Create a Secure FTP Server with Linux and SSH

For those not quite at the level of running a complete build system, the File Transfer Protocol (FTP) is still alive and an important part of the business technology landscape. You might think that going full-on cloud is the best bet, but what about those files and folders that house more sensitive data? Do you really want those being uploaded and downloaded to and from a third-party service that you don’t have control over?

The answer should be no.

You need to ensure those files are uploaded to a service you can trust and sometimes the only option is keeping it within your LAN.

If that sounds like a viable solution for you, Linux has your back (as it always does).

With the help of Secure Shell (SSH), you can deploy an FTP server in minutes. I want to show you how it’s done with AlmaLinux. With this taken care of, you’ll be able to move files back and forth with SFTP (Secure FTP) so you can trust the transmission of that data.

One thing to keep in mind is that if you want to use this FTP server outside of your LAN, you’ll need to configure your routing hardware to route the traffic to the hosting server, and you must allow SSH traffic into the network.

What You’ll Need

The only things you’ll need to follow along are a running instance of AlmaLinux (or a similar distribution, such as Red Hat Enterprise Linux, CentOS Stream or Oracle Linux) and a user with sudo privileges.

With those things at the ready, it’s time to configure.

Giving Your User Sudo Privileges

By default, new users are not added to the admin group on AlmaLinux. Instead of changing to the root user for setting this up, which can be a security risk, your best bet is to add a standard to the necessary group. To do that, first change to the root user with the su command. Once you’ve done that, issue the command:

Where USER is the name of the user in question.

Once you’ve done that, exit from the root user with the exit command and then log out and log back in as your user. That user can now work with sudo.

Create Your First FTP Directory

We’re going to create a specific directory that will be used for FTP purposes. The best place to house this is in the /svr directory. Create a new directory with:

Next, you’ll need to change the permissions of that directory to 701, which means:

• Owner has read, write and execute permissions (7).
• Group has no permissions (0).
• Others have execute permission (1).

Change the permission with the command:

Create the Necessary User and Group Accounts

We’ll now create a new user and group that will have access to the new directory. Create the group with:

Now, create a user with the following configuration:

• Isn’t allowed to log into Linux.
• Belongs to the ftp_users group.
• Has a home directory of /srv/ftp/update.

The command for this is:

Where USERNAME is the name of the user you want to add.

Give the new user a strong/unique password with:

passwd USERNAME

Where USERNAME is the name of the user you just created.

Create the User’s Upload Directory

We’ll next create an upload directory for the new user. Let’s say the new user you created is ftpuser. To create the upload directory for that user, issue the command:

sudo mkdir -p /srv/ftp/ftpuser/upload

Change the ownership and permissions for the new directory with:

sudo chown -R root:ftp_users /srv/ftp/ftpuser
sudo chown -R ftpuser:ftp_users /srv/ftp/ftpuser/upload

What we’ve done above is change the ownership (for user and group) of /srv/ftp/ftpuser to root and ftp_users and then change the ownership (for user and group) of /srv/ftp/ftpuser/upload to ftpuser and ftp_users. Remember, in our case ftp_users is the group and ftpuser is the user. You can, of course, change those to anything you want/need.

Configure SSH

We now have to configure SSH so it’s aware of the new FTP directory. Open the SSH daemon configuration file with:

Paste the following at the bottom of the file:

Save and close the file.

Restart SSH with the command:

SSH is now running and aware of the FTP directory. It’s time to test your new FTP server.

Test the Server

Go to another machine on your network and make sure that SSH is installed (or a client that includes SSH/SFTP such as PuTTY). From the terminal window, log in with ftpuser (or whatever you’ve named the new user) like so:

Where SERVER is the IP address of the FTP server.

You should be prompted for the ftpuser password, which you created above. If successful, you’ll see a prompt that looks like this:

sftp>

Change to the upload directory with:

Let’s say you have a file on your local computer (named newstack.txt and located in your home directory) and you want to upload it to the FTP server. To do that, the command would be something like this:

Or, say the newstack.txt file is in your upload directory on the FTP server and you want to download it to your home directory on the local machine. For that, the command is:

If you opt to use a GUI, one thing to keep in mind is that you’ll have to configure your connections with port 22, as that is the default SSH port.

Congratulations, you now have a working FTP server that uses SSH’s SFTP protocol to send and receive files securely.