2

Can anyone offer any suggestions. I have an Amazon EC2 instance running, based on the 64-bit Amazon Linux AMI. I've installed all updates using yum, and have installed PHP5.3 and the vsFTPd service.

I've created a new user group, and a new user, given a password to the user and made the html folder for web php files owned by the new group. Everything in that respect works fine. Create a php file in vi and the page is visible in a browser.

Now i've started the vsFTPd server, all is ok. I can connect to it almost instantaneously from a terminal screen, but doing ls -l takes ages to return.

Connect from FTP software and it can take upwards of 60 seconds to connect, the same when changing folders. Then when you try and upload a file, sometimes it will go, and it always seems to create folders ok, but then times-out or drops the connection and won't restart. Cancel the transfer, and set it up again, and it reconnects fine.

Can anyone offer any ideas as to whats wrong? I've tried both passive mode on and off on the FTP client, but it doesn't make any difference. I don't see that much can be wrong as its connecting and does transfer a couple of small text files before timing out.

Any thoughts or suggestions would be very helpful if you guys can! I'm out of ideas!

4
  • 2
    Did you specify the pasv_min_port/pasv_max_port values and open the corresponding port range (as well as ports 20 and 21) in your security group? The approach I took to setting vsftpd up on Amazon's Linux is described here
    – cyberx86
    Oct 29, 2011 at 0:00
  • @cyberx86 - thanks for that i'll give that a try. What min/max port numbers would you specify? I've got Port 21 set in the security settings for FTP, so i'll set 20 as well!
    – TIW
    Oct 30, 2011 at 17:08
  • Something above 10000 - pick something a bit random. You will need more ports for more users, so if you are the only user, you should be able to only keep 2 or 3 ports open (e.g. min: 15243, max: 15245) - I believe it is normally one port per connection (but it is often possible for the user to establish more than one simultaneous connection, even if unlikely).
    – cyberx86
    Oct 30, 2011 at 19:18
  • @cyberx86 - Thanks very much. Yes that solved the problem, files are transferring very quickly and the whole FTP service is responding like lightening now!! Thanks for your help.
    – TIW
    Oct 31, 2011 at 14:18

2 Answers 2

1

SETUP vsFTPD SERVER IN AMAZON LINUX VIA SFTP

  1. Update the "yum" repository

    sudo yum update -y

  2. Install vsFTPD Server from yum repository

    sudo yum install vsftpd -y

  3. Configure Basic Settings for vsFTPD server

    sudo vi /etc/vsftpd/vsftpd.conf

    a. Make the below changes in the file and save i. Disable anonymous users anonymous_enable=NO ii. Allow local users, meaning that vsFTPD server will use Linux system users and authentication to determine who can sign in local_enable=YES iii. Allow local users WRITE access, so that they can upload material and modify content write_enable=YES iv. Confine users to the respective home directories chroot_local_user=YES v. Basic vsFTPD related changes pasv_enable=YES pasv_min_port=1024 pasv_max_port=1048 pasv_address=

  4. Create an FTP User

    sudo adduser ftpuser

  5. Assign a password to the new user

    sudo passwd ftpuser

  6. Configure SSL with vsFTPD server a. Create a sub directory to store the files # sudo mkdir /etc/ssl/private

    b. Create the certificate and the key in a single file # sudo openssl req -x509 -nodes -days 365 -newkey rsa:1024 -keyout /etc/ssl/private/vsftpd.pem -out /etc/ssl/private/vsftpd.pem

    c. Add the SSL Details to the vsftpd Configuration File # sudo vi /etc/vsftpd/vsftpd.conf

    i. Specify the location of the certificate and key files
        rsa_cert_file=/etc/ssl/private/vsftpd.pem
        rsa_private_key_file=/etc/ssl/private/vsftpd.pem
    
    ii. Enable the use of the files, disable anonymous users and force the use of SSL for both data transfer and login routines
        ssl_enable=YES
        allow_anon_ssl=NO
        force_local_data_ssl=YES
        force_local_logins_ssl=YES
    
    iii. Restrict the type of connection to TLS, which is more secure than SSL
        ssl_tlsv1=YES
        ssl_sslv2=NO
        ssl_sslv3=NO
        require_ssl_reuse=NO
        ssl_ciphers=HIGH
    
  7. Restart vsFTPD server to enable our changes

    sudo /etc/init.d/vsftpd restart

  8. Start vsFTPD server automatically with every reboot

    sudo chkconfig vsftpd on

0

One factor that may contribute to the poor functioning of vsFTPd is your firewall rule set. For a typical FTP session, you will want to use passive FTP (usually works better with your user's setups - both the programs they use and their firewalls).

For this, you will need to open ports 20, 21, and whatever ports you specify in your vsftpd configuration.

In vsftpd, you can configure a passive port range, by setting the pasv_min_port and pasv_max_port values. This allows you to use passive FTP while allowing them to easily work with firewalls of the sort implemented by EC2.

You should pick ports above 10000 - ideally something a bit random. You will need more ports for more users, so if you are the only user, you should be able to only keep 2 or 3 ports open (e.g. min: 15243, max: 15245) - I believe it is normally one port per connection (but it is often possible for the user to establish more than one simultaneous connection, even if unlikely)

If you have a firewall (e.g. shorewall) running on your server, you will need to configure that - also, your iptables rules need to permit the FTP connection on the ports you have specified. On the EC2 end of things, you need to open the appropriate ports in the security group your instance is running under. A few more points from my approach to setting up passive FTP with vsftpd on Amazon's Linux can be found here.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .