Hey everyone and welcome back. Now what I want to do is to briefly shift gears and talk about FTP.
This is the file transfer protocol and as you may guess the actual name is pretty descriptive of
its function. This is used for the transferring of files and it is still very very popular in
modern networks so it definitely is worthwhile for us to understand this and be aware of it,
not just for the purposes of the examination but also as Linux engineers. So let's talk about
how the actual connection of FTP actually operates then. So what I'll do here is if we can imagine
we have an FTP server, we'll say FTP and we can also have a client. So this could just be someone
on their computer looking to receive some type of files. Now one thing to note is that FTP is going
to rely heavily on two ports. The first port is going to be port number 20 and the second one is
going to be port number 21. Now these two ports ultimately serve slightly different purposes.
They both use or are both used for FTP should I say. Port 20 is going to be the actual transferring
of data is going to be sent over this port whereas port 21. This is going to be used to control or
handle the connection itself. What does this actually mean? Well if we actually dive in and
look at an example of how a connection can be initiated hopefully this will make a little bit
more sense. So check this out we've got this client over here. Now the client is going to request
some type of file from the FTP server over here. Now what's got to happen first is that this client
over here has got to specify a source port number of its own. Now this can be a random port number.
If I just happen to specify 9594 let's just say random number and actually let's just give each
one an IP address. Let's imagine this is 10112 and this can be 10111. So what the client is going
to do is going to make a connection to FTP. Pretty much saying hey my IP address is 10112.
I am starting a connection over my local port of 9594. This is a random port chosen by the clients.
Now the crucial thing is that this actual request is going to be sent to the server on its IP address
using port 21 which is an FTP port but remember this is the port used to control or handle the
connection. So this is not where the data is going to actually come across. This is just to
instantiate this connection. Now in this connection the client is going to communicate another
port number different from this source one right here. Again it will be a random one let's just say
9595 so one higher but ultimately what the client is doing here is saying hey I want FTP services
from you as indicated by the port from this server and when you respond to me I want you to send data
to me on my IP address up here on this particular port in this case 9595. Now the crucial thing
is that when FTP responds and actually sends the data to this IP address to this particular port
the FTP service is going to open up here but it's going to open up locally on port 20 on FTP because
now we're actually sending over the data the actual file that was requested. So this is the big
difference port 21 used to open up and instantiate the connection when the data is actually flowing
it's going to be over port 20 again this is from the server's point of view. The client can just
use random ports as long as it's communicating those ports to the server. Now this type of
connection here is a very particular type of FTP connection this is known as active FTP. Now the
issues with active FTP is simply due to what we just recently talked about and that is with respect
to firewalls because firewalls don't happen to like inbound connections or at least unless you
have to explicitly open inbound connections which is kind of frowned upon not really desirable.
So think about this imagine the same connection we've got the client over here we have the FTP
server think about what actually happened here we've got our port of 9594 I believe it was we
send the request to the FTP server on port 20. FTP server uses port 21 to respond back to us but FTP
opens a fresh connection into our computer as the client this time on port 9595 now because this is an
inbound connection from the perspective of the client uninitiated by the client i.e it was initiated
by a remote server firewall operators on the client side may not be too keen with the ability of an
external source to just open a connection directly into the network or into the host so because of
this FTP active can become problematic so the way this is resolved is by using FTP in passive mode
now this is handled a little bit differently yet again so let me show you how this works
so over here on the client side once again and we will have the server FTP things are going to look
a little bit different but you will recognize a lot of the steps here so check this out imagine
that the client here wants those FTP services so once again let's just say 9495 I believe the
port is it doesn't actually matter let's just say it's 9495 this time the client is going to send a
request to FTP on port 21 saying pretty much hey master FTP I need to have a passive connection
so FTP receives this on its control port of port 21 and what FTP is going to do it's going to respond
back pretty much saying okay I'm going to facilitate this connection by waiting for you I'm going to
open up a random port on my side of the connection and you can call in to me that way the client can
be the one initiating the connection in fact I've accidentally rubbed out that five there let me just
draw that back so like I say FTP is going to say okay I'm going to wait for you and FTP is now going
to be the one that will choose a random port so let's just say FTP chooses 8642 whatever it may be
and it communicates that information to the client so now the client is going to use a new port once
again so the client could use 9496 to make an outbound connection and it's going to make an
outbound connection to the FTP server on its IP address but it's going to target this particular
port that was specified by the FTP server but again the crucial difference here is that this is an
outbound connection initiated by the client so the client is only ever doing outbound initiation
it's never waiting for a connection to come inbound and this is going to solve these particular
