Pure-FTPd - Hardened FTPS Server for AWS EC2

This is a repackaged open source software product wherein additional charges apply for cloudimg support services.

## Why This Image Instead of a Manual Install or Managed Service

A bare Pure-FTPd package needs hours of TLS hardening, chroot setup, passive-mode tuning and virtual-user management before it is production ready. Many competing images ship documented default credentials that automated scanners target within minutes of launch. Managed transfer services add convenience but take away control over storage, networking and the user backend.

This cloudimg image removes those trade-offs. You get a hardened, production-grade FTPS server accepting encrypted transfers within minutes of launch, with no known default credential, no plaintext access and full control over your EC2 instance and attached storage.

## Use-Case Scenario: Nightly Batch File Exchange

A logistics team receives daily shipment manifests from external carriers over a secure channel. Each carrier connects with its own FTPS credentials, uploads files into a chrooted directory visible only to that carrier, and an automated process moves completed files onward for downstream processing. The fixed passive port range and the per-instance passive address let the server sit behind network address translation while carriers connect from fixed IP ranges scoped in the Security Group. Setup takes minutes rather than a multi-day project.

## How It Works

Pure-FTPd is fully installed and running as a systemd service (pure-ftpd.service). On the first boot of every instance, a one-shot service:

• Creates a unique virtual FTP user with a strong random password
• Generates a unique self-signed TLS certificate for that specific instance
• Sets the passive-mode address to this instance address for external clients
• Writes the user, password and host to a root-owned credentials file

No two instances share a credential and no default login is ever baked into the image.

## Security Posture

• Mandatory TLS: Explicit FTPS is required on both the control and data channels. A plaintext FTP login is refused, so usernames, passwords and file contents are always encrypted in transit.
• No anonymous access: Anonymous FTP is disabled outright.
• Chroot isolation: Every virtual user is jailed to its own home directory and cannot browse the rest of the server.
• Virtual users only: Logins are served from a compact PureDB database mapped to a single unprivileged system account, so no real system account is ever exposed over FTP.
• No known bootstrap credential: The stock package ships no usable login. Credentials are generated uniquely per instance at first boot.

## Network and Deployment on AWS

The server listens on the standard FTP control port 21 and uses a defined passive data port range (30000-30009). Open these ports in your EC2 Security Group and scope inbound rules to your client addresses. Place the instance in a private subnet for extra isolation and attach EBS storage as needs grow. The file store lives on a dedicated data volume.

Retrieve the generated FTP user, password and host from the root-owned credentials file, then connect with any FTPS-capable client - lftp, curl, FileZilla or WinSCP - using explicit TLS.

## Extending the Server

The configuration lives in readable files under /etc/pure-ftpd with cloudimg helper tools (pureftpd-adduser, pureftpd-listusers) around the standard pure-pw virtual-user manager. There is no web console. You can add more virtual users, set per-user quotas and bandwidth limits, and install your own TLS certificate.

## Guided Setup and Next Steps

After purchase, cloudimg engineers can walk you through virtual users, directory layout, quotas, passive mode and firewall design, and TLS certificate management. Contact our 24/7 support team to schedule a guided setup session.

All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.