FTP configuration for WordPress

2 Views

I’ve installed a WordPress instance on a Linux server, and I need to give it FTP access in order to install plugins and execute automatic backup/restores. I’ve just installed vsftpd, and started the service, but now what?

  • How do I figure out/set what the username/pass is?
  • Should I allow anonymous access?
  • Is the hostname just ‘localhost’?

Any advice would be appreciated. I’ve never messed with FTP on linux before. Thanks-

Post Views: 2

Related posts

Leave a Reply

3 comments

  1. Your question is a little unclear because you don’t specify what aspect of wordpress “wants” FTP access. If you got WP installed, you clearly have at least some access to the machine already. That said, I’ll try to answer around that inclarity.

    Your questions in order, then some general thoughts:

    1. How do I figure out/set what the username/pass is?

    Remember that the man page for a program is a good first stop. A good man page will also contain a FILES or “SEE ALSO” section near the bottom that will point you to relevant config files.

    In this case, “man vsftpd” mentions /etc/vsftpd.conf, so you can then do “man vsftpd.conf” to get info on how to configure it.

    VSFTPD is configurable, and can allow users to log in in several ways. In the man page, check out “guest_enable” and “guest_username”, “local_enable” and “user_sub_token”.

    *The easiest route for your single user usage is probably configuring local_enable, then your username and password would be whatever it is in /etc/password.*

    1. Should I allow anonymous access?

    No. Since you’re using this to admin your WordPress, there’s no reason anyone else should be using this FTP. VSFTPD has this off by default.

    1. Is the hostname just ‘localhost’?

    Depends where you’re coming from. ‘localhost’ maps back to the loopback, or the same physical machine you’re on. So if you need to put ftp configuration information for Server A into a wordpress configuration file on Server A, then ‘localhost’ is perfectly acceptable. If you’re trying to configure the pasv_addr_resolve/pasv_addr flag of VSFTPD, then no, you’ll want to either pass in the fully qualified name of Server A (serverA.mydomain.com), or leave it off an rely on the IP address.

    EDIT: I actually forgot the critical disclaimer to never send credentials over plain FTP. Plain old FTP (meaning not SFTP) sends your username and password in cleartext. I didn’t install VSFTP and play with it, but you’ll want to make sure that there is some form of encryption happening when you connect. Try hitting it with WinSCP (from windows) or sftp (from linux) to make sure you’re getting an ecrypted SFTP, rather than plaintext FTP.

    Apologies if you already knew that 😉

  2. You would probably get better answers on server fault.

    That said:

    • vsftp should use your local users by default, and drop you in that user’s home directory on login.

    • disable anonymous access if you don’t need it, I don’t think wordpress will care but your server will be safer.

    • yes, or 127.0.0.1, or your public IP if you think you might split the front and back end some day.

  3. WordPress does not natively support SFTP. You can get around this two ways:

    1. chmod permissions in the appropriate directories to allow the normal, automatic update to work correctly. This is the approach most certain to work, as long as it doesn’t trip over any local security policies.
    2. Try hacking it in yourself. There have been any number of threads on this at the WordPress.org forums. Here is a recent one which is also talking about non-standard ports. Here is an article about how to try to get it working on Debian Lenny (which also addresses the non-standard port issue).