All about FTP users

Does a supplier only support FTP, or do you need to give someone access to one directory instead of a whole home directory?

This article describes what an FTP user is, why FTP is a poor choice for everything else, and how to create one.

What an FTP user is

An extra login that reaches a site's files over FTP. It has its own username and password, separate from the ones you use for SSH and SFTP, and it can be limited to one directory.

• FTP only. It cannot log in over SSH or SFTP, and cannot run commands.
• Files it uploads end up owned by the site itself, the same as files uploaded over SFTP. Your website keeps working with them and permissions stay correct.
• It cannot leave its directory. Whatever you set becomes the top of the tree: the client cannot move up to the parent, and cannot see anything outside it.
• One site can have several FTP users, each pointing at a different directory.

Avoid FTP where you can

FTP has no encryption. The username, the password and the contents of every file travel over the network as readable text.

Anyone who can see that traffic can read all of it — other people on the same Wi-Fi network as the person connecting, and every network operator the connection passes through. Once someone has the password, they can log in as that FTP user and upload files, for example a PHP script that gives them control over your site.

For uploading files, use SFTP: same job over an encrypted SSH connection, using the login the site already has (or an SSH key), with no extra setup. See All about UNIX users.

The two cases where an FTP user is still the answer

• A supplier requires FTP. Still common in e-commerce: a wholesaler that drops a stock or price file on your server every night, or picks up an order export. If their system only speaks FTP, you cannot change that from your side.
• Someone needs access to one directory only. Logging in over SFTP always gets you the site's entire home directory, including its code and configuration. An FTP user can be pointed at a single subdirectory, so a freelancer or an external system can upload to uploads/ without reading or changing anything else.

If you have to use FTP

1. Restrict who can connect — only the IP addresses of the supplier or person who needs access, using a firewall group. See Opening the FTP port.
2. Give the FTP user its own subdirectory, not the whole home directory.
3. Use a unique password. Never reuse the password you use for SSH and SFTP, because that one gets someone into everything.
4. Delete the FTP user once the supplier or person no longer needs it.

Requirement: the ProFTPD node group

FTP only works when a node in the cluster has the 'ProFTPD' node group. Until then, the 'FTP' tab is not shown on the UNIX user page at all.

To add the group, see Add a node group.

The web-based file manager in Core uses FTP too, so it needs the same node group. Without it, the 'File Manager' tile on the UNIX user's 'SFTP & SSH' tab is greyed out, with a tooltip saying the cluster has no node with ProFTPD.

The file manager creates its own temporary login that expires after an hour. You do not need an FTP user for it.

Creating an FTP user

Directly

1. Navigate to 'Advanced' > 'UNIX Users'.
2. Select the UNIX user.
3. Navigate to 'FTP'.

Via the project

1. Navigate to 'Projects'.
2. Select the project.
3. Navigate to 'Advanced'.
4. Under the 'UNIX User' tile, click 'Manage'.
5. Navigate to 'FTP'.

Then fill in the form

1. Click '+' next to 'FTP Users'.
2. 'Username' — lowercase letters, digits, dash, underscore, dot and @. Max 32 characters. It does not have to relate to the UNIX user's name.
3. 'Password' — at least 24 characters. 'Generate' produces one. Copy it before creating the FTP user: it is never shown again and cannot be looked up later.
4. 'Directory' — a path relative to the UNIX user's home directory, for example uploads. The home directory is shown in front of the field. Leave it empty for access to the entire home directory.
5. Click 'Create'.

The FTP user appears in the table, and is set up on the cluster shortly after.

Connecting

The 'FTP' tab shows what the person connecting needs:

• 'Hostname' — one tile per node with the 'ProFTPD' group. Use the hostname shown there.
• 'Port' — 21.

With the username and password you set, that is the full set of connection details. Any FTP client works, for example FileZilla or WinSCP.

Opening the FTP port

Port 21 is closed to the internet by default. Add a firewall rule on the node:

1. Navigate to 'Servers' > 'Nodes'.
2. Select the node with the 'ProFTPD' group.
3. Scroll to 'Firewall Rules' and click '+'.
4. 'Source' — a firewall group containing the IP addresses that need access. Only pick 'All' when the addresses cannot be known in advance; that lets anyone on the internet reach the FTP server and try passwords against it.
5. 'Target' — 'ProFTPD'.

The 'ProFTPD' target covers port 21 and the passive (PASV) data ports FTP clients negotiate for transfers. No second rule needed.

Changing or deleting an FTP user

The password and the directory cannot be changed after creation. To change either, delete the FTP user and create a new one.

To delete: on the 'FTP' tab, click 'Delete' on the row and confirm. This removes the login only — the files in the directory are untouched.

Related

• All about UNIX users — the account that owns the site an FTP user belongs to, and the SFTP and SSH access that is preferable in almost every case.
• All about firewall rules — the rule that opens port 21, and the firewall groups that limit who may connect.
• Add a node group — how to add the 'ProFTPD' group to a node.