Load Times Under 2s: FTP & DNS

Installing an FTP server

Next we’re going to want to install an FTP server so you can upload files. To do this will be using vsftpd. This is an FTP server that allows you to upload files just like any other FTP system. It’s pretty easy to install but we’re going to add some specializations to it. Our system will allow you to add and edit users using a my sequel database table, and will upload files into their specific folder. In order for the web server to access these files will simply create a soft link from the web server location to the FTP server location. The trick will be to get the permissions correct.

First you need to install vsftpd.
yum install -y vsftpd;

 

Next we need to install a user specifically for the vsftpd process.
useradd -G users -s /bin/false -d /home/vsftpd vsftpd;

 

We’re going to add the vsftpd user to the Apache group so that files uploaded to the web server folder can be accessed by vsftpd.
usermod -G apache vsftpd;

 

Now we need open the settings configurations.
nano /etc/vsftpd/vsftpd.conf;

 

… and add in the configurations file:
# https://wiki.centos.org/HowTos/VirtualVsFtpd # Example config file /etc/vsftpd/vsftpd.conf # # The default compiled in settings are fairly paranoid. This sample file # loosens things up a bit, to make the ftp daemon more usable. # Please see vsftpd.conf.5 for all compiled in defaults. # # READ THIS: This example file is NOT an exhaustive list of vsftpd options. # Please read the vsftpd.conf.5 manual page to get a full idea of vsftpd's # capabilities. # # Allow anonymous FTP? (Beware - allowed by default if you comment this out). anonymous_enable=NO # # Uncomment this to allow local users to log in. # When SELinux is enforcing check for SE bool ftp_home_dir local_enable=YES # # Uncomment this to enable any form of FTP write command. write_enable=YES # # Default umask for local users is 077. You may wish to change this to 022, # if your users expect that (022 is used by most other ftpd's) local_umask=022 # # Uncomment this to allow the anonymous FTP user to upload files. This only # has an effect if the above global write enable is activated. Also, you will # obviously need to create a directory writable by the FTP user. # When SELinux is enforcing check for SE bool allow_ftpd_anon_write, allow_ftpd_full_access #anon_upload_enable=YES # # Uncomment this if you want the anonymous FTP user to be able to create # new directories. #anon_mkdir_write_enable=YES # # Activate directory messages - messages given to remote users when they # go into a certain directory. dirmessage_enable=YES # # Activate logging of uploads/downloads. xferlog_enable=YES # # Make sure PORT transfer connections originate from port 20 (ftp-data). connect_from_port_20=YES # # If you want, you can arrange for uploaded anonymous files to be owned by # a different user. Note! Using "root" for uploaded files is not # recommended! #chown_uploads=YES #chown_username=whoever # # You may override where the log file goes if you like. The default is shown # below. xferlog_file=/var/log/vsftpd.log # # If you want, you can have your log file in standard ftpd xferlog format. # Note that the default log file location is /var/log/xferlog in this case. xferlog_std_format=YES # # You may change the default value for timing out an idle session. #idle_session_timeout=600 # # You may change the default value for timing out a data connection. #data_connection_timeout=120 # # It is recommended that you define on your system a unique user which the # ftp server can use as a totally isolated and unprivileged user. nopriv_user=vsftpd # # Enable this and the server will recognise asynchronous ABOR requests. Not # recommended for security (the code is non-trivial). Not enabling it, # however, may confuse older FTP clients. #async_abor_enable=YES # # By default the server will pretend to allow ASCII mode but in fact ignore # the request. Turn on the below options to have the server actually do ASCII # mangling on files when in ASCII mode. # Beware that on some FTP servers, ASCII support allows a denial of service # attack (DoS) via the command "SIZE /big/file" in ASCII mode. vsftpd # predicted this attack and has always been safe, reporting the size of the # raw file. # ASCII mangling is a horrible feature of the protocol. #ascii_upload_enable=YES #ascii_download_enable=YES # # You may fully customise the login banner string: #ftpd_banner=Welcome to blah FTP service. # # You may specify a file of disallowed anonymous e-mail addresses. Apparently # useful for combatting certain DoS attacks. #deny_email_enable=YES # (default follows) #banned_email_file=/etc/vsftpd/banned_emails # # You may specify an explicit list of local users to chroot() to their home # directory. If chroot_local_user is YES, then this list becomes a list of # users to NOT chroot(). # (Warning! chroot'ing can be very dangerous. If using chroot, make sure that # the user does not have write access to the top level directory within the # chroot) chroot_local_user=YES #chroot_list_enable=YES # (default follows) #chroot_list_file=/etc/vsftpd/chroot_list # # You may activate the "-R" option to the builtin ls. This is disabled by # default to avoid remote users being able to cause excessive I/O on large # sites. However, some broken FTP clients such as "ncftp" and "mirror" assume # the presence of the "-R" option, so there is a strong case for enabling it. #ls_recurse_enable=YES # # When "listen" directive is enabled, vsftpd runs in standalone mode and # listens on IPv4 sockets. This directive cannot be used in conjunction # with the listen_ipv6 directive. listen=YES # # This directive enables listening on IPv6 sockets. By default, listening # on the IPv6 "any" address (::) will accept connections from both IPv6 # and IPv4 clients. It is not necessary to listen on *both* IPv4 and IPv6 # sockets. If you want that (perhaps because you want to listen on specific # addresses) then you must run two copies of vsftpd with two configuration # files. # Make sure, that one of the listen options is commented !! #listen_ipv6=YES pam_service_name=vsftpd userlist_enable=YES tcp_wrappers=YES # here the vsftpd will allow the 'vsftpd' user to login into the # '/var/www/ftp/$USER' directory guest_enable=YES guest_username=vsftpd local_root=/var/www/ftp/$USER user_sub_token=$USER virtual_use_local_privs=YES user_config_dir=/etc/vsftpd/vsftpd_user_conf #SSL Configurations rsa_cert_file=/etc/ssl/certs/test-selfsigned.crt rsa_private_key_file=/etc/ssl/private/test-selfsigned.key ssl_enable=YES ssl_tlsv1=NO ssl_sslv2=YES ssl_sslv3=YES require_ssl_reuse=NO ssl_ciphers=HIGH allow_anon_ssl=NO #force_local_data_ssl=YES #force_local_logins_ssl=YES #Permssions userlist_deny=YES allow_writeable_chroot=YES

