04 – Server Plan FTP

Designing your webserver and access

The file you need to alter here is /etc/group

make sure theres a www-data group in the list. A record like “www-data:x:33:mywebsite.com,mysite2.com” means that mywebsite.com is a user of www-data

www-data is the group that controls your web sites. The idea is to add your first user account which is the administrator. “madmin” is my first user. I added this user to www-data to help ease traversing and controlling the websites by command line.

I have then made individual users by their website name to help ftping.

1) Have 1 admin user who is not the root

2) Have users for each domain to access FTP when needed.

Adding a new domain website

> useradd -d /home/mydomain.com -m mydomain.com
[note that adduser is different. it requires more details]
[rm -r to remove the directory from /home/mydomain]
[userdel to delete the user if wrongly created]
> passwd mydomain.com
> usermod -a -G www-data mydomain.com
[this adds your user to the www-data group]
> chgrp -R www-data /home/mydomain.com/public
> chmod -R 2750 /home/mydomain.com/public
> chmod -R 2770 /home/mydomain.com/public/uploads
[if you copy stuff from another directory using root remember to use following]
> chown -R mydomain:www-data /home/mydomain.com/public
> chgrp -R www-data /home/mydomain.com/public
> chmod -R 2750 /home/mydomain.com/public
[otherwise you may get ftp errors]
[lightly configuation and logs]
> nano /etc/lighttpd/lighttpd.conf
[find a nice place: scroll all the way down till: #### handle Debian Policy Manual, Section 11.5. urls]
[add in the following]
$HTTP["host"] =~ “(^|.)mydomain.com$” {
server.document-root = “/home/mydomain.com/public”
server.errorlog = “/var/log/lighttpd/mydomain.com/error.log”
accesslog.filename = “/var/log/lighttpd/mydomain.com/access.log”
server.error-handler-404 = “/e404.php”
}
> mkdir /var/log/lighttpd/mydomain.com
> chown -R www-data:www-data /var/log/lighttpd
[now lighttpd own this logs directory]
[you have to run this everytime you add a new domain]
> /etc/init.d/lighttpd restart
[this should restart the server nicely. if you have installed vsftp you should be able to put in a test.html file in the public folder and test it.]
[at this time you can configure your dns for mydomain.com to point to this ip address. This would be the A record]
FAQ:
Q: Why asd.html file is not found but sdf.html file is found when i type in 123.45.67.89 when both files are in the directory?
A: File permission settings might be wrong. check that www-data is the group and its chmod -R 2750 to the public folder

Install ftp server

> apt-get install vsftpd
> nano /etc/vsftpd.conf

[change the following: you have to remove # from the front of the line]

* anonymous_enable=NO
* local_enable=YES
* chroot_local_user=YES

[press crtl-x to exit and save]

> /etc/init.d/vsftpd restart [1][2]

NOTES:

  1. [1] just by running vsftpd restart will give you a OOPs 500 error. You need to put “service” before vsftpd
  2. [2] or you can run > service vsftpd restart
  3. seems like vsftpd or other ftp software hooks onto user accounts. so for web servers, each domain should have a ftp account
  4. remember to set chroot
  5. by default openssh should be installed on ubuntu

FTPS for VSFTPD (Very secure ftp daemon)

Note that ftps is different from sftp.

> mkdir /etc/vsftpd
> openssl req -x509 -nodes -days 365 -newkey rsa:1024 -keyout /etc/vsftpd/vsftpd.pem -out /etc/vsftpd/vsftpd.pem
> chmod 600 /etc/vsftpd/vsftpd.pem
> nano /etc/vsftpd.conf

[Add in or make sure the following is uncommented.]

ssl_enable=YES
allow_anon_ssl=NO
force_local_data_ssl=YES
force_local_logins_ssl=YES
require_ssl_reuse=NO
# need require ssl reuse otherwise you get errors when you are editing files using ftps
# error “vsftpd: SSL connection failed session reuse required”
ssl_tlsv1=YES
ssl_sslv2=YES
ssl_sslv3=YES
rsa_cert_file=/etc/vsftpd/vsftpd.pem
listen_port=21
#you can use any port, filezilla defaults to port 21. So does wordpress
pasv_min_port=20000
pasv_max_port=20999
# you will need this pasv, otherwise when you set up firewall, you get ftp connection problems. as a sample use 20000 – 20999

> /etc/init.d/vsftpd restart

now you can ftp into your system using port 990 with ftps

NOTES:

  1. Ref: http://ubuntuforums.org/showthread.php?t=518293