How to Install and Configure (SFTP) vsftpd to Use SSL/TLS on an Ubuntu 14.04 VPS

FTP or file transfer protocol, was a popular way to transfer files between local and remote computers in the past. SFTP is called as “Secure FTP”, which generally use SSH File Transfer Protocol. FTP instead of a more secure alternative like SFTP, which uses the SSH protocol to implement file transfers, you can secure it somewhat by configuring FTP to use SSL.

You must login "Root" privilege or use "Sudo" before typing the command.

Setup VsFTP Server 

Step 1 » Update ubuntu repositories.

     root@digidom:~# apt-get update

Step 2 » Install VsFTPD package. The vsftpd server is available in Ubuntu's default repositories.

     root@digidom:~# apt-get install vsftpd

Step 3 » After installation, check the location where vsftpd files are listed.

     root@digidom:~# whereis vsftpd

Step 4 » Backup the Original vsftpd.conf to vsftpd.con.back

     root@digidom:~# cp /etc/vsftpd.conf /etc/vsftpd.conf.back

Step 5 » Configure Basic vsftpd Functionality. The default configuration file is at etc/vsftpd.conf.

     root@digidom:~# vi /etc/vsftpd.conf

Disable the users to log in anonymously by finding the anonymous_enable parameter and changing it to read "NO":

     anonymous_enable=NO

Next, we need to enable user logins that use the local authentication files, since we disabled anonymous access.

     local_enable=YES

To enable users to make modifications to the filesystem, we will uncomment the write_enable parameter as well:

     write_enable=YES

Additionally, uncomment the chroot_local_user option to restrict users to their own home directories:

     chroot_local_user=YES

Save and close the file.

Step 6 » To see the enabled options in vsftpd.conf file, use this command

     root@digidom:~# egrep -v '^#|^$' /etc/vsftpd.conf

          listen=YES

          anonymous_enable=NO

          local_enable=YES

          write_enable=YES

          local_umask=022

          dirmessage_enable=YES

          use_localtime=YES

          xferlog_enable=YES

          connect_from_port_20=YES

          chroot_local_user=YES

          secure_chroot_dir=/var/run/vsftpd/empty

          pam_service_name=vsftpd

          rsa_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem

          rsa_private_key_file=/etc/ssl/private/ssl-cert-snakeoil.key

Step 7 » Restart vsftpd service using the below command.

     root@digidom:~# service vsftpd restart

Create an FTP User

Because of the way vsftpd secures its chroot jails, the chroot must not be owned by the user and must not be writeable. Because of this, it is best to implement a user specifically for use with FTP. 

Note : SFTP doesn't support /usr/sbin/nologin shells.

Step 8 » Create a User account and specify Home Directory location, I point to "/var/www/html/" and set the password.

     root@digidom:~# useradd -m -d /var/www/html/ -s /bin/bash mailftp

     root@digidom:~# passwd mailftp

Note : Do not delete this account using "userdel -rf mailftp". It will remove html directory, because this user (mailftp) home directory is /var/www/html/.

Step 9 » Now give root ownership of the "mailftp" home directory (/var/www/html/):

     root@digidom:~# chown root:root /var/www/html/

     root@digidom:~# ll -d /var/www/html/

          drwxr-xr-x  5 root root 4096 Dec 16 22:55 html/

Step 10 » We need to create a separate directory within this home directory, where files can be uploaded. Then, we need to give this directory over to our FTP user:

     root@digidom:~# mkdir /var/www/html/mailbox

     root@digidom:~# chown mailftp:mailftp /var/www/html/mailbox

     root@digidom:~# ll -d /var/www/html/mailbox

          drwxr-xr-x 2 mailftp mailftp 4096 Dec 17 00:46 /var/www/html/mailbox/

Step 11 » Now, we should be able to log in (insecurely) as the "mailftp" and upload files to the file directory using Terminal or FTP Client (Filezilla). Here I Used Terminal.

     root@digidom:~# ftp localhost

          Connected to localhost.

          220 (vsFTPd 3.0.2)

          Name (localhost:root): mailftp

          331 Please specify the password.

          Password: "Enter The Password Here"

          230 Login successful.

          Remote system type is UNIX.

          Using binary mode to transfer files.

          ftp> ls

          200 PORT command successful. Consider using PASV.

          150 Here comes the directory listing.

          drwxr-xr-x    2 1001     1001         4096 Dec 17 00:46 mailbox

          226 Directory send OK.

          ftp> mkdir test  => Here You have No Permission. Bcoz /html/ is Root owner.

