Customizing the FTP service on CentOS

In this process, you will learn how to customize your vsftpd installation. vsftpd has a lot of configuration parameters, and here we will show how to create a custom welcome banner, change the server’s default-time out, limit user connections, and ban users from the service.

To Start With: What Do You Need?

To complete this process, you will require a working installation of the CentOS 7 operating system with root privileges and a console-based text editor of your choice. It is expected that your server will be using a static IP address and that vsftpd is already installed with a chroot jail and is currently running.

The Process

1. To begin with, log in as root and open the main vsftpd configuration file:
   vi /etc/vsftpd/vsftpd.conf
2. First, provide an alternative welcome message, uncomment the following line, and alter the message as required. For example, you could use this:
   ftpd_banner=Welcome to my new FTP server
3. To change the default FTP time-outs, uncomment these lines and substitute the numeric values as required:
   idle_session_timeout=600
data_connection_timeout=120
4. Now, we will limit the connections: the data transfer rate in bytes per second, the number of clients, and the maximum parallel connections per IP address. Add the following lines to the end of the file:
   local_max_rate=1000000
max_clients=50
max_per_ip=2
5. Next, save and close the file. To ban a specific user, you can use the following commands while replacing the username with an appropriate system user value that fits your needs:
   echo "username" >> /etc/vsftpd/user_list
6. Now to apply the changes, restart the FTP service:
   systemctl restart vsftpd

How Does It Work?

In this process, we have shown some of the most important vsftpd settings. Covering all the configuration parameters here is outside the scope of this process. To learn more about it, read through the entire main vsftpd configuration file at /etc/vsftpd/vsftpd.conf, as it contains a lot of useful comments; alternatively, you can read the man vsftpd.conf manual.

So what did we learn from this experience?

We began by opening the main vsftpd configuration file and then activated and customized the welcome banner using the ftpd_banner directive. On the next successful login, your users should see your new message. Next, when dealing with a large number of users, you may want to consider changing the values for a default timeout and limit the connections in order to improve the efficiency of your FTP service.

First, we changed our server’s timeout numbers. An idle_session_timeout of 600 seconds will logout the user if he is inactive (not executing FTP commands) for 10 minutes, while a data_connection_timeout of 120 seconds will kill the connections when a client data transfer is stalled (not progressing) for 20 minutes. Then we changed the connection limits. A local_max_rate of 1000000 bytes per second will limit the data transfer rate of a single user to roughly one megabyte per second. A max_clients value of 50 will tell the FTP server to only allow 50 parallel users to the system, while a max_per_ip of 2 allows only two connections per IP address.

Then we saved and closed the file. Finally, we showed how to ban users from using our FTP service. If you wanted to ban a specific user from using the FTP service as a whole, the user’s name should be added to the /etc/vsftpd/user_list file. If you ever need to re-enable the user at any time, simply reverse the previous process by removing the user concerned from /etc/vsftpd/user_list.