Pure-FTPd 1.0.54

In the AWS Marketplace listing, choose Continue to Subscribe, then Continue to Configuration. Pick Pure-FTPd 1.0.54 on Ubuntu 24.04 as the software version and select your Region, then choose Launch through EC2.

Choose m5.large, your key pair, and a security group as described above. FTP needs little CPU, so size the instance for your users and transfer volume.

The AMI carries two volumes: the 8 GiB root volume and a 20 GiB data volume for /srv/ftp. You can make the data volume larger at launch, and first boot grows the file system to fill it.

To launch with the AWS CLI, replace the values in angle brackets. The second block device mapping sets the data volume size:

aws ec2 run-instances --region <region> --image-id <ami-id-from-the-listing> \
  --instance-type m5.large --key-name <your-key-pair> \
  --security-group-ids <your-security-group> --subnet-id <your-subnet> \
  --metadata-options HttpTokens=required,HttpEndpoint=enabled \
  --block-device-mappings 'DeviceName=/dev/sdf,Ebs={VolumeSize=100,VolumeType=gp3}' \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=pure-ftpd}]'

• Version: Pure-FTPd 1.0.54 on Ubuntu 24.04
• SSH user: ubuntu

Connect with your key pair:

ssh -i <your-key.pem> ubuntu@<public-ip>

First boot creates the user and the certificate, starts the server, and proves an encrypted round trip before it finishes. This usually takes about a minute:

systemctl is-active pure-ftpd pure-ftpd-prepare pure-ftpd-firstboot
sudo test -f /var/lib/sac/data/pure-ftpd-firstboot.done && echo FIRSTBOOT_DONE

All three units are active, and the first-boot marker is present:

active active active FIRSTBOOT_DONE

Only SSH and Pure-FTPd listen on public addresses. The passive data ports open only for the duration of a transfer:

sudo ss -lntp | awk 'NR>1 {print $4, $6}' | grep -v '127.0.0' | sort

0.0.0.0:21 users:(("pure-ftpd",...)) 0.0.0.0:22 users:(("sshd",...)) [::]:21 users:(("pure-ftpd",...)) [::]:22 users:(("sshd",...))

Print the credentials file without its comment lines:

sudo grep -vE '^(#|$)' /root/pure-ftpd-credentials.txt

Only root can read the file. It contains:

FTP_HOST=ec2-<public-ip-dashed>.compute-1.amazonaws.com FTP_PORT=21 FTP_USER=sac FTP_PASSWORD=<FTP_PASSWORD> FTP_TLS=explicit FTPS (AUTH TLS) required for login and data FTP_PASSIVE_PORTS=30000-30099 FTP_HOME=/srv/ftp/sac TLS_CERT_SHA256=<certificate-sha256-fingerprint>

FTP_HOST is the instance's public DNS name from EC2 instance metadata (the public or private IP address when the subnet has no public DNS names). The certificate also names the public and private IP addresses, so connecting by IP address works too. To use your own DNS name, follow Step 11.

In FileZilla, open File > Site Manager > New site and set:

• Protocol: FTP - File Transfer Protocol
• Host: FTP_HOST from Step 4, port 21
• Encryption: Require explicit FTP over TLS
• Logon type: Normal (or Ask for password)
• User / Password: SecureAnyCloud and FTP_PASSWORD

On the Transfer Settings tab, keep Passive mode.

The first time you connect, FileZilla shows the server's certificate. It is self-signed and was created on your instance. Compare its SHA-256 fingerprint with TLS_CERT_SHA256 from Step 4, then select Always trust this certificate. You can print the fingerprint on the instance at any time:

sudo openssl x509 -noout -subject -fingerprint -sha256 -in /etc/ssl/pure-ftpd/pure-ftpd.crt

• WinSCP: set File protocol to FTP and Encryption to TLS/SSL Explicit encryption.
• Cyberduck: choose FTP-SSL (Explicit AUTH TLS).
• lftp: run set ftp:ssl-force true; set ftp:ssl-protect-data true.

From a terminal on your own machine, curl asks for the password when you give only the user name. The -k option accepts the self-signed certificate. Alternatively, save the certificate and use --cacert:

curl --ssl-reqd -k -u sac -T ./report.csv ftp://<public-ip>/report.csv
curl --ssl-reqd -k -u sac --list-only ftp://<public-ip>/
curl --ssl-reqd -k -u sac -O ftp://<public-ip>/report.csv

