Debian FTP Server User Management Guide

Managing users on a Debian FTP server primarily involves using vsftpd (Very Secure FTP Daemon)—the most widely used FTP server software in Debian-based systems. Below is a structured guide covering user creation, permission configuration, and essential security practices.

1. Install vsftpd

Before managing users, ensure vsftpd is installed. Run the following commands to update your package list and install the software:

sudo apt update
sudo apt install vsftpd

2. Configure vsftpd for User Management

The core of FTP user management lies in editing the vsftpd configuration file (/etc/vsftpd.conf). Open the file with a text editor (e.g., nano):

sudo nano /etc/vsftpd.conf

Adjust the following key parameters to enable local user access and restrict access to home directories:

• local_enable=YES: Allows login from local system users.
• write_enable=YES: Permits file uploads/downloads (modify as needed).
• chroot_local_user=YES: Restricts users to their home directories (prevents access to other parts of the filesystem).
• allow_writeable_chroot=YES: Required if chroot_local_user=YES is enabled—ensures the chroot directory can be written to (critical for uploads).

Save changes and exit the editor.

3. Create FTP Users

Use the adduser command to create a new FTP user. This command automates home directory creation and password setup:

sudo adduser ftpuser

Follow the prompts to set a password and provide optional user information (e.g., full name). The user’s home directory will default to /home/ftpuser.

Optional: Customize User Settings

• Change the Home Directory: Use usermod to set a custom home directory (e.g., /var/ftp/ftpuser):

  sudo usermod -d /var/ftp/ftpuser ftpuser
  

• Prevent Shell Login: For security, disable shell access for FTP-only users by changing their default shell to /sbin/nologin:

  sudo usermod -s /sbin/nologin ftpuser
  

4. Set Home Directory Permissions

Proper permissions are critical to ensure users can access their directories while maintaining security. Run these commands for each FTP user:

sudo chown ftpuser:ftpuser /home/ftpuser  # Set ownership to the FTP user
sudo chmod 755 /home/ftpuser            # Allow read/execute for others (required for chroot)

If chroot_local_user=YES is enabled, also run:

sudo chown root:root /home/ftpuser      # Root owns the chroot directory
sudo chmod 755 /home/ftpuser            # Prevent users from modifying the directory structure

5. Manage User Access with User Lists

For granular control over which users can log in, use the vsftpd.user_list file:

• Add Users to the List: Edit the file and include one username per line:

  echo "ftpuser" | sudo tee -a /etc/vsftpd.user_list
  

• Configure the List in vsftpd.conf: Ensure the following settings are present to allow only listed users:

  userlist_enable=YES
  userlist_file=/etc/vsftpd.user_list
  userlist_deny=NO  # Set to "YES" to deny listed users (opposite behavior)
  

6. Restart vsftpd to Apply Changes

After making configuration changes, restart the vsftpd service to apply them:

sudo systemctl restart vsftpd

7. Configure Firewall for FTP Traffic

If you’re using UFW (Uncomplicated Firewall), allow FTP ports to permit external connections:

sudo ufw allow 21/tcp       # Standard FTP port
sudo ufw allow 990/tcp      # FTPS (implicit SSL/TLS) port
sudo ufw allow 40000:50000/tcp  # Passive mode ports (adjust range as needed)
sudo ufw enable             # Enable the firewall

8. Test FTP Connection

Use an FTP client (e.g., FileZilla) to verify user access:

• Host: Your server’s IP address
• Username: The FTP user you created (e.g., ftpuser)
• Password: The password set during user creation

Test uploading/downloading files to ensure permissions are correctly configured.

Key Security Considerations

• Avoid Shell Access: Always set the FTP user’s shell to /sbin/nologin to prevent unauthorized system access.
• Use Passive Mode: Configure passive mode ports (as shown in Step 7) to support connections behind firewalls/NAT.
• Regularly Update Software: Keep vsftpd and the system updated to patch security vulnerabilities.
• Monitor Logs: Check /var/log/vsftpd.log for suspicious activity (e.g., failed login attempts).

By following these steps, you can effectively manage FTP users on your Debian server, ensuring secure and controlled access to your files.