 

Now we’re going to make a directory for our FTP files to be uploaded to. We also need to set the permissions so that the vsftpd user (the program) can control the folder.
mkdir /var/www/ftp/; chown vsftpd:vsftpd /var/www/ftp/;

 

Now we need to copy the PAM MySQL authentication settings. This is what will allow us to add FTP users via to MySQL tables.
cp /etc/pam.d/vsftpd /etc/pam.d/vsftpd-orig; cat /dev/null > /etc/pam.d/vsftpd;

 

Now we need to edit the configuration file
nano /etc/pam.d/vsftpd;

 

…and add in the following lines. You will need to set your own vsftpd user password.
#%PAM-1.0 session optional pam_keyinit.so force revoke auth required pam_mysql.so user=vsftpd passwd=[[vsftpd User Password]] host=localhost db=vsftpd table=accounts usercolumn=username passwdcolumn=pass crypt=3 account required pam_mysql.so user=vsftpd passwd=[[vsftpd User Password]] host=localhost db=vsftpd table=accounts usercolumn=username passwdcolumn=pass crypt=3

 

Now we need to create the vsftpd user in the MySQL database.
mysql -uroot -p"[[Root MySQL Password]]" -e "CREATE DATABASE vsftpd;"; mysql -uroot -p"[[Root MySQL Password]]" -e "GRANT SELECT ON vsftpd.* TO 'vsftpd'@'localhost' IDENTIFIED BY '[[vsftpd User Password]]';"; mysql -uroot -p"[[Root MySQL Password]]" -e "FLUSH PRIVILEGES;"; mysql -uroot -p"[[Root MySQL Password]]" -e "CREATE TABLE vsftpd.accounts (id INT NOT NULL AUTO_INCREMENT PRIMARY KEY ,username VARCHAR( 30 ) NOT NULL ,pass VARCHAR( 50 ) NOT NULL , UNIQUE (username)) ENGINE = MYISAM ; ";

 

