Installing FTP server on SELinux properly

Hey guys,

So part of my job these days was to setup a web server from scratch. Not coming straight from the IT sector myself, I had quite a bit of  trouble installing vsfptd on the machine, so I think I might just help other lost souls out there like me by recounting my experience:

First of, installing vsftpd should be simple enough by itself. You could just

yum install vsftpd

or any similar approach to get it installed on your machine. You could then alter /etc/vsftpd/vsftpd.conf file to tweak it the way you want.

But if your machine uses SELinux, chances are that you’re still not yet able to log in to your home directory and upload from FTP clients at all. To be precise, there are 3 additional things you should do:

setsebool -P ftp_home_dir on
setsebool -P allow_ftpd_full_access on
chcon -R -t httpd_sys_content_t /path/to/your/home/dir

The first allows FTP clients to log in and cd into the home directory of the users without errors.
The second allows FTP clients to fully read and write. Without this, you could only list directory contents but should always fail to create folders or files.
The third allows both Apache (httpd) and FTP (vsftpd) to read and write contents on your home directory properly. Please note that you could also use “public_content_rw_t” instead of “httpd_sys_content_t“, but I’m not really deep into SELinux to tell which is of better practice.

Please do let me know if this works for you or not, for I don’t want to spread false information on the internet 🙂

Hope that helps,

Some references:
Setup FTP server
Apache and selinux
Practical selinux for the beginners
– fptd & selinux

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s