          550 Create directory operation failed.

          ftp> cd mailbox

          250 Directory successfully changed.

          ftp> mkdir test  

          257 "/mailbox/test" created

          ftp>

          ftp> bye

          221 Goodbye.

Configure SSL with vsftpd (SFTP).

Step 12 » We need to create some SSL certificates to use with vsftpd. Check whether openssl is installed or not.

     root@digidom:~# openssl version

          OpenSSL 1.0.1f 6 Jan 2014

     root@digidom:~# openssl req -x509 -nodes -days 365 -newkey rsa:1024 -keyout     /etc/ssl/private/vsftpd.pem -out /etc/ssl/private/vsftpd.pem

Step 13 » See the vsftpd.pem certificate in the openssl directory.

     root@digidom:~# cd /etc/ssl/

     root@digidom:/etc/ssl# ll

          drwxr-xr-x  2 root root       20480 Dec 12 10:28 certs/

          -rw-r--r--  1 root root        10835 Apr  7  2014   openssl.cnf

          drwx--x--- 2 root ssl-cert   4096   Dec 17 01:12 private/

     root@digidom:/etc/ssl# ll private/

          -rw-r----- 1 root ssl-cert 1704 Dec 12 10:28 ssl-cert-snakeoil.key

          -rw-r--r-- 1 root root      2019 Dec 17 02:21 vsftpd.pem

Step 14 » Add the SSL Details to the vsftpd Configuration with root privilege.

     root@digidom:~# vi /etc/vsftpd.conf

Note : When we created the certificate, we included both the key file and the certificate in one file, so we can also point our private key line to that.

    rsa_cert_file=/etc/ssl/private/vsftpd.pem

    rsa_private_key_file=/etc/ssl/private/vsftpd.pem

We need to add the following lines to force SSL. This will restrict clients that can't deal with TLS, but that is what we want.

     ssl_enable=YES

     allow_anon_ssl=NO

     force_local_data_ssl=YES

     force_local_logins_ssl=YES

After this we configure the server to use TLS, which is actually a successor to SSL, and preferred:

     ssl_tlsv1=YES

     ssl_sslv2=NO

     ssl_sslv3=NO

Finally, we will require add some additional options to flesh out our configuration file:

     require_ssl_reuse=NO

     ssl_ciphers=HIGH

Save and close the file.

Step 14 » Now, we need to restart our server for our changes to take effect:

     root@digidom:/var/www/html# service vsftpd restart

How To Connect to the Server with FileZilla

Most modern FTP clients can be configured to use SSL and TLS encryption. Here I  used Filezilla.

Step 15 » Open the Filezilla ftp client and Go to File => Site Manager.

Step 16 » After that New window will be open Go to 

(1) NewSite => (2) Specify the Name => (3) Go to General Tab => (4,5,6,7,8) Add the following FTP details  => (9) OK => It will created in left panel.

Step 17 » After that you can open File => Site Manager => Select the New My Sites => Connect

Step 18 » When you connect first time, you will be asked to accept the TLS certificate: 

Just select "Always trust this host..."  =>  OK

Step 19 » By accepting the certificate, it will get connected and we can see the Document Root in the Right side panel. We can Upload and Download the Files.

I have uploaded index.php file for testing purpose.

Step 21 » Now check the uploaded file using web browser, to find out whether there is any permission issue.

Step 21 » You can also access through Terminal using SFTP command.

1st => Check the SSH connection is working fine, then you can access SFTP Using "ssh root@Server-IP-Address"

2nd => After successful ssh connection, you can use SFTP using this command 

 "SFTP mailftp@Server-IP-Address". After that it will ask for mailftp password.

You should now be connected with your server with TLS/SSL encryption.

Step to create ClearOS bootable USB in windows 7

URL ClearOS: http://www.clearfoundation.com/Software/downloads.html

URL Syslinux: https://www.kernel.org/pub/linux/utils/boot/syslinux/

Make sure you pick the highest version you can find and download the zip version of it.

Linux, like PC’s uses Master Boot Records and therefore cannot just boot any disk. You need to make that disk bootable. This is why we need Syslinux.

