One option for building an FTP server is to use pure FTPd,
in this episode we'll take a closer look.
>> You're watching ITPROTV.
[MUSIC]
>> Welcome back, I'm here with Don for more help pick.
And if you've been following along in our episodes,
then you know that we kind of started diving into FTP in the last episode and
this episode we're going to continue that.
So, what exactly are we gonna be talking about?
Well, this time we're gonna learn about pure FTPd,
which is another FTP demon available inside of Linux.
We'll learn some of its advantages over other products.
We're gonna see how to get it installed and
then how to configure it to be as secure, well as secure as we can make FTP.
>> So what can you tell us about pure FTPd and
why would we use it as opposed to vsftpd?
>> All right, well, vsftpd is far more common, and honestly, as usual,
they go to FTP server, but where pure FTD kind of excels is, it still has
a focus on security, like the vsftpd does, except it's very feature rich.
It has a lot of really advanced features that are inside of it.
If you take a look at their homepage, you can actually see a lot of that.
So I'm on the pure FTPd secure FTPd Demon.
This is a lot of acronyms today.
And basically they highlight some of the features they have and so on.
It's a great product, I will say, I do normally go to the vsftpd decide because
a lot of the features they have are ones that I don't necessarily need.
But if you're running a large scale FTP server,
then you will find that you benefit from a lot of what they have.
For example, maybe you want to do ratio downloads for
every five gigs of data you want to download,
you have to upload at least one gig or you want to do moderated upload.
So you can upload into a temporary folder and an admin has to approve them.
If you want advanced features like that to actually run a FTP site in a like
a commercial environment.
Pure FTPd has a lot of the features that will let you do that.
So that's usually what drives people to using this one.
So, if you need advanced functionality, this one's your choice.
If you don't if you just need basic FTP services and you want it to be secure.
Vsftpd in a lot of cases is a better choice.
So what does it take to get pure FTPd up and running?
It's a little bit different than what we saw with the vsftpd.
One of the big differences with it is that pure FTPd?
It can it can run as a service as a demon running as the root account or,
system credentials or it can run entirely in user space.
So it's a very safe application because if it's running in user space,
if it runs as my user account for example,
it won't have access to anything that my user account doesn't have access to.
That's what helps it be secure.
But it does make the configuration a little bit different.
And let me show you what I mean.
I'm gonna go to my command prompt here and we'll get it installed.
It is a part of Ubuntu standard repository so I don't have to download it.
I can just say sudo Apt install Pure-FTPd like that.
So it's gonna go and download it very streamlined.
Not a whole lot of package dependencies coming along with it.
I'll say yes to get that installed and there it goes.
And once it's installed we've got it.
I can turn it on by doing Sudo system CTL enable--now.
Pure-FTPd.
And the first time you started this is where things get a little bit weird.
We're gonna get some authentication prompts that you might not be used to.
Actually mine just did it automatically for me.
Perfect.
If you get an authentication prompt here,
you might actually have to provide your user account credentials up to three
times in order for it to be able to attach your user account to run.
In my case it automatically picked it up and so
it's added it the services started and I'm good to go but
just be aware that on some destro's you will see that authentication prompt, and
that's because it's binding to your user account running in user space.
That's a little bit of variation and that prompted kind of throw people.
Otherwise I do need to open up some ports on my firewall,
so I'll do sudu UFW allow 20-TCP.
And I'll follow that up with 21, I guess I could have done a range command and
save a little time.
I will do that from my passive ports though.
So I'm going to allow 10,000 through 20,000 and
that's gonna be for TCP and I can add a comment to remember, or whatever but
that's from my passive transfers that happened inside of FTP.
Once that's done, I basically got the server installed running and
I've got my firewall configured, so I'm pretty good to go.
>> And now that it is up and running, how can we go about configuring it?
All right this is probably the biggest part where we deviate from
a standard configuration.
Pure FTPds configuration is straight up weird.
It's just a strange one, the developers, they wanted it to be a little
bit more portable where it was easy to take the configuration and
drop it on new servers without a whole lot of hassle.
It does have a standard configuration file but they don't want you to edit it.
Let me show you what that looks like.
I'm gonna go into /ATC/Pure-FTPd.
And if you take a look in there, you'll see Pure FTPd.com.
That's the main configuration file.
And if I edit that, which, it will let me I can go into that file and
I can start modifying configuration settings.
Right in here, the configuration settings are really simple.
There is a property followed by a value.
So here's a property broken clients, compatibility and
then the value is set to know that compatibility is turned off, right?
So everything will be like that, a name on the left, and a value on the right,
if I want to edit it, I just go through and I put that in here.
For example, if I want to enable anonymous communications,
then I would come in and say well actually anonymous is on by default.