This command uploads a file, reads it back, lists the directory and deletes the file, all over FTPS to the instance's own private address. The password is passed to curl on standard input, so it never appears in the process list or your shell history:

sudo bash -c ' F=/root/pure-ftpd-credentials.txt U=$(sed -n "s/^FTP_USER=//p" $F); P=$(sed -n "s/^FTP_PASSWORD=//p" $F) IP=$(hostname -I | cut -d" " -f1) ftps() { printf "user = \"%s:%s\"\n" "$U" "$P" | curl -K - -s --ssl-reqd -k "$@"; } echo "hello from sac" > /run/report.txt ftps -T /run/report.txt "ftp://$IP/report.txt" && echo "upload -> ok" echo "download -> $(ftps "ftp://$IP/report.txt")" echo "list -> $(ftps --list-only "ftp://$IP/" | tr "\n" " ")" ftps -Q "DELE report.txt" "ftp://$IP/" -o /dev/null && echo "delete -> ok" rm -f /run/report.txt '

upload -> ok download -> hello from sac list -> .. . report.txt delete -> ok

Uploaded files land in the user's jail, /srv/ftp/sac, owned by the unprivileged ftpvirtual account. To drop files in for a user over SSH, copy them there and give them to that account (sudo chown ftpvirtual:ftpvirtual /srv/ftp/sac/<file>).

The image ships an end-to-end check that you can run at any time. First boot runs it too. The check reads the credentials file itself and drives the server over FTPS through the instance's private address:

sudo pureftpd-verify.sh

ok plain FTP login refused before PASS (421, curl rc 28) ok anon login refused over FTPS (530) ok ftp login refused over FTPS (530) ok wrong password refused (530) after <milliseconds> ms ok wrong-password delay in effect (<milliseconds> ms) ok cleartext data channel refused (curl rc 19) ok server certificate is this instance's (<fingerprint>...) ok tls1_2 accepted ok tls1_3 accepted ok TLS 1.1 refused ok upload (EPSV) sac-verify-<pid>.bin ok download (PASV) byte-identical ok passive data port <port> inside 30000-30099 ok data channel protected (PROT P accepted) ok listing shows the upload ok delete ok file gone after delete ok file gone from /srv/ftp/sac ok CWD .. / ../.. stay at the jail root ok ../../../etc/passwd unreachable (curl rc 9) ok /etc/passwd (absolute) unreachable (curl rc 9) ok root listing holds only the user's own files ok live session process runs as ftpvirtual ok privilege-separation helper runs as _pure-ftpd ok exactly one root pure-ftpd process (the listening master) PUREFTPD_ROUNDTRIP_OK target <private-ip>

The check takes about a minute, because it tries wrong passwords on purpose and Pure-FTPd makes each one wait. It leaves the user's directory as it found it.

A client that does not start TLS gets the welcome banner and is then refused at the user name, before it can send a password:

IP=$(hostname -I | cut -d" " -f1); (curl -sv -m 8 "ftp://$IP/" 2>&1 || true) | grep -E '^< (220|421)' | tr -d '\r' | sed -n 1,6p

< 220---------- Welcome to Pure-FTPd [privsep] [TLS] ---------- < 220-You are user number 1 of 50 allowed. < 220-Local time is now <time>. Server port: 21. < 220-This is a private system - No anonymous login < 220-IPv6 connections are also welcome on this server. < 220 You will be disconnected after 15 minutes of inactivity.

The configuration requires TLS for logins and data (TLS 3), allows only virtual users from the PureDB database, refuses anonymous logins and jails everyone:

grep -E '^(PureDB|NoAnonymous|MinUID|TLS|CertFileAndKey|ChrootEveryone|PassivePortRange|MaxClientsNumber|MaxClientsPerIP|Include) ' /etc/pure-ftpd/pure-ftpd.conf

PureDB /etc/pure-ftpd/pureftpd.pdb NoAnonymous yes MinUID 100 TLS 3 CertFileAndKey "/etc/ssl/pure-ftpd/pure-ftpd.crt" "/etc/ssl/pure-ftpd/pure-ftpd.key" ChrootEveryone yes PassivePortRange 30000 30099 MaxClientsNumber 50 MaxClientsPerIP 8 Include /etc/pure-ftpd/passive-ip.conf

The files that matter are locked down, the user database holds only an argon2id hash, and every virtual user works as the unprivileged ftpvirtual account in its own directory:

sudo stat -c '%a %U:%G %n' /etc/pure-ftpd/pureftpd.passwd /etc/pure-ftpd/pureftpd.pdb /etc/ssl/pure-ftpd/pure-ftpd.key /root/pure-ftpd-credentials.txt /srv/ftp /srv/ftp/sac
sudo cut -d: -f1,6 /etc/pure-ftpd/pureftpd.passwd;
sudo cut -d: -f2 /etc/pure-ftpd/pureftpd.passwd | cut -c1-14

