Pure-FTPd

Related articles
SFTP chroot
SCP and SFTP
Pure-FTPd
is an FTP server designed with security in mind.
Installation
pure-ftpd
AUR
can be installed from the
Arch User Repository
.
Start
and
enable
pure-ftpd.service
.
Configuration
Pure-FTPd configuration is completely done with its startup arguments.
There is a wrapper script, which reads
/etc/pure-ftpd/pure-ftpd.conf
. It then starts Pure-FTPd with the corresponding arguments.
Set up virtual users
With Pure-FTPd, it is possible to use virtual users instead of real system users.
The available users need to be provided by one or more backends. See
backends
.
For simplicity and demonstration purposes, the PureDB backend will be used. Uncomment the following two lines:
/etc/pure-ftpd/pure-ftpd.conf
# We disable the anonymous account.
NoAnonymous yes
# We use PureDB as backend and specify its path.
PureDB /etc/pureftpd.pdb
Now only authenticated users can connect. To add users to the PureDB we need to create a
/etc/passwd
-like file which is then used to create the PureDB.
To create, view, or modify the
/etc/pureftpd.passwd
file, we use the
pure-pw
command.
# pure-pw useradd someuser -u ftp -d /srv/ftp
This creates the user
someuser
which runs as the FTP system user. By default, the user is chrooted to
/srv/ftp
. In the event that that's undesirable, replace
-d
with
-D
.
Note
The virtual users running as the FTP system users can not log in by default. To change that behavior, set the option MinUID in
/etc/pure-ftpd.conf
to 14 (UID of the ftp user).
We also need to list the shell of the FTP system user in
/etc/shells
.
# echo "/bin/false" >> /etc/shells
Note
Symlinks outside of the chrooted directory do not work since the package is not compiled with
--with-virtualchroot
. You can use
mount --bind source target
as a workaround.
Before this account is usable, we need to commit our changes:
# pure-pw mkdb
The virtual user can now access everything in
/srv/ftp
.
The command
pure-pw mkdb
creates the file mentioned earlier called
/etc/pureftpd.pdb
, which houses all information related to your virtual users. There is no need to restart your service when issuing this command as it is updated on the fly and changes take effect immediately.
Changing user password
For example, to change a user's password, type the command:
# pure-pw passwd someuser
Afterwards, commit your changes by updating
/etc/pureftpd.pdb
:
# pure-pw mkdb
Removing user
To remove a user, type the command:
# pure-pw userdel someuser
The user's home directory is not removed via this command; therefore, it must be removed manually.
Checking user settings
To check a user's current account settings, type the command:
# pure-pw show someuser
Backends
You need to specify one or more backends. If you specify more than one, Pure-FTPd will respect the order in which they are specified. It will use the first backend which contains the requested user.
Available backends are:
/etc/passwd
MySQL
LDAP
PostgreSQL
PAM
PureDB
Or you can write
your own
PAM
To enable PAM backend, create the following file:
/etc/pam.d/pure-ftpd
auth       required     pam_unix.so
auth       required     pam_env.so
account    required     pam_unix.so
session    required     pam_unix.so
and uncomment the PAMAuthentication line in the config file like so:
/etc/pure-ftpd/pure-ftpd.conf
# If you want to enable PAM authentication, uncomment the following line

PAMAuthentication            yes
Set up TLS
Create a certificate
Refer to
the documentation
for more information. The short version is this:
Create a Self-Signed Certificate:
# mkdir -p /etc/ssl/private
# openssl req -x509 -nodes -days 7300 -newkey rsa:2048 -sha256 -keyout /etc/ssl/private/pure-ftpd.pem -out /etc/ssl/private/pure-ftpd.pem
Make it private:
# chmod 600 /etc/ssl/private/*.pem
Enable TLS
Towards the bottom of
/etc/pure-ftpd/pure-ftpd.conf
you should find a section for TLS. Uncomment and change the
TLS
setting to
1
to enable both FTP and FTPS:
/etc/pure-ftpd/pure-ftpd.conf
TLS             1
Now
restart
the
pure-ftpd.service
unit and you should be able to log in with FTPS-capable clients, e.g.
filezilla
or
SmartFTP
.
See also
Official homepage
Virtual users