=NO

To enable local users to use vsftpd, you will need to change the following values.

 chroot_local_user=YES

Now you will want to start the service and enable to auto start on bootup

 service vsftpd restart

and 

 chkconfig vsftpd on

===Configure SELinux for FTP===

Lets first check and see what the SELinux options are and what the default values are.

 getsebool -a | grep ftp

You should see something like the following

 allow_ftpd_anon_write --> off
 allow_ftpd_full_access --> off
 allow_ftpd_use_cifs --> off
 allow_ftpd_use_nfs --> off
 ftp_home_dir --> off
 ftpd_connect_db --> off
 ftpd_use_fusefs --> off
 ftpd_use_passive_mode --> off
 httpd_enable_ftp_server --> off
 tftp_anon_write --> off
 tftp_use_cifs --> off
 tftp_use_nfs --> off

You will need to adjust the ftp_home_dir option and ftpd_use_passive_mode

 setsebool -P ftp_home_dir on
 setsebool -P ftpd_use_passive_mode on

===Configure IPTables for ftp===

By default iptables only allows connections from port 22.  This means that we will have to open port 21 and 20.

Allow FTP connections @ port 21
 /sbin/iptables -A INPUT  -p tcp --sport 21 -m state --state ESTABLISHED -j ACCEPT
 /sbin/iptables -A OUTPUT -p tcp --dport 21 -m state --state NEW,ESTABLISHED -j ACCEPT

Allow Active FTP Connections
 /sbin/iptables -A INPUT -p tcp --sport 20 -m state --state ESTABLISHED,RELATED -j ACCEPT
 /sbin/iptables -A OUTPUT -p tcp --dport 20 -m state --state ESTABLISHED -j ACCEPT

Allow Passive FTP Connections
 /sbin/iptables -A INPUT -p tcp --sport 1024: --dport 1024:  -m state --state ESTABLISHED -j ACCEPT
 /sbin/iptables -A OUTPUT -p tcp --sport 1024: --dport 1024:  -m state --state ESTABLISHED,RELATED -j ACCEPT

Now save them

 /etc/init.d/iptables save