Changes

This lab will show you how to set up an FTP server inside a VM guest on a Fedora 16 hostand provide you with experience identifying configuration parameters that meet your requirements. Since youYou'll be using a VM your Centos host as the FTP server, you'll only require one lab PC. Remember, these are not group labs - please work individuallyand connecting to it from your VMs and from other machines.

FTP uses 2 TCP ports. The first, usually port 21, is used to send commands to the server (ls, cd, get, put, etc.) and to receive command replies from the server. The second, usually sometimes port 20, is used to send a file to the server during an upload or to receive a file from the server during a download.

*Power up your PC (the gateway with host name f16host), login as your user-id, open a terminal window and "su" to root.

*Still as root you need to install an ftp client. Use this command: "yum install ftp".*Login to your VM01 VM1 and ensure you have the firewall set up to allow the services you have previously configured (e.g. DNS, mailapache). If those services are not functioning, fix them (or your firewall) now.Before preceeding to the next part ensure your gateway is working properly and that your server has full access to the Internet. Try some of these commands on your VM /guest:

#Still on vm01 use *On your Centos host you should not need to install vsftpd. If it is not present, install it. yum to install vsftpd and edit #Edit the config file (/etc/vsftpd/vsftpd.conf) to implement the following:

#*Local users should be allowed to login to their own Prevent local accounts and upload/download their own filesfrom logging in.#*The FTP Greeting Banner should be set to "Welcome to my OPS335 FTP Server".#*Set the server to listen on IPv4 sockets, not IPv6.#*Set the maximum number of concurrent client connections to 5030.#*Set the maximum transfer rate for anonymous users to 110912 140300 bytes per second.#*Set the connection timeout for all idle clients to 90 secondstwo minutes.

#*Limit the range of ports passive mode is allowed to use to 40335 14335 to 4088514935.#You'll now have to modify your vm01 firewall to allow NEW tcp connections on port 21, and tcp connections on the same ports vsftp is will use for data connections.#You'll need to set SELinux to permissive mode: setenforce 0.#You'll also need to tell SElinux to allow ftp access to users' home directories with: setsebool ftp_home_dir 1#*Note that this may take a minute to run.

#From the command line of your server, create a new file (or several) in /var/ftp/pub.#Change the ownership of the /var/ftp/pub directory to the user ftp.#At this point you should test your FTP server from other hosts within your intranet. It should work properly for both allow anonymous and local usersto retrieve files. From a terminal window on the gateway one of your VMs try these activities:#*ftp as anonymous using the login 'ftp' to your VMhost, then list and get filesthe file you created.#*ftp Try logging is as a user that exists on that machine. ===Connecting from outside your user name intranet===*Now configure your firewall (using iptables) on the gateway machine to allow FTP clients from outside your VM, then network (if you did not already do so).*Test your firewall by logging into a second PC (try both Windows and Linux) and attempt an FTP connection to your gateway PC. Test the anonymous user's ability to list, and get and put filesagain.

{{Admon/important|Obsolete| Note that the material in this step is obsolete. Active mode is considered an even bigger security risk (to the client) than standard ftp. Most ftp clients do not even support active mode anymore. Note how you would perform these steps, but do not do them.}}#Edit /etc/vsftpd/vsftpd.conf and disable Passive mode (so now only Active , ensure active mode is enabled) , and then restart vsftpd.#Add any iptables rules necessary to allow active connections.

===Log Packets with Netfilteriptables===#On the firewall/gateway add iptables log rules to monitor ftp traffic (control and data) for the following:#*PREROUTING chain of nat table#*FORWARD chain of filter table#*POSTROUTING chain from outside your network in both of nat table#On vm01 add iptables log rules to monitor ftp traffic (control and data) for the following:.

#*While monitoring your packets using "tail -f /var/log/messages" - test your firewall logs by connecting from one of your VMs, and then by logging into a second PC (try both Windows and Linux) and attempt an FTP connection to your gateway PC. Test both local user as well as anonymous connections.

Answer In completing this lab you have gained experience using a service that has multiple modes. You have practiced researching configuration parameters to find the following questions and and email ones you need. This will be an invaluable skill, as you will not usually have anyone telling you specifically which parameters to set, or what values to set them to your teacher in ASCII text format.  Exploration questions:#What parameters would did you use to force vsftp to use active mode only.#What version number of vsftpd are you using.

#Certain If you wanted to allow your local users to access their files through ftp, what parameters have notes in the man page saying they should only be used if would you are certain you know set, and what would you are doing. List two of these and explain, in your own words, why they have such warnings (e.g. why they represent a significant security risk).set them to?