How To Secure FTP Server

How To Secure FTP Server

As popular as FTP is FTP communication is not secure, all communication is plain text and can be easily captured. Despite this serious weakness, few do anything to secure it. There are simple ways to correct this with VSFTPD.

SSL/TLS With FTP
FTPS is also known as FTPS Secure or FTP-SSL.  What FTPS does is add the Transport Layer Security (TLS) and the Secure Sockets Layer (SSL) to the normal FTP on the same port 21.  It is easy to confuse FTPS on port 21 with SFTP which is actually SSH on port 22.

Add these settings to your /etc/vsftpd.conf file and you will have an anonymous ftp server that will allow anyone to download files from /var/ftp but they cannot upload. It will also protect all of your users as they must ftp into their home accounts using ssl.

anonymous_enable=YES
local_enable=YES
rsa_cert_file=/ etc/vsftpd.pem
ssl_enable=YES
force_local_logins_ssl=YES
force_local_data_ssl=YES
ssl_tlsv1=YES
ssl_sslv2=YES
ssl_sslv3=YES

You do not need to create the self-signed certificate as they are already created by the vsftpd server as you can see listed. Notice that ssl is enabled only for local logins, users who have accounts on the machine. The connection will still be on port 21. Once you have the server set up you will need a client that is ftps compatible.

Create Self-Signed Certificate
You can create a self-signed certificate with this command which will create a certificate for 1 year and the pem file is then saved in the /etc/directory. Note that you will need to change the /etc/vsftpd.conf file to enter the path of this file. You will be asked several questions which will identify your organization.

# openssl req -x509 -nodes -days 365 -newkey rsa:1024 -keyout /etc/vsftpd.pem -out /etc/vsftpd.pem
Generating a 1024 bit RSA private key
……++++++
..++++++
writing new private key to ‘/etc/vsftpd.pem’
—–

You are about to be asked to enter information that will be incorporated into your certificate request.What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter ‘.’, the field will be left blank.
—–
Country Name (2 letter code) [AU]:US
State or Province Name (full name) [Some-State]:MT
Locality Name (eg, city) []:Trout Creek
Organization Name (eg, company) [Internet Widgits Pty Ltd]:Example LTD
Organizational Unit Name (eg, section) []:
Common Name (eg, YOUR name) []:example.com
Email Address []:fsmith@example.com

Edit /etc/vsftpd.conf and comment out the rsa certificate and private key files that are there by default and add these lines which show the path to your self-signed certificate.

rsa_cert_file=/etc/vsftpd.pem
rsa_private_key_file=/etc/vsftpd.pem
Restart the ftp server.
service vsftpd restart

Using a FTP Client that is SSL/TLS Compatible

The popular Linux ftp client gFTP will not connect using SSL when you are using self-signed certificates, you would have to purchase a real certificate for your business. Another Linux alternative is to use ftp-ssl. This is a command line version of ftp and actually will replace ftp with this client. It functions that same as ftp. It will attempt to connect using ssl, if it is not enabled it will drop back to regular ftp. The Filezilla version for Linux continued to crash when the connection was made, so it is not a reliable option.
When you connect you will be asked to accept the self-signed certificate, either which you made or the default for vsftp.
Accept the certificate and you have encrypted FTP on port 21.
If you have users connecting with FileZilla for Windows, which is reliable, you will need to make these changes so they can log in with SSL. Note the port is still 21 but the Servertype is now FTP over SSL.

Using find Command By Examples

The find command is a Linux command that is used to search for files in the Linux file system. In fact, it is a standard shell command that exists in most Linux/Unix variants.

    To search for all files that end with .sh, from the root directory down to all sub directories. Execute the find command as

    find / -name "*.sh" -print

    To search for all files that end with .sh, from both the dir1 and dir2 directories, and change the file permission mode to 755 for those matching files. Execute the find command as

    find dir1 dir2 -name "*.sh" -exec chmod 755 {} \;

    To search for all files that contains case-sensitive search term ABC, from the root directory down to all sub directories. Execute the find command as

    find / -name "*" -exec grep -H "ABC" {} \;

    To narrow down the scope of file searching as well as speed up the searching efficiency, rewrite the find command as

    find / -type f -name "*" -exec grep -H "ABC" {} \;

    to get find command search for regular file only instead of all file type that exists in the file system.

    Using the grep command by understanding grep command option switches

    grep -HIirls ABC *

            to search all files from the current directory that contain the search pattern ABC
            -H to print out filename
            -I to ignore binary file
            -i to search case-insensitive
            -r to search recursively from the directory to all sub directories
            -l to show file name once only for the file that containing the search pattern and exit from further search when the first match of pattern found in the file
            -s to suppress any errors message about non-existent or unreadable file

    Others forms of Linux command that serve the same purpose could be

    find / -type f -print | xargs grep -H "ABC" /dev/null
              or
    egrep -r "ABC" *

    To search for all files that are 1000KB (1MB) in file size, from the root directory down to all sub directories. Execute the find command as

    find / -size 1000k -print

    To search for all files that are greater than 1MB in file size, from the root directory down to all sub directories. Execute the find command as

    find / -size +1000k -print

    To search for all files that are between 1MB and 2MB (inclusive) in file size, from the root directory down to all sub directories. Execute the find command as

    find / -size +1000k -size -2000k -print

    Note! Use the +/- sign to indicate range, which apply to the time related quantity, as showing below.