At this point we can install the pam_mysql authentication package.
cd /tmp/; wget ftp://ftp.pbone.net/mirror/archive.fedoraproject.org/fedora/linux/releases/20/Everything/x86_64/os/Packages/p/pam_mysql-0.7-0.16.rc1.fc20.x86_64.rpm rpm -Uvh pam_mysql-0.7-0.16.rc1.fc20.x86_64.rpm; ls -al /usr/lib64/security/pam_mysql.so;

 

At this point, the MySQL authentication should be installed and the FTP user system should be installed. We can now create a test user. All user folders will be stored in the /var/www/ftp/ folder. We can link the folders to the web ones, giving our web servers access to the FTP files.
mysql -uroot -p"[[Root MySQL Password]]" -e "INSERT INTO vsftpd.accounts (username, pass) VALUES('[[FTP User]]', md5('[[FTP User Password]]'));"; mkdir /var/www/ftp/[[FTP User]]/; chown vsftpd:vsftpd /var/www/ftp/[[FTP User]]/; ln -sf /var/www/ftp/[[FTP User]] /var/www/html/test_folder;

 

Now we can enable and start our vsftpd process. You should be able to see that the process is running without any errors with the last status line.
systemctl enable vsftpd; systemctl start vsftpd; systemctl status -l vsftpd;

 

If you have SELinux, we will need to set a bool that will allow the vsftpd process to access the required directories:

setsebool -P ftpd_full_access on

 

Now at this point if you connect to your FTP server you should be able to upload files directly to the server and view them at:
https://[[Your IP address]]:8081/test_folder

Installing a DNS server

Now we need to set up a DNS server. This will allow you to point your domain name directly to your server. The DNS server will allow you to direct your visitors to each subdomain that your site has. This is great for mail, for FTP, and for websites.

First we need to install bind.
yum install -y bind bind-utils;

 

Next we need to enable it.
systemctl enable named;

 

And now we need to set up the firewall to allow DNS traffic.
firewall-cmd --permanent --zone=public --add-port=53/tcp firewall-cmd --permanent --zone=public --add-port=53/udp firewall-cmd --reload

 

We need to make some changes to the /etc/named.conf configuration file.
nano /etc/named.conf

 

Set:
listen-on port 53 { any; };
listen-on-v6 port 53 { ::1; };

Next we need to set up our main DNS zones file and the individual configuration files. First we will copy the original main configuration file for posterity.
cp /etc/named.rfc1912.zones /etc/named.rfc19192.zones.old;

 

And we need to add our domain name to the main file.
nano /etc/named.rfc1912.zones

 

… add the following contents to the bottom of the file
zone "[[Your Domain Name]]" IN { type master; file "[[Your Domain Name]]"; allow-query { any; }; allow-transfer { none; }; };

 

Next we need to create your individual Zone file.
nano /var/named/[[Your Domain Name]]

 

… and add in the following contents. Feel free to make any changes, as required on your site.
$TTL 3H @ IN SOA @ hostmaster.[[Your Domain Name]]. ( 0 ; serial 3H ; refresh 1H ; retry 1W ; expire 3H ) ; minimum @ IN NS ns1.[[Your Domain Name]]. @ IN NS ns2.[[Your Domain Name]]. @ IN A [[Your IP Address]] @ IN MX 10 mail.[[Your Domain Name]]. ns1 IN A [[Your IP Address]] ns2 IN A [[Your IP Address]] www IN CNAME [[Your Domain Name]]. mail IN CNAME [[Your Domain Name]].

 

Now we can start the DNS server.
systemctl start named;

 

If everything worked correctly, you shouldn’t see any error messages. Assuming you did not get any error messages, you can run the following command to test your DNS server.
dig any [[Your Domain Name]] @[[Your IP Address]]

 

If at any point you need to reload your DNS zones you can simply run the following command without restarting your DNS server.
rndc reload [[Your Domain Name]]

 

Finally we need to tell your server to access its own DNS for any lookups.
nano /etc/resolv.conf;

 

… add the following lines.
search [[Your Domain Name]] nameserver 127.0.0.1

 

… and restart your DNS server
systemctl restart named;

 

Automatic Installation?

If you like the result of the tutorial, but run into problems or would just like to have the work done automatically, we can help you with that. We have an automated script that can SSH into your server and run this tutorial from beginning to end (as long as it’s running CentOS 7). If you would like this done for you ($100), please contact us using the form below.

 

 

---