How to setup an anonymous FTP download server

Sometimes you may not need to set up a full FTP server with authenticated users with upload and download privileges. If you are simply looking for a quick way to allow users to grab a few files, an anonymous FTP server can fit the bill. This article shows you show to set it up.

This example uses the vsftp server.

Installing and configuring the anonymous FTP server

Install the vsftp server using sudo:

$ sudo dnf install vsftpd

Enable the vsftp server.

$ sudo systemctl enable vsftpd

Next, edit your /etc/vsftpd/vsftpd.conf file to allow anonymous downloads. Make sure you have the following entries.

anonymous_enable=YES

This option controls whether anonymous logins are permitted or not. If enabled, both the usernames ftp and anonymous are recognized as anonymous logins.

local_enable=NO

This option controls whether local logins are permitted.

write_enable=NO

This option controls whether any FTP commands which change the filesystem are allowed.

no_anon_password=YES

When enabled, this option prevents vsftpd from asking for an anonymous password. With this setting, the anonymous user will log straight in without one.

hide_ids=YES

Enable this option to display all user and group information in directory listings as ftp.

pasv_min_port=40000
pasv_max_port=40001

Finally, these options set the minimum and maximum port to allocate for PASV style data connections. Use them to specify a narrow port range to assist firewalling. You should choose a range for ports that aren’t currently in use. This example uses port 40000-40001 to limit the ports to a range of 1.

Final steps

Now that you’ve set the options, add the appropriate firewall rules to allow vsftp connections along with the passive port range you specified.

$ firewall-cmd --add-service=ftp --perm
$ firewall-cmd --add-port=40000-40001/tcp --perm
$ firewall-cmd --reload

Next, configure SELinux to allow passive FTP:

$ setsebool -P ftpd_use_passive_mode on

And finally, start the vsftp server:

$ systemctl start vsftpd

At this point you have a working FTP server. Place the content you want to offer in /var/ftp. (Typically, system administrators put publicly downloadable content under /var/ftp/pub.) Now you can connect to your server using an FTP client on another system.


Image courtesy of Tom Woodward on Flickr, CC-BY-SA 2.0.

FAQs and Guides For System Administrators Using Software

16 Comments

  1. Danniello

    Nice, but because browsers will not support FTP protocol soon – it would be great to have instruction howto configure https file server in Fedora…

  2. Brett Schroeder

    Nice succinct summary, Curt!

    Can you explain what are the correct file permissions, including SELinux contexts, for content in /var/ftp, please?

    • Thanks Brett!

      The file permissions for /var/ftp/pub are 755 with root:root as the ownership.

      The following SELinux label applies to /var/ftp/pub:

      system_u:object_r:public_content_t:s0

    • @Brett: There are two parts to this answer. First, if you copy content to that area, it will automatically be labeled correctly. If you find an SELinux label problem (for instance, if you move rather than copy content), you can use the ‘restorecon’ tool to relabel properly. Second, file permissions should still be set so they are world-readable — 644 for files, 755 for directories would be prudent, owned by root/root.

  3. @Brett: What Paul said too!

  4. Ken

    You should probably include a caveat about the security considerations of allowing anon FTP.

    I’m no expert, but I have had machines with anon FTP infected by script kiddies (though it didn’t help that that machine also used telnet, not ssh).

    Also, I would suggest some mention of DMZs, jails, chroot, containers, etc.

    Honestly, anon FTP was common in the 80s, but the Morris worm changed that.

    • @Ken: The vsftpd server was designed in part to cope with and minimize security vulnerabilities. With appropriate standard practices noted in other comments, running an anonymous service using vsftpd needn’t be hazardous.

  5. Seal

    how do i access the ftp server with ftp client?

    • Curt Warfield

      @Seal

      If you are using the standard FTP client from the command line:

      $ ftp “hostname”

      Where you’d substitute “hostname” for the FTP server IP address or it’s domain name.

      When prompted for the username, simply type: anonymous

  6. Seal

    I have tried accessing the contents using a web browser and filezilla ftp client but i couldn’t get through

  7. Undoubtеdly one of my most favorіte blogs to read through when starting the day with
    a mug of cappuccino of courѕe!

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.

The opinions expressed on this website are those of each author, not of the author's employer or of Red Hat. Fedora Magazine aspires to publish all content under a Creative Commons license but may not be able to do so in all cases. You are responsible for ensuring that you have the necessary permission to reuse any work on this site. The Fedora logo is a trademark of Red Hat, Inc. Terms and Conditions

%d bloggers like this: