FTP Server Configuration

Introduction:-

FTP is File Transfer Protocol which is used to transfer files between server and clients. FTP is most used protocol over internet to transfer files and it support all the platforms. FTP server works on client-server architecture. FTP client can easily connect to FTP server and it can download and upload files.

Requirement:-

• Package = vsftpd
• Port = 20 [ Control Connection ]

                      21 [ Data Control ]

• Configuration File = /etc/vsftpd/vsftpd.conf
• Service = vsftpd
• FTP home dirctory = pub

Per quest on FTP Server:-

• Configure FTP Server IP = 192.168.1.1
• Configure Linux Client IP = 192.168.1.2
• Configure Windows Client IP = 192.168.1.3
• Hostname = server.rootuser.in
• Firewall must be disabled of Server and Client

FTP Server Side Configuration:-

1] Install vsftpd package for FTP service

[root@server ~]# yum install vsftpd* -y

2] Verify wheather the package is install or not

[root@server ~]# rpm -qa vsftpd

3] Edit main configuration file of FTP service. ( Uncomment the follwoing lines which are in BOLD format)

[root@server ~]# vim /etc/vsftpd/vsftpd.conf

#Allow anonymous user to get login to FTP   anonymous_enable=YES

#To allow local users to log in uncommnet this line. 
local_enable = YES
#Uncomment this line if you want local users to be able to upload files.
write_enable = YES
#To allow uploading for anonymous user uncomment this line.
anon_upload_enable=YES
#To activate loging of uploading and downloading.
xferlog_enbable = YES
#The log file of FTP are default store location is; you may change this location
xferlog_file=/var/log/vsftpd.log
#You may change the default value for timing out an idle session.
idle_session_timeout=1200
# You may for some reason decide to limit that amount of users that connect to your

servers at any time, and how many simultaneous connections can be maintained from

each ip address then add following line to the end of file: 
max_clients=20
max_per_ip=4
:wq

4] Create the resources that are downloaded by anonymous user, and create upload 

directory to store uploaded files of public user.

[root@server ~]# cd /var/ftp/pub

[root@server pub]# touch anup1 anup2 anup3 anup4 anup5

[root@server pub]# ls

[root@server pub]# cd ..

[root@server ftp]# mkdir upload

[root@server ftp]# cd

5] Create one local user to get login to FTP service from client side.

[root@server ~]# useradd anup

[root@server ~]# passwd anup  

6] Set Selinux security related options.

[root@server ~]# getsebool -a | grep ftp

[root@server ~]# setsebool allow_ftpd_full_access on

[root@server ~]# setsebool ftp_home_dir on

[root@server ~]# getsebool -a | grep ftp  

7] Finally start vsftpd service and make it permanent at next reboot

[root@server ~]# service vsftpd start

[root@server ~]# chkconfig vsftpd on    

FTP Client Side Configuration

1] Check communication wih FTP Server

[root@client ~}# ping 192.168.1.1

2] Create some files to upload.

[root@client ~}# mkdir data

[root@client ~}# cd data

[root@client data]# touch file1 file2 file3 file4

[root@client data]# cd  

3] Now try to connect with anonymous user and password is blan (just press enter).

[root@client data]# ftp 192.168.1.1

Username : anonymous

password : <┘(press enter)

Log in successful.

ftp> ls

ftp> cd pub

ftp> get anup1 # To download single file.

ftp> get anup* # To download multiple file.

ftp> cd ..

ftp> cd upload

ftp> put file1 # To upload single file.

ftp> put file* # To upload multiple file.

ftp> bye

[root@client data]# ls

[ Note = Go to FTP server machine and verify the file which are uploaded under /var/ftp/upload ]  

4] You can also connect to FTP with local user which we have created initally. ( i.e. Anup )

[ Note = Local user must connect to it's home directory on server ]

[anup@client ~]$ ftp 192.168.1.1

Username : anup

password : anup

Login Successful.

ftp> bye

[anup@client ~]$

Install DenyHosts

Install Denyhosts to prevent SSH dictionary attacks

Introduction:-

Brute force attacks or dictionary based attacks are common these days for servers. DenyHosts is an excellent python tool to prevent such attacks. It will detects failed attempts and prevent offending Host/IP for further connection by adding it to /etc/hosts.deny file.

DenyHosts is a tool that observes login attempts to SSH, and if it finds failed login attempts again and again from the same IP address, DenyHosts blocks further login attempts from that IP address by putting it into /etc/hosts.deny. DenyHosts can be run by cron or as a daemon.

