vsftpd configuring

[LinuxHippy]

I see that you can start the vsftpd process from the services program. How do I then configure vsftpd ?

[Flyboy917]

I see that you can start the vsftpd process from the services program. How do I then configure vsftpd ?

This site is very helpful...though I haven't got it function correctly myself yet.

http://www.linuxhomenetworking.com/#Linux

Will keep you posted.

[killaweegee]

the default vsftpd configuration works out of the box if you are allowing anonymous users. The anonymous user folder is in /var/ftp/pub/. The vsftpd configuration file is /etc/vsftpd/vsftpd.conf. This file is very well commented and should help you configure it along with the link from above.

[LinuxHippy]

I edited that vsftpd.conf file and saw that it was set up to use port 20. nmap shows that port 21 is open for ftp. Do I need both ports 20 and 21 open to ftp files between pcs on my network?

[Tachi]

Yes.
Port 21: control
Port 20: data

[LinuxHippy]

Ahhh! I see port 21 is already open. How would I drop port 20 for ftp. I got these commands from other threads, but they don't drop port 20:

iptables -I INPUT -p tcp --dport 20 -j ACCEPT
iptables -I INPUT -p udp --dport 20 -j ACCEPT

iptables -A INPUT -p TCP -i eth0 --dport 20 -s 192.168.1.0/24 \-m state --state NEW -j ACCEPT

[killaweegee]

By drop are you meaning you want to stop all traffic from using port 20 or are you wanting to allow port 20? The iptables commands you displayed will ACCEPT traffic on port 20 because of the -j ACCEPT command. If you are wanting to simply drop them on the local machines firewall just change your iptables commands to -j DROP at the end.

[LinuxHippy]

I want to open up port 20 to allow ftp transfers. Those commands didn't open port 20.

[killaweegee]

if you are opening this port to forward to an internal ftp server you could do this: iptables -t nat -A PREROUTING -i $extint -p tcp -m tcp -j DNAT --to ipofftpserver.

If you are opening this port on the local machine without running nat your commands from above looks as though they should work. If you do have a firewall between your networks be sure to allow the port there as well.