# Secure FTP with Linux

Secure FTP communication with your Linux host. These instructions apply to Ubuntu 18.04 and can easily be adapted for a vast majority of Linux platforms.

---

## Install FTP Server

Run the following commands to install FTP (`vsftpd`):

```bash
sudo apt-get update
sudo apt-get install vsftpd
```

To enable a local user account for FTP access, make the following changes to the `/etc/vsftpd.conf` file.

```bash
anonymous_enable=NO
connect_from_port_20=NO
local_enable=YES
write_enable=YES
```

To enable secure FTP over SSL/TLS, make the following changes to the `/etc/vsftpd.conf` file.

```bash
rsa_cert_file=/etc/letsencrypt/devshell.io/fullchain.cer
rsa_private_key_file=/etc/letsencrypt/devshell.io/devshell.io.key

listen_port=990
ssl_enable=YES
ssl_tlsv1=YES
ssl_sslv2=NO
ssl_sslv3=NO
allow_anon_ssl=NO
force_local_data_ssl=YES
force_local_logins_ssl=YES
require_ssl_reuse=NO
ssl_ciphers=HIGH
pasv_min_port=40000
pasv_max_port=50000
```

Note the `rsa_cert_file` and `rsa_private_key_file` referencing the trusted *Let's Encrypt* SSL/TLS certificate/key pair generated via the *Ghost* platform setup. Alternatively, you can generate your own (self-signed) certificate.

Restart the `vsftpd` service:

```bash
sudo service vsftpd restart
```

## Configure Firewall

Create the following `ufw` firewall profile file `/etc/ufw/applications.d/vsftpd`, with the following content:

```bash
[FTP Secure]
title=FTP Secure
description=Secure FTP over SSL/TLS
ports=990,40000:50000/tcp
```

The values for `ports` should correspond to the ones set in the `/etc/vspftpd.conf` file.  Enable the secure FTP ports in the firewall:

```bash
sudo ufw allow 'FTP Secure`
```

Check to make sure the `FTP Secure` connectivity is enabled in the firewall:

```bash
sudo ufw status
```

You should get an output similar to:

```bash
Status: active

To                         Action      From
--                         ------      ----
FTP Secure                 ALLOW       Anywhere
FTP Secure (v6)            ALLOW       Anywhere (v6)
```

## Testing

Test the secure FTP connectivity with an FTP client (e.g. FileZilla).

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1698816474589/d9110d53-e1d5-4535-9b13-0e03f4f128be.jpeg align="center")

## Troubleshooting

You may get the following error when attempting to connect to the default FTP port (21) via a secure SSL/TLS connection.

```bash
Status:      Connection established, waiting for welcome message...
Response:    220 (vsFTPd 3.0.3)
Command:     AUTH TLS
Response:    502 Command not implemented.
Command:     AUTH SSL
Error:       Could not read from socket: ECONNRESET - Connection reset by peer
Error:       Could not connect to server
```

This could happen in the case you tried to configure secure FTP connectivity in `/etc/vsftpd` (with all the changes described above), without changing the `listen_port` parameter. Hence the change of:

```bash
listen_port=990
```

## References

[FTP with Ubuntu](https://help.ubuntu.com/lts/serverguide/ftp-server.html.en)