FTP Security

After you configure SELinux properly for the vsftpd service, you also should configure some basic security. When dealing with security for FTP, you can run into a little trouble if you don’t plan things out ahead of time.

The FTP protocol supports two different types of file transfers. The first is known as active mode, which uses port 20 to connect back to the client. The second is known as passive mode, which uses a custom-defined range of ports above 1024. Because there are two different modes for FTP, you need to decide which mode you want to use so that you can configure the correct security settings and open the correct ports on the firewall. Back in the configuration section, the option connect_from_port_20 is set to YES by default. This means that, by default, active mode is used for the vsftpd service.