So if I wanted to turn off anonymous communications, well,
we could find that in here.
It's called no anonymous right here.
No anonymous.
I could set that to yes.
And that would turn off anonymous accounts kind of almost like a double negative
by default.
No anonymous set to no means anonymous users are allowed.
Well, if I edit it here and reload that's fine.
But if I go to a new server or if I need to merge configurations,
I've got to go line by line and find the differences and fix that.
That can be a bit of a hassle.
And so what they've done is they've set up a system where instead of
changing values in the config there is a sub folder in here called camp.
And what you can do is you can create text files in here where the file name
matches the property and then inside of the pile the file you put the value.
So you can see I've got a file in here that says no anonymous and
if I look inside of it, it just has the word, yes, no anonymous is set to yes.
And that means right now I am not allowing anonymous communications and
if I want to allow anonymous communications I need to change that.
Yes to a no.
So I can just edit that file.
So I'll say sudo edit no anonymous and I'll say no to that.
And when I save it, that's going to make it where now that setting is set
to know and a lot of people just kind of automate this using the T command.
So you can echo the word.
No pipe it into tea and drop it into that file.
It's kind of a hassle.
It's usually easier to edit the file but it's a weird way to configure it, but
just know that that's kind of different than pretty much any other service that's
out there.
No anonymous.
That's one setting, we might want to make another one.
I might want to set up my passive ports ranges.
And so I could come in and say echo 10,000 space 20,000, right?
Those are the values I want from my passive ports.
I'm gonna echo that into sudo
T /etc/ pure-FTPd/comp/passive range or
passive ports range.
I've got to do the right value here.
Pass support range.
When I do that, it's going to create a file called passive ports range.
And inside of it has 10,000 space 20,000.
So that setting is the same as if I had gone and
edited the main configuration file and put it in there.
Now when it loads it will read that it'll see that it's available and it will.
No, that's what I want.
So that's kind of how we go about configuring it.
It's weird but once you get used to it it's not so bad.
>> Now, is there any way for you to monitor people's access?
>> Yeah, actually the logging should be turned on by default.
Let's check that out.
So I've got this value right here alt log, right?
Alt log, it's a little confusing because that stands for alternative logs.
So if you want to do something alternative to the default but
what's in there already is the default If I can't that file let me cat or a dog.
I can see he's got one entry in there, which is CLF colon and
then it points to a file/bar slash log/Pure-FTPd/transfer.log.
That's the default log.
It's already created is already enabled.
But that CLF at the beginning, right?
That is it's just a regular carriage, return line feed,
simple text log file that we're used to.
I'm trying to remember what it stands for.
I think it's common log files what that actually stands for
where each line represents a single log entry and that's that,
but it does actually support more than one style or format of log.
So let me edit that.
So I'll do a suit edit aunt log and I can just add more entries to this.
If I have more than one type of log, I want to output,
I can just punch it in here.
So maybe I want W3C formatted logging.
This is really useful if you have like a security like centralized logging or
a seam and it's expecting log files in a certain format.
We can put it in the W3C format and have that, I'll need to specify
a destination and I don't want to use the same file name or I'll have a conflict.
So maybe I'll call this one,
we'll call it transfer-W3C.log.
And it also supports doing one that is optimized for statistics.
So I'll call that one stats colon slash bar slash
log slash Pure-FTPd/transfer-stats.log.
So now it's going to generate three different log files of activity on
the system in three different formats.
And so I'm just dropping them all in here.
Now, the cool part about this is in theory,
all the stuff that I'm putting in the com folder.
These are the things that I'm modifying on the server.
So if I ever want to go to a new server, I just have to copy these files over and
it's got my configuration.
And if some of these files already exist in the new server now,
I know where there's a conflict.
So I know exactly where to look for settings that might bump into each other
and I can fix that versus if I just copy a configuration file over.
Well, I've got to run some kind of comparison on them or
something to find it.
This makes it a lot easier.
That's one of the reasons why they chose to do this.
But once I've got that put in place,
I do need to restart Pure-FTPd before that will work.
So I'll do a sudo system CTL restart.
Pure-FTPd.
We'll get that restarted and then let me connect to the server and
transfer something.
I'm gonna fire up trusty old.
What do I want to use today?
Let's use files Zilla again.
All right. So infernal zilla,
I can just get connected to my server.
I'm gonna punch in the IP 10.222.0251.
I'll use my user name to connect, so that I'll see it in the log.
I'll punch in my super secure password and I'm gonna go ahead, and connect.
Now I will get a warning because FTP is using plain text by default, so
I'll just have to say, okay to that and it's gonna
connect I see my home directory, and maybe I want to copy something down.