1. Connect the USB disk to a Windows Vista or 7 PC.

2. Create a FAT32 partition on it of at least 5GB using Disk Management.

3. Open the ClearOS iso file with WinRAR (open, not extract).

4. Copy the “images” and “isolinux” folders to the USB drive.

5. Rename the “isolinux” folder to “syslinux“. AND Open the “syslinux” folder, find and rename “isolinux.cfg” to “syslinux.cfg“.

6. Copy the ClearOS iso file to the root of the USB partition.

7. Find your Syslinux zipfile and extract it to a subfolder on your desktop.

8. Open a command prompt with Administrative privilege and navigate to the “win32” folder inside the Syslinux folder.
 Note:  Take note of the USB drive letter and run. My side USB drive is "L:"
 Run this command: syslinux.exe -m -f -a -d /boot/syslinux l:

This will make the drive bootable for Linux. Obviously replace l: with your drive letter.
And that’s it. You now have a bootable USB drive for ClearOS.

9. After creating Bootable USB, Go to BIOS and change the boot priority to USB.

10. After booting ClearOS select the "HardDisk" option selecte the partition.

That's it......... 

CentOS 6 CD/DVD/ISO to USB Installation in Windows 7

I tried various Linux ISO to USB software like UNetbootin, Universal-USB-Installer etc... to create CentOS 6 bootable Pendrive. But all have some problems or limitations which force me to use ISO2USB software, which help me to meet my need.

Create a CentOS 6 bootable USB which will support customized installation (by using kickstart configuration file).

UNetbootin: Bootable USB of CentOS 6 created by UNetbootin is not even booting the system using USB and not support kickstart configuration file.

Universal-USB-Installer: It successfully boot the CentOS 6 from USB but failed to install by kickstart configuration file and Copying section.

Prepare CentOS 6 bootable from ISO file or CD/DVD :

URL for Windows : https://sourceforge.net/projects/iso2usb/files/latest/download

1. Plug the USB drive to Windows XP/Vista/7 machine.

2.  After downloading, Execute the ISO2USB software.

3. Browse CentOS 6 ISO (with custom installation) file by using the highlighted browse button.

4. Click on OK button but before clicking on OK button; just make sure that correct USB drive should be selected.

5. Click Exit button, when finished.

6. Safely remove USB drive from Windows XP/Vista/7 system.

  USB drive is now ready to install CentOS 6 (with custom configuration file) on your system.

PHP mail function not working on CentOS server with WHM, testing in browser.

I configured LAMP server in VPS server, I tried to run PHP mail function in web browser, but it was not working in the 1st attempt. Later, I solved the issue.

1. Login to WHM with username and password.

2. Go to Server Configuration => Tweake Setting.

3.  In side the Tweake Settings go to Mail option,  change the 'Prevent “nobody” from sending mail' to Off Default Mode.

4. Create the PHP mail function script in the Document root "test.php".

<?php

  $to = "Destination mail ID";

  $message = "Hello World";

  $subject = "User Activated";

  $headers = 'MIME-Version: 1.0' . "\r\n";

  $headers = 'Content-type: test/html; charset=iso-8859-1' . "\r\n";

  //Additional Header

  $headers = 'From: Easyship <info@easyshipping.com>' . "\r\n";

  

  //send email

  mail($to, $subject, $message, $header);

  

  //Email response

  dir ("Reach Here"); 

?>

5. Go to web browser and test the PHP mail function script in browser.

    URL:-    http://IP Address/~easy/easyshipping/test.php    or   DomainName/test.php

     

6. If there is no error, go to the mail box and check for php test mail.

That's it...

Installing Composer Globally on CentOS 6.4

Installing Composer Globally on CentOS 6.4

Composer is a tool for dependency management in PHP. It allows you to declare the dependent libraries your project needs and it will install them in your project for you.

Composer requires PHP 5.3.2+ to run. A few sensitive php settings and compile flags are also required, but the installer will warn you about any incompatibilities.

To install it globally on CentOS follow the steps below.
1. First, go to the /tmp directory. 

      [root@centos ~]# cd /tmp

2. Download the composer.phar file.

       [root@centos tmp]# curl -sS https://getcomposer.org/installer | php

3. You can run these commands to easily access composer from anywhere on your   system: Move it to /usr/local/bin/

       [root@centos tmp]#  mv composer.phar /usr/local/bin/composer

4. Then, just run composer in order to run Composer instead of
        [root@centos ~]#  php composer.phar

Reference URL :   https://getcomposer.org/doc/00-intro.md