firewall issues so once the connection is now open this channel is open effectively and FTP
can begin sending all of that FTP data through this channel and the client can receive all of that
via FTP so now that we understand the two different modes of connecting to FTP what we now want to
look at are some FTP server options that we can use if we want to actually supply these services
ourselves now we do have a few options the first one and the main focal point I would say is one
called VSFTPD this is the very secure FTP daemon now VSFTPD is a very good daemon although I would
be hesitant or wary of any software which happens to be very secure that's just my own personal
bias but yeah it's good software but please don't put too much faith in the system sometimes the
names can be deceiving the next one we want to look at is one called pure FTPD and the last one
is one called pro FTPD now really like I say the main one we want to focus on is VSFTPD the big
crucial thing we have to know here is that this is actually controlled like so much of what we see
on linux directly via configuration files whereas if we use pure FTPD we do not modify
configuration files instead we make all the changes to the service directly via the command line
now with respect to pro FTPD honestly I really wouldn't worry about looking into this with any
great detail the exam objectives really just specify that we have an awareness of pro FTP's
existence so that you do recognize it is an FTP developer option but really like I say let's turn
our attention to VSFTPD and begin a little installation then so what I will do is I will
clear the screen so what I'm going to say here is sudo apt install and I will say VSFTPD to install
VSFTPD I will type in my password here and hit enter would be super helpful if I could type the
right password of course so try again there we go now the installation begins now depending on the
distribution that you're using VSFTPD may be located in two different locations or rather
should I say the configuration file for VSFTPD the first location you should check would be in the
Etsy directory and then you will either have a VSFTPD directory and inside that directory you
would have a file called VSFTPD.conf however if you are like me you actually will not have this
particular directory and instead the VSFTPD configuration file will be directly within the
Etsy directory so if I just say sudo nano and do VSFTPD.conf if I hit enter this here is the main
configuration file now there are some settings we want to be aware of for example if I scroll down
here we have this setting for anonymous underscore enable this is set to the value no this means that
anonymous logins are disabled by default what this means is that we're not going to allow anyone to
log in to our ftp server instead they must provide credentials such as a username and a valid password
in order to access our services now just below this we also have local underscore enable set to
the value yes this is going to allow us to allow local users to log in so local users with their
local credentials they can ultimately access the services on the file transfer protocol server
with this configuration enabled now below here we have write enabled equals yes this is commented out
meaning that the actual configuration is not taking effect this means that they cannot actually make
write changes to the ftp server meaning that they can't actually modify the contents on the server
similar to what we saw before we have this configuration file here or rather this configuration
setting should I say a non upload enable yes if we actually uncomment this it's going to allow
anonymous users who have logged in without providing credentials to actually upload files to the server
itself naturally this can obviously be very dangerous if you don't have a good grip of who can
actually access your server so naturally what I want to do is to actually comment this so that
this configuration does not take effect and if we scroll on down we're going to see more and more
settings you can explore these at your leisure but really those are the main configurations that we
want to be concerned about so for now what I will do here is I will just escape this by pressing control
x and just say no here and now what I will do is I will just access my machine right here over ftp
now I'll just say ftp localhost if I hit enter so if I say the name happens to be ipv0 and I type
an ipv0 password right here and hit enter we can see here the login is successful and we actually
now have this ftp prompt if I just say help we can actually see all of the commands that are available
to us over ftp so I can do things like ls to see a listing of the files I could cd into a directory
such as documents and do an ls notice nothing is within this particular directory and if I happen
to have right access I could write to this directory and host files within this server
accessible via ftp now like I say if I happen to just say quit to quit the connection if I try to log
in again and I happen to say anonymous and I just specify the password as anonymous the actual
connection is going to fail however if I say quit go back into my configuration file if I go on down
I will change this to the value yes and I'll save the changes right here and escape out so now what
I can do is I can actually restart the service by saying pseudo service vs fdpd and restart that is
now restarted if I do ftp localhost and I just use the username of anonymous and the password again
of anonymous now this time the login is deemed successful so really with respect to ftp we want
to understand the nature of the connection are we using an active connection or a passive connection
when would you use one or the other the common ports are going to be in use port 21 and port 20
we want to understand some of the options that we have to host a ftp server such as vs fdpd which
will be managed by a configuration file such as the ones we just saw and we also have pure ftpd
which is a command line option as well as pro fdpd whereby we really just have to have a general
awareness of its existence as an ftp server okay doc so that is us for ftp I hope this has been
informative for you and I'd like to thank you for viewing