Let me drop something in.
Let's see do I have my downloads folder here?
I will copy this file down so it's gonna download and
then once it's downloaded now I can go, and see that in the logs.
I'll do a sudo cat/var/log/pure-ftpd/transfer.log
was my default log.
And right there I can see that entry that I've transferred the file.
I can see that user depzet got/home/depzet/file.
One.text, so I can see that activity.
It's all stored right there in the logs and
we can make sure that our server is being accessed responsibly.
>> Now Pure-FTPd is supposed to be pretty secure but
FTP is just a plain text protocol.
So is there a way that we can make Pure-FTPd use encryption.
>> You can but I'll say the same thing that I said about the Sftpd,
which is why you can make it secure.
You generally don't want to that there are better protocols for that.
Sftp, the secure file transfer protocol uses ssh,
you don't even need an FTP server.
It does a better job of encrypted file transfers.
But if you want the advanced bells and whistles of pure FTP, you want like ratio
downloads, then that's where you just need to make it as secure as you can.
And so we can bolt on TLS or transport layer security to add that functionality.
It's just like ssl on a on a web page.
We can make ftp run over that and configure ftps.
The only thing we need is a certificate.
We've got to generate a certificate for this.
And unlike the sftpd where it used like the default system one here,
I'm going to generate a self signed certificate for us to use.
So in order to do this, there's two things I have to set.
First off, I need to enable TLS in my configuration so to do that,
we have a simple setting.
I'll just say echo one and I'm gonna sudu t, that and
I'm gonna drop that in slash btc/pure-ftpd/camp/TLS.
The TLS setting has a few different values.
Well, there's zero, which is to not do it.
One is to make it optional and two is to require it.
So if I want to require TLS, I can set that to two, if I wanted to be optional.
I just said it to one and that's what I'm doing.
I'm making it optional on my FTP server, but that setting right there is gonna tell
it that I want to at least support it and enable TLS then I need a certificate.
So for that what I'll do is let me just switch to my home directory for
a moment and I'm gonna do a openssl req.
So I'm gonna generate a certificate request for a-x 509 certificate.
I'm gonna do -nodes.
And that's what's going to let it know that I don't need a pass phrase on it and
I'm gonna self sign this one.
Then -new key.
So I'm generating a key.
I'll do rsa colon 2,048.
So I'm doing a 2,048 bit key and then -key out.
I'm gonna output this to a file called Pure-FTPd.pem.
And then I have to specify dash out again for the certificate part.
So it's just the signed certificate.
I'm gonna put it in the same file, so it'll be pure-ftpd.pem.
Pem files can store the key, the certificate,
you can store it all in one and the last thing I'll do days I'll make this one for
we'll do two years, 730 days, so I'll run that.
It's gonna ask me for my country, my state.
So I'll just kind of punch in the values as we need them to be.
I'll be ITPROTV will be my company today organizational to be the IT Department,
the fully qualified name for my FTP server.
Maybe mine's just lab that ITPRO.TV.
The email address people can reach for support.
I'll leave that blank and
when it's done I'll have generated that pem file now I called it pure-ftpd.pem.
I did that on purpose because that's what the default configuration is looking for.
If I name it anything else, I have to go and modify the config for it.
So it's better to just use the standard name.
I need to move it into the right spot.
So I'll do a sudo cp, pure ftpd.pem.
I'm going to copy that to /etc.ssl/private and
I have to spell cp, right?
Apparently I do not know how to do that.
There we go and then I need to change its permissions a little bit.
I'll do a sudu ch mode, 600,
I needed to not have write permissions on it and
I will assign that to /etc/ssl/private/pure-ftpd.pem.
And I left the hyphen out, so let me get that in there.
There we go.
Once we've got that certificate with the right permissions we've got in the right
place now we just have to restart Pure-FTP.
So I'll do a sudo system CTL restart pure-FTPd.
That'll restart it up and now I should be able to connect and
actually get a secure connection this time.
So let me disconnect from the server and this time I will let me create a site.
All right actually I got my site leftover from last time.
I'm sure it will love the different certificate.
So let me just run that through and
this time when it connect sure enough it sees a certificate and
it's asking me do I trust it, and I can see all the values that I just put in.
I'll trust it and say okay and now I connect up and
I can see TLS connection established.
This is now an encrypted connection to my FTP server.
>> Well this is a great introduction to pure FTPd and some of its features.
We've got to look at the installation process and configuring it.
I mean we're also gonna look at some enabling, some of the security features as
well but that's all we've got time for in this episode.
Stick around because we've got more help it coming up.
Thanks so much for watching.
We'll see you next time.
>> Thank you for watching ITPROTV.
[MUSIC]