600 root:root /etc/pure-ftpd/pureftpd.passwd 600 root:root /etc/pure-ftpd/pureftpd.pdb 600 root:root /etc/ssl/pure-ftpd/pure-ftpd.key 600 root:root /root/pure-ftpd-credentials.txt 755 root:root /srv/ftp 750 ftpvirtual:ftpvirtual /srv/ftp/sac sac:/srv/ftp/sac/./ $argon2id$v=19

The server runs in a sandbox that can write only to the data volume and its transfer log, and it cannot reach the instance metadata service:

systemctl show pure-ftpd -p ProtectSystem -p ReadWritePaths -p NoNewPrivileges -p IPAddressDeny

IPAddressDeny=169.254.169.254/32 168.63.129.16/32 fd00:ec2::254/128 ReadWritePaths=/srv/ftp /var/log/pure-ftpd ProtectSystem=strict NoNewPrivileges=yes

No per-instance password reaches a log, the journal, shell history, backups, /etc or the data volume. The server logs every command to the journal, but it logs passwords as <*>:

sudo pureftpd-secret-leak-check.sh

LEAKCHECK_OK no per-instance password in the journal, auth.log, syslog, cloud-init, the transfer log, shell history, MOTD, /var/backups, /etc, /srv/ftp or /tmp

Pure-FTPd logs the address each client really connected from, so the journal and the transfer log show who did what:

sudo journalctl -u pure-ftpd --no-pager -o cat | grep -E 'New connection|is now logged in' | tail -n 4
sudo tail -3 /var/log/pure-ftpd/transfer.log

(?@<private-ip>) [INFO] New connection from <private-ip> (?@<private-ip>) [INFO] sac is now logged in <private-ip> - sac [<date>] "PUT /srv/ftp/sac/sac-verify-<pid>.bin" 200 262144 <private-ip> - sac [<date>] "GET /srv/ftp/sac/sac-verify-<pid>.bin" 200 262144

Every user gets its own jail, /srv/ftp/<user>, and never sees the others. Add a user with a generated password (shown once):

sudo pureftpd-adduser alice

Or set the password yourself on standard input, so it never appears on a command line or in your history:

read -rs PW && printf '%s\n' "$PW" | sudo pureftpd-adduser bob --password-stdin; unset PW

Change a password (generated, or with --password-stdin). For the SecureAnyCloud user, this also updates /root/pure-ftpd-credentials.txt:

sudo pureftpd-passwd sac

Delete a user (add --remove-files to delete its directory too) and list the users:

sudo pureftpd-deluser alice

sudo pureftpd-listusers

sac /srv/ftp/sac/./

Passwords must be at least 12 characters.

For per-user quotas, bandwidth limits, allowed client addresses or time windows, use Pure-FTPd's own pure-pw on the same database, then rebuild it. For example, this sets a 10 GB quota for alice:

sudo pure-pw usermod alice -N 10000 -f /etc/pure-ftpd/pureftpd.passwd -F /etc/pure-ftpd/pureftpd.pdb -m

See man pure-pw for every option. Changes apply to the next login.

FTP uses a second connection for every transfer and listing. In passive mode, which every modern client uses, the client opens that connection to a port the server announces from 30000-30099, so your security group must allow that range as well as port 21.

The server allows up to 50 simultaneous sessions (half the passive range, so it can never run out of data ports) and at most 8 from one address.

Clients that use the EPSV command (FileZilla, WinSCP, curl, lftp and most others) reuse the address they connected to. Older clients use PASV, where the server announces an address. On every boot, pure-ftpd-prepare sets that address to the instance's public IPv4 address from instance metadata. The address can change when you stop and start the instance:

cat /etc/pure-ftpd/passive-ip.conf

# written by pureftpd-prepare at every boot - do not edit (set /etc/sac/pure-ftpd-passive-ip instead) ForcePassiveIP <public-ip>

Behind an Elastic IP or a Network Load Balancer, write that address to /etc/sac/pure-ftpd-passive-ip (or none when all your clients are inside the VPC), then apply it:

echo <elastic-ip> | sudo tee /etc/sac/pure-ftpd-passive-ip
sudo pureftpd-prepare --restart

Point a DNS record at the instance, then set the name the server presents. This command creates a new self-signed certificate for the name (and the instance's addresses), updates FTP_HOST and TLS_CERT_SHA256 in /root/pure-ftpd-credentials.txt, restarts the server and keeps the name across reboots:

sudo pureftpd-set-hostname <your-domain>

To use a certificate from your own certificate authority instead, copy it over the generated pair and restart the server. Running pureftpd-set-hostname again replaces it with a self-signed one:

sudo install -m 0644 <your-domain>.crt /etc/ssl/pure-ftpd/pure-ftpd.crt
sudo install -m 0600 <your-domain>.key /etc/ssl/pure-ftpd/pure-ftpd.key
sudo systemctl restart pure-ftpd

