Enable Anonymous FTP on ProFTPD in CentOS

To enable an anonymous account on ProFTPD in CentOS, you edit the proftpd.conf file to add an <Anonymous> block, create a system user (typically ftp), and restart the service. This article walks through the exact configuration steps, security considerations, and common pitfalls so you can set up a working anonymous FTP server without exposing more than you intend.

What Anonymous FTP Means on ProFTPD

Anonymous FTP lets anyone connect to your server without a personal username and password. They log in with the username anonymous (or ftp) and typically use their email address as the password, though most servers accept any non-empty string. ProFTPD handles this through a dedicated <Anonymous> configuration block that overrides the default server behavior for those connections.

This is different from a regular user account. The anonymous user is chrooted to a specific directory (usually /var/ftp), cannot see the rest of the filesystem, and only has the permissions you explicitly grant. You control whether they can download, upload, create directories, or rename files. The default is read-only download access, which is the safest starting point.

Prerequisites: Install ProFTPD on CentOS

CentOS 7 and 8 include ProFTPD in the EPEL (Extra Packages for Enterprise Linux) repository. If you haven’t installed it yet:

1. Enable EPEL: sudo yum install epel-release (CentOS 7) or sudo dnf install epel-release (CentOS 8+).
2. Install ProFTPD: sudo yum install proftpd or sudo dnf install proftpd.
3. Check the version: proftpd -v to confirm the install.
4. Start and enable the service: sudo systemctl enable --now proftpd.

On CentOS 9, ProFTPD is also available via EPEL, but you may need to enable CodeReady Builder (CRB) first. The package name is the same.

Step-by-Step: Create the Anonymous User and Directory

ProFTPD’s anonymous block expects a system user to map the anonymous login to. The standard is the ftp user, which is often already present on CentOS. If not, create it:

sudo useradd -d /var/ftp -s /sbin/nologin ftp
sudo mkdir -p /var/ftp/pub
sudo chown root:root /var/ftp
sudo chmod 755 /var/ftp

The home directory /var/ftp is where anonymous users will be chrooted. The pub subdirectory is a common place to put files for public download. The nologin shell prevents the user from logging into the system via SSH or console.

Configure the Anonymous Block in proftpd.conf

The main configuration file is /etc/proftpd.conf. Add the following block near the end, after the global settings:

<Anonymous ~ftp>
  User ftp
  Group ftp
  UserAlias anonymous ftp
  MaxClients 10
  DisplayLogin welcome.msg
  DisplayFirstChdir .message
  <Directory *>
    <Limit WRITE>
      DenyAll
    </Limit>
  </Directory>
  <Directory /var/ftp/pub>
    <Limit READ>
      AllowAll
    </Limit>
  </Directory>
</Anonymous>

Here’s what each directive does:

• <Anonymous ~ftp> – The tilde expands to the ftp user’s home directory, so the anonymous root is /var/ftp.
• User ftp and Group ftp – The anonymous connection runs with the privileges of the ftp user.
• UserAlias anonymous ftp – Maps the username anonymous (and by default ftp) to the system user ftp.
• MaxClients 10 – Limits concurrent anonymous connections to 10. Adjust as needed.
• DisplayLogin and DisplayFirstChdir – Show a welcome message file if present.
• The <Directory *> block denies all write operations (upload, rename, delete) by default.
• The <Directory /var/ftp/pub> block explicitly allows READ, so users can download files from that subdirectory.

After editing, test the configuration with sudo proftpd -t. If it says “Syntax check completeâ€�, restart the service: sudo systemctl restart proftpd.

Common Problems and How to Fix Them

Several issues can prevent anonymous access from working:

• Firewall blocking port 21 – CentOS’s default firewall (firewalld) blocks FTP. Open it with: sudo firewall-cmd --add-service=ftp --permanent && sudo firewall-cmd --reload.
• SELinux denying access – CentOS ships with SELinux enforcing. The boolean ftpd_anon_write must be enabled for anonymous write access: sudo setsebool -P ftpd_anon_write 1. For read-only, the default is usually fine, but if you see “Connection closedâ€� in logs, check sudo ausearch -m avc -ts recent.
• Passive mode not working – FTP passive mode uses random high ports. You need to configure a passive port range and open it in the firewall. In proftpd.conf, add: PassivePorts 49152 65535. Then open those ports in firewalld.
• Directory permissions too restrictive – The anonymous root and its subdirectories must be readable and executable by the ftp user. If you get “550 Permission deniedâ€�, check ownership and permissions with ls -ld /var/ftp /var/ftp/pub.
• UserAlias not working – If you only want the username anonymous and not ftp, you can set UserAlias anonymous ftp and then UserAlias ftp (without a target) to disable the default alias. But the default is usually fine.