    To search for all files that are own by user ID 501, from the root directory down to all sub directories. Execute the find command as

    find / -user 501 -print

    To search for all files that are created less than five minutes ago, from the root directory down to all sub directories. Execute the find command as

    find / -cmin -5 -print

    This form of find command is useful to find out the effects of system change after installing or updating Linux package.

        Linux file creation time vs Linux file modification time

        The Linux file creation refers to a file being created in the file system, changes of file permission, or changes of file ownership.

        Linux file modification time refers to a file last editing time.

        Take a look on the diagram below, which is a snapshot of $HOME/bin directory contents listing.

        Different of Linux file creation time and file modification time

        The ls -la command shows that wdf file modification or last edited time on Sep 29 11:25. Then ls -lc command shows that wdf file creation time on Oct 15 12:26 which is the time the file being extracted from a tarball.

    To search for all files that are created less than 2 x 24 hours ago, from the root directory down to all sub directories. Execute the find command as

    find / -ctime -2 -print

    To search for all files that are modified less than five minutes ago, from the root directory down to all sub directories. Execute the find command as

    find / -mmin -5 -print

    To search for all files that are modified less than 2 x 24 hours ago, from the root directory down to all sub directories. Execute the find command as

    find / -mtime -2 -print

    To search for all files that are accessed (such as execute the file, view the file using vi, cat, less, etc) less than five minutes ago, from the root directory down to all sub directories. Execute the find command as

    find / -amin -5 -print

    To search for all files that are accessed less than 2 x 24 hours ago, from the root directory down to all sub directories. Execute the find command as

    find / -atime -2 -print

    To search for all files that are own by group ID 22, from the root directory down to all sub directories, and change the group ID to 112 for those matching files. Execute the find command as

    find / -group 22 -exec chown :112 {} \;

    To search for all directories that are global writable, from the root directory down to all sub directories. Execute the find command as

    find / -perm -0002 -type d -print

    To search for all files that are not own by any user and group, from the root directory down to all sub directories. Execute the find command as

    find / -nouser -o -nogroup -print

    To search for all directories exists in the file system. Execute the find command as

    find / -type d -print

    The alternative form of commands are

    ls -ap | grep /
    find / -type d -printf "%P\n" apply -printf switch to show directories name only and discarding the leading path.

    To find the total disk space take up by all tarballs ended with .gz file extension

    find / -type f -name "*.gz" -exec du -k {} \; | awk '{sum+=$1} END {print sum"KB"}'

    To create CPIO archive backup of dir1 and dir2 directories. Execute the find command as

    find /f1 /f2 -depth -print | cpio -ocvB -O /f2f2.cpio

What happens when a device is plugged in?

What happens when a device is plugged in?

Many times device Plug-in related questions comes in our mind . These questions specially arises when we face challenges to block certain device on the server , or block certain devices for certain users . Let me explain my understanding on this topic.

For newly Plugged-in device , given below steps take place


1. Kernel detect the Plug-in device and export device status to sysfs. You can view exported state via mounted /sys virtual filesystem.


2. Kernel then notify udev about this event via netlink socket.


3. udev process the user-configurable rules (present in /etc/udev/rules.d) and creates device file in /dev.


4. After creating device node , udev notify hald about the event via the socket.


5. HAL probes the device for information.


6. The device object structure populates with the probed information.


7. HAL broadcast Plug-in event.


8. A user-space application then process the information.


In this complete process , We can add our custom hook in udev rules . For example suppose you want to notify administrator via mail about any usb storage device insertion on the system, we can do that by udev rules. In coming posts ,I will explain about writing udev rules.

Extract A File From RPM

Extract A File From RPM 

RPM is a powerful Package Manager, which can be used to build, install, query, verify, update, and erase individual software packages. A package consists of an archive of files and meta-data used to install and erase the archive files. The meta-data includes helper scripts, file attributes, and descriptive information about the package. Packages come in two varieties: binary packages, used to encapsulate software to be installed, and source packages, containing the source code and recipe necessary to produce binary packages.

Sometimes we need a particular file from rpm. To get it, we have to install that rpm. But using this Article, you might not install rpm to get particular file.

By mistake I have deleted /sbin/poweroff file from system. Now we need to find out which rpm contains /sbin/poweroff

# yum whatprovides /sbin/poweroff

systemd-sysvinit-10-2.fc14.1.i686 contains /sbin/poweroff in Fedora 14.

Now, if you try to install that package using yum, we will get “Package systemd-sysvinit-10-2.fc14.1.i686 already installed and latest version”.

To restore /sbin/poweroff, all we need is systemd-sysvinit-10-2.fc14.1.i686.rpm and rpm2cpio, this is bundled with rpm-x.x.x…i386.rpm.

# rpm -ql rpm | grep rpm2cpio

/usr/bin/rpm2cpio

/usr/lib/rpm/rpm2cpio.sh

/usr/share/man/ja/man8/rpm2cpio.8.gz

/usr/share/man/ko/man8/rpm2cpio.8.gz

/usr/share/man/man8/rpm2cpio.8.gz

/usr/share/man/pl/man8/rpm2cpio.8.gz

/usr/share/man/ru/man8/rpm2cpio.8.gz

# rpm2cpio systemd-sysvinit-10-2.fc14.1.i686.rpm | cpio -idmv

# cp sbin/poweroff /sbin/

Note: There is another way to install systemd-sysvinit-10-2.fc14.1.i686.rpm by forcefully installing it.

# rpm -ivh systemd-sysvinit-10-2.fc14.1.i686.rpm –force