/srv/ftp is its own EBS volume, mounted by file system UUID with nodev,nosuid,noexec, so uploads can never be run as programs:

findmnt -no SOURCE,FSTYPE,OPTIONS /srv/ftp df -h --output=size,used,avail,target /srv/ftp

/dev/nvme1n1 ext4 rw,nosuid,nodev,noexec,relatime Size Used Avail Mounted on 20G 28K 19G /srv/ftp

To grow it, increase the volume's size in the EC2 console (Volumes > Modify volume), wait until the modification reaches the optimizing state, then grow the file system online (the next boot does it too):

sudo pureftpd-prepare

Back it up with EBS snapshots or AWS Backup. A snapshot of the data volume holds every user's files.

The operating system and OpenSSL update through apt, and unattended security upgrades are on. Pure-FTPd itself is the source build described in the overview, so apt does not touch it. The version and where it came from:

(sudo /usr/local/sbin/pure-ftpd --help 2>&1 || true) | sed -n 1p cat /usr/local/share/doc/pure-ftpd/SOURCE.txt apt-cache policy pure-ftpd | sed -n 1,3p

pure-ftpd v1.0.54 [privsep] This Pure-FTPd 1.0.54 was built by sac from the upstream release tarball https://download.pureftpd.org/pub/pure-ftpd/releases/pure-ftpd-1.0.54.tar.gz, whose SHA-256 checksum dc9140420ec44f7829579591ff378aa6396b4604b9c6aeae847368e0f35bd7b2 and minisign signature (author key E7620F1842B4E81F, signed at Unix time 1777365701) were both verified before the build, configured with: --prefix=/usr/local --sysconfdir=/etc/pure-ftpd --localstatedir=/var --with-tls --with-puredb --with-quotas --with-peruserlimits --with-throttling --with-altlog --without-inetd --with-certfile=/etc/ssl/pure-ftpd/pure-ftpd.crt --with-keyfile=/etc/ssl/pure-ftpd/pure-ftpd.key. It is not the Ubuntu pure-ftpd package, so apt and unattended-upgrades do not update it; sac publishes a new image version when upstream releases a fix (upstream releases: https://download.pureftpd.org/pub/pure-ftpd/releases/ and https://github.com/jedisct1/pure-ftpd/releases). pure-ftpd: Installed: (none) Candidate: 1.0.50-2.2build2

Do not install Ubuntu's pure-ftpd package: it is the older 1.0.50 and would conflict with the server on port 21.

When a Pure-FTPd release fixes a security issue, SecureAnyCloud adds a new image version to this listing. To move to it:

• Launch the new version next to the old instance.
• Stop the server on the old instance (sudo systemctl stop pure-ftpd), take a snapshot of its data volume, and create a volume from that snapshot in the new instance's Availability Zone.
• On the new instance, stop the server, attach the volume, and copy your users' directories into /srv/ftp (or mount the volume in place of the new one by its UUID in /etc/fstab). Copy /etc/pure-ftpd/pureftpd.passwd from the old instance, then rebuild the database with sudo pure-pw mkdb /etc/pure-ftpd/pureftpd.pdb -f /etc/pure-ftpd/pureftpd.passwd and start the server.

Alternatively, build the new upstream release yourself from the URLs above, verifying its signature with the author's minisign key, and install it over /usr/local/sbin/pure-ftpd.

Components:

• Pure-FTPd: 1.0.54 (upstream source build), at /usr/local/sbin/pure-ftpd
• pure-pw, pure-pwconvert, pure-statsdecode: 1.0.54, at /usr/local/bin/
• OpenSSL: 3.0.13 (Ubuntu, updated by apt), as a system library
• Operating system: Ubuntu 24.04 LTS

Paths:

• /etc/pure-ftpd/pure-ftpd.conf: server configuration
• /etc/pure-ftpd/pureftpd.passwd, pureftpd.pdb: virtual users (source file and compiled database, mode 0600)
• /etc/pure-ftpd/passive-ip.conf: passive address, written at every boot
• /etc/ssl/pure-ftpd/: certificate and key
• /srv/ftp/<user>: each user's jail on the data volume
• /var/log/pure-ftpd/transfer.log: transfer log (CLF). Commands go to the journal (journalctl -u pure-ftpd).
• /root/pure-ftpd-credentials.txt: host, user and password (mode 0600)
• /usr/local/share/doc/pure-ftpd/: license, ChangeLog and SOURCE.txt
• /usr/local/sbin/pureftpd-*: account, host name, passive address, check and leak-check tools

To change a setting, edit /etc/pure-ftpd/pure-ftpd.conf and run sudo systemctl restart pure-ftpd. If you change PassivePortRange, change the security group to the same range. The range also sets the session limit.