Security: What to Lock Down

Anonymous FTP is a public service, so security is critical. Follow these rules:

• Never give the anonymous user write access to the root of the anonymous directory. Use a separate uploads directory if you need uploads, and set its permissions to 1733 (sticky bit) so users can upload but not delete others’ files.
• Disable anonymous uploads entirely unless you have a clear need. The example above denies all WRITE operations.
• Use MaxClients to prevent resource exhaustion. Set a reasonable limit like 10 or 20.
• Consider using AllowOverwrite off inside upload directories to prevent overwriting existing files.
• Run ProFTPD chrooted – the <Anonymous> block does this automatically, but ensure the ftp user has no shell access (/sbin/nologin).
• Regularly update ProFTPD via sudo yum update proftpd to patch known vulnerabilities.
• Monitor logs in /var/log/secure and /var/log/proftpd for unusual activity.

Alternatives and When Not to Use Anonymous FTP

Anonymous FTP is an old protocol. In many cases, you might be better off with:

• SFTP (SSH File Transfer Protocol) – Uses SSH, encrypted, and you can set up a chrooted SFTP user with no shell access. CentOS has OpenSSH built-in. This is the recommended replacement for most file-sharing needs.
• FTPS (FTP over TLS) – If you must use FTP, enable TLS in ProFTPD to encrypt credentials and data. Add TLSEngine on and configure certificates.
• HTTP/HTTPS with a simple file listing – A web server like Nginx can serve a directory for downloads, which works through firewalls and browsers without FTP client software.

If your goal is to share files with a few known people, anonymous FTP is the wrong choice because it offers no accountability. If you need public distribution of large files, HTTP is often simpler and more reliable. Only use anonymous FTP when you specifically need FTP protocol compatibility (e.g., legacy systems or embedded devices).

Frequently Asked Questions

How do I allow anonymous uploads?

Create a dedicated upload directory, e.g., /var/ftp/uploads, and add a <Directory> block inside the anonymous section that allows WRITE. For example: <Directory /var/ftp/uploads> <Limit WRITE> AllowAll </Limit> </Directory>. Also set the directory permissions to 1733 (sticky bit) so users can add files but not delete others’. Remember to enable SELinux boolean ftpd_anon_write and open the passive port range.

Why do I get “530 Login incorrect� when trying anonymous?

This usually means the <Anonymous> block is not being applied. Check that the block is in the main configuration file and not inside a <VirtualHost> that is not active. Also verify that the ftp user exists and that the UserAlias directive is correct. Run proftpd -t to check syntax and restart the service.

Can I have both anonymous and regular users on the same server?

Yes. The <Anonymous> block only affects connections that use the anonymous or ftp username. Regular users with system accounts will still be able to log in normally, subject to the global configuration. Just make sure your global <Limit LOGIN> allows both, or use AllowUser ftp inside the anonymous block.

Is anonymous FTP safe to use on the internet?

It can be safe if properly configured: read-only, chrooted, limited clients, and updated software. The main risks are unencrypted credentials (but anonymous has no real password) and potential data exposure if you accidentally allow write access. For sensitive data, use SFTP or FTPS instead. Always monitor logs for abuse.

How do I change the anonymous root directory from /var/ftp to something else?

Change the <Anonymous> directive to point to the new path, e.g., <Anonymous /srv/ftp>. Also update the ftp user’s home directory with sudo usermod -d /srv/ftp ftp and ensure the new directory has the correct ownership and permissions. Then restart ProFTPD.

Related

• Google Easter Eggs: Cool Hidden Tricks
• Router Power Brick Distance: Why Far Away?
• Raspberry Pi Internet Pause Button: How to Build One