Installing vsftpd on Amazon’s Linux AMI

By default, Amazon’s Linux AMI provides only the amzn repository. While this repository does have quite a selection of packages, there are a few commonly used packages that are missing (e.g. php-mcrypt). On the FTP side, the only FTP server included is VS-FTP (vsftpd). While my personal preference has historically been pure-ftpd, this is a quick look at how to setup vsftpd on the server.

The installation is quite straightforward:

sudo yum install vsftpd -y

Configuration files are located in: /etc/vsftpd

The only file that requires modification is vsftpd.conf

It is easier to setup ‘active’ FTP, but not by much. Active FTP requires fewer open ports on the server, but takes an extra step for a user in most cases.

The default config should provide a functioning server. If you are using Virtualmin, it might set the listen_address, which I found prevented vsftpd from starting, simply comment out the setting, and all works fine.

For FTP, you will need to open port 21, which can be done using Amazon’s EC2 console (they actually have an FTP option).

Start the FTP daemon (sudo service vsftpd start), and everything should just work.

With the above setup you will be running ‘active’ FTP. In a client, you will most likely need to explicitly set the transfer mode as active (in Filezilla, this is done at: Edit > Settings > Connection > FTP ).

Since passive mode tends to be preferred, it is a simple change to make.

Firstly, modify your vsftpd.conf file, adding:

pasv_enable=YES
pasv_max_port=xxxxx
pasv_min_port=xxxxx
pasv_address=xxx.xxx.xxx.xxx

The first setting enables passive mode, the next two restrict the port range (since ports need to be opened for this to work), and the last setting specifies the external IP address (e.g. elastic IP). Alternatively, the last setting can be replaced with:

pasv_addr_resolve=YES
pasv_address=DOMAIN_NAME

This variation is handy if a static IP is not being used, as it allows you to specify a domain name instead.

Following this, simply open the port range you chose:

Using Amazon’s EC2 console, add a custom port range to your security group, specify from and to values matching the min and max ports used in your configuration file, and set the type as TCP; the source IP will likely be 0.0.0.0/0 (no restrictions)

Finally, restart vsftpd (sudo service vsftpd restart) and give it a try. any system user not listed in the ftpusers and user_list files should be able to login (ec2-user, of course, doesn’t use a password, so might prove more of a challenge).