RHEL6: vsftpd anonymous access with selinux

First install the vsftpd package:

yum install vsftpd

and edit /etc/vsftpd/vsftpd.conf

anonymous_enable=YES
write_enable=YES
local_umask=022
anon_upload_enable=YES
anon_mkdir_write_enable=YES
anon_other_write_enable=YES
dirmessage_enable=YES
xferlog_enable=YES
connect_from_port_20=YES
xferlog_file=/var/log/vsftpd.log
xferlog_std_format=YES
ftpd_banner=Welcome to blah FTP service.
listen=YES
local_root=/var/ftp/upload
pam_service_name=vsftpd
userlist_enable=YES
tcp_wrappers=YES

Then edit tcpwrappers /etc/hosts.allow and add:

vsftpd: ALL

Set an iptables rule:

iptables -A INPUT -m state –state NEW -m tcp -p tcp –dport 21 -j ACCEPT

Set rights and user for the upload dir:

chmod 666 /var/ftp/upload

chown ftp:ftp /var/ftp/upload

We need also a rule for selinux that the anonymous users are allowed to write or upload to the /var/ftp/upload directory

setsebool -P allow_ftpd_anon_write=1

Set the correct filetype for selinux which is:

public_content_t

this can be done with the command:

chcon -t public_content_rw_t /var/ftp/upload

If you messed up to much with the types you could also use the command:

#restorecon /var/ftp/upload

Don’t forget to put:

IPTABLES_MODULES=”ip_conntrack_ftp”

into /etc/sysconfig/iptables-config