Pure-FTPd

Pure-FTPd is an FTP server designed with security in mind.

Installation

pure-ftpd^AUR can be installed from the Arch User Repository.

Start and enable pure-ftpd.service.

Configuration

Pure-FTPd configuration is completely done with its startup arguments.

There is a wrapper script, which reads /etc/pure-ftpd/pure-ftpd.conf. It then starts Pure-FTPd with the corresponding arguments.

Set up virtual users

With Pure-FTPd, it is possible to use virtual users instead of real system users.

The available users need to be provided by one or more backends. See backends.

For simplicity and demonstration purposes, the PureDB backend will be used. Uncomment the following two lines:

/etc/pure-ftpd/pure-ftpd.conf

# We disable the anonymous account.
NoAnonymous yes
# We use PureDB as backend and specify its path.
PureDB /etc/pureftpd.pdb

Now only authenticated users can connect. To add users to the PureDB we need to create a /etc/passwd-like file which is then used to create the PureDB.

To create, view, or modify the /etc/pureftpd.passwd file, we use the pure-pw command.

# pure-pw useradd someuser -u ftp -d /srv/ftp

This creates the user someuser which runs as the FTP system user. By default, the user is chrooted to /srv/ftp. In the event that that's undesirable, replace -d with -D.

Note:

The virtual users running as the FTP system users can not log in by default. To change that behavior, set the option MinUID in /etc/pure-ftpd.conf to 14 (UID of the ftp user).

We also need to list the shell of the FTP system user in /etc/shells.

# echo "/bin/false" >> /etc/shells

Note: Symlinks outside of the chrooted directory do not work since the package is not compiled with --with-virtualchroot. You can use mount --bind source target as a workaround.

Before this account is usable, we need to commit our changes:

# pure-pw mkdb

The virtual user can now access everything in /srv/ftp.

The command pure-pw mkdb creates the file mentioned earlier called /etc/pureftpd.pdb, which houses all information related to your virtual users. There is no need to restart your service when issuing this command as it is updated on the fly and changes take effect immediately.

Changing user password

For example, to change a user's password, type the command:

# pure-pw passwd someuser

Afterwards, commit your changes by updating /etc/pureftpd.pdb:

# pure-pw mkdb

Removing user

To remove a user, type the command:

# pure-pw userdel someuser

The user's home directory is not removed via this command; therefore, it must be removed manually.

Checking user settings

To check a user's current account settings, type the command:

# pure-pw show someuser

Backends

You need to specify one or more backends. If you specify more than one, Pure-FTPd will respect the order in which they are specified. It will use the first backend which contains the requested user.

Available backends are:

/etc/passwd
MySQL
LDAP
PostgreSQL
PAM
PureDB
Or you can write your own

PAM

To enable PAM backend, create the following file:

/etc/pam.d/pure-ftpd

auth       required     pam_unix.so
auth       required     pam_env.so
account    required     pam_unix.so
session    required     pam_unix.so

and uncomment the PAMAuthentication line in the config file like so:

/etc/pure-ftpd/pure-ftpd.conf

# If you want to enable PAM authentication, uncomment the following line

PAMAuthentication            yes

Set up TLS

Create a certificate

Refer to the documentation for more information. The short version is this:

Create a Self-Signed Certificate:

# mkdir -p /etc/ssl/private
# openssl req -x509 -nodes -days 7300 -newkey rsa:2048 -sha256 -keyout /etc/ssl/private/pure-ftpd.pem -out /etc/ssl/private/pure-ftpd.pem

Make it private:

# chmod 600 /etc/ssl/private/*.pem

Enable TLS

Towards the bottom of /etc/pure-ftpd/pure-ftpd.conf you should find a section for TLS. Uncomment and change the TLS setting to 1 to enable both FTP and FTPS:

/etc/pure-ftpd/pure-ftpd.conf

TLS             1

Now restart the pure-ftpd.service unit and you should be able to log in with FTPS-capable clients, e.g. filezilla or SmartFTP.