1] DenyHosts is written in Python, therefore we must install Python and also the Python development files first

[root@server ~]# yum install python* -y

2] Download denyhosts from following link and paste it on your desktop

Denyhosts Download Link =

http://kaz.dl.sourceforge.net/project/denyhosts/denyhosts/2.6/DenyHosts-2.6.tar.gz

3] Run the python script and install denyhosts

[root@server ~]# cd /root/Desktop

[root@server Desktop]# tar -xvzf DenyHosts-2.6.tar.gz

[root@server Desktop]# ls

[root@server Desktop]# cd DenyHosts-2.6

[root@server DenyHosts-2.6]# python setup.py install

[root@server DenyHosts-2.6]# cd

[ Note = This installs denyhots to /usr/share/denyhosts ]

4] Create the denyhosts configuration file using sample configuration file

[root@server ~]# cp /usr/share/denyhosts/denyhosts.cfg-dist /usr/share/denyhosts/denyhosts.cfg

5] Edit file denyhosts.cfg as shown below

[root@server ~]# vim /usr/share/denyhosts/denyhosts.cfg

DENY_THRESHOLD_INVALID = 5   -->  DENY_THRESHOLD_INVALID = 3
DENY_THRESHOLD_VALID = 10     -->  DENY_THRESHOLD_VALID = 4
:wq

6]Create denyhosts daemon file using sample script

[root@server ~]# cp /usr/share/denyhosts/daemon-control-dist /usr/share/denyhosts/daemon-control

7] Edit daemon-control file and make sure you set the correct values for following options

[root@server ~]# vim /usr/share/denyhosts/daemon-control

DENYHOSTS_BIN = "/usr/bin/denyhosts.py"

DENYHOSTS_LOCK = "/var/run/denyhosts.pid"

DENYHOSTS_CFG = "/usr/share/denyhosts/denyhosts.cfg"

:wq

8] Now make that file executable

[root@server ~]# chown root /usr/share/denyhosts/daemon-control

[root@rootuser ~]# chmod 700 /usr/share/denyhosts/daemon-control

9] Now create the system bootup links for denyhosts

[root@server ~]# cd /etc/init.d

[root@server init.d]# ln -s /usr/share/denyhosts/daemon-control denyhosts

10] Start denyhosts service

[root@server ~]# /etc/init.d/denyhosts start

[ Note = After you have crossed the threshold of incorrect login attempts, the IP address from which you tried to connect should get listed in /etc/hosts.deny. ]

PXE Boot Server on Linux

-->

How to configure PXE Boot Server on Linux

This notes will be helpful for linux admins who frequently installs different linux os. PXE boot is one of the best option to start linux installation and for rescue of the other failed systems. We are using RHEL5 as PXE boot server.

Use IP = 192.168.1.1

Hostname = server.anup.co.in

NOTE : Here I am using the IP address 192.168.1.1 you can edit it as per your network.

1] Install syslinux & tftp-server

[root@server ~]# yum install tftp-server -y

2] Enable syslinux at boot time

[root@server ~]# vim /etc/xinetd.d/tftp

edit the line no. 14

disable = no

:wq

3] Restart service

[root@server ~]# service xinetd restart

[root@server ~]# chkconfig xientd on

4] Mount CD/DVD and copy it to rhel folder

[root@server ~]# mount /dev/cdrom /mnt

[root@server ~]# mkdir -p /var/ftp/pub/rhel

[root@server ~]# cp -rvp /mnt/* /var/ftp/pub/rhel

5] Copy the needed files from syslinux to the tftpboot directory

[root@server ~]# cp /usr/lib/syslinux/pxelinux.0 /tftpboot

[root@server ~]# cp /usr/lib/syslinux/menu.c32 /tftpboot

[root@server ~]# cp /usr/lib/syslinux/mboot.c32 /tftpboot

[root@server ~]# cp /usr/lib/syslinux/chain.c32 /tftpboot

6] Create the base directory for image. Create directories for each RHEL release you supporting.

[root@server ~]# mkdir -p /tftpboot/images/rhel

[root@server ~]# cp /var/ftp/pub/rhel/images/pxeboot/vmlinuz /tftpboot/images/rhel/

[root@server ~]# cp /var/ftp/pub/rhel/images/pxeboot/initrd.img /tftpboot/images/rhel/

7] Install DHCP server.

[root@server ~]# yum install dhcp -y

8] Configure DHCP server. Add following lines to your /etc/dhcp/dhcpd.conf make suitable changes for your network.

[root@server ~]# vi /etc/dhcpd.conf

option domain-name "anup.co.in";
option domain-name-servers 192.168.1.1;
default-lease-time 600;
max-lease-time 7200;

allow booting;
allow bootp;
next-server 192.168.1.1;
filename “/pxelinux.0”;

subnet 192.168.1.0 netmask 255.255.255.0 {
        range dynamic-bootp 192.168.1.100 192.168.1.200;
    option routers 192.168.1.1;
}

:wq

10] Start dhcp service

[root@server ~]# service dhcpd start

11] Create the directory for your PXE menus

[root@server ~]# mkdir -p /tftpboot/pxelinux.cfg

12] Sample config file

[root@server ~]# vi /tftpboot/pxelinux.cfg/default

default menu.c32

prompt 0

timeout 50

MENU TITLE ANUP PXE Menu

LABEL Red Hat Enterprise Linux 5.4

MENU LABEL RHEL 5.4

KERNEL images/rhel/vmlinuz

append vga=normal initrd=images/rhel/initrd.img ramdisk_size=32768

method=ftp://192.168.1.1/pub/rhel

:wq

Test the PXE server:

* Make changes in the BIOS settings and boot client machine from network. OR just press F12 to boot from network.