Creating and managing FTP accounts

Why Do We Need an FTP Account and What Problems Does It Solve?

Imagine you have an e-commerce site with tens of thousands of files and you want a graphic designer to only have access to the images folder, or a developer to be able to edit template files but not have access to the database. In such cases, giving full cPanel or SSH access to all colleagues is a major security risk. The standard solution is to create an FTP account with restricted access.

With an FTP account, you can:

• Limit each user's access precisely to a specific folder (e.g., public_html/images).
• Configure write, read, or delete permissions for files individually.
• Delete the account without affecting other users when collaboration ends.
• Control traffic and the number of uploaded files (if needed).

In this article, we assume you are using Linux hosting with cPanel or DirectAdmin control panel. If you have received hosting services from ServerNet, these steps are exactly applicable in your hosting management environment.

Creating an FTP Account Restricted to a Folder (Step by Step)

Step 1: Log into the Control Panel and Find the FTP Section

Log into cPanel or DirectAdmin. In cPanel, look for the Files section and click on FTP Accounts. In DirectAdmin, find the FTP Management option in the main menu.

Step 2: Configure the New Account

Fill out the new account creation form carefully. The most important part is specifying the Directory. Suppose you want to create an account to manage the public_html/downloads folder:

• Log in: Enter the username (e.g., downloads_user).
• Password: Choose a strong password with a combination of uppercase letters, lowercase letters, numbers, and symbols. Do not use repeated passwords.
• Directory: This is the most important part. Enter the full path: /home/username/public_html/downloads. Note that username is your main hosting account username.
• Quota (optional): If you want to limit the disk space this user can use, enter the amount in megabytes. For example, 500 means a maximum of 500 megabytes.

Then click the Create FTP Account button.

Step 3: Test the Connection and Check Access

Test the connection using an FTP client like FileZilla or Cyberduck. Enter the following information:

• Host: The IP address or domain of the site (e.g., ftp.yourdomain.com or 192.168.1.100)
• Username: The full username (in cPanel, it is usually in the form username@domain.com)
• Password: The set password
• Port: 21 (default)

After connecting, verify that the user only sees the contents of the downloads folder and cannot access higher-level folders (e.g., public_html or home). If they can access higher-level folders, the path was set incorrectly.

Managing Permissions and Advanced Settings

Changing Passwords and Security Restrictions

To change the password of an existing FTP account, go back to the FTP Accounts section. Next to the username, click the Change Password option. It is recommended to change passwords every 3 months.

You can also apply additional restrictions via SSH (if you have root access). For example, by editing the /etc/vsftpd/vsftpd.conf file, you can enable the chroot_local_user=YES option to prevent users from leaving their home directory. However, in shared hosting, cPanel usually does this automatically.

Managing Multiple FTP Accounts Simultaneously

If you have several colleagues, create a separate account for each. Each account can point to a different folder. For example:

• developer1: Access to public_html/templates
• designer1: Access to public_html/images
• content_writer: Access to public_html/blog

This ensures that if one account is compromised, the damage is limited to that specific folder.

Secure Deletion of an FTP Account and Complete Cleanup

Steps to Delete an Account

When a colleague leaves the project or no longer needs access, you should delete the account. Steps:

1. Go to the FTP Accounts section.
2. Next to the desired username, click the Delete option.
3. In the confirmation window, click Delete.

Note: Deleting an FTP account does not delete the files inside the folder. It only removes the user's access. If you also want to delete the files uploaded by that user, you must do so manually.

Common Mistake: Forgetting to Delete Old Accounts

Many site administrators do not delete FTP accounts after collaboration ends. This is a serious security risk. An old FTP account can be a way to infiltrate the site. Always delete the account after the project is finished and update the passwords of all active accounts.

Troubleshooting Common FTP Account Issues

Issue: Cannot Access the Desired Folder

If the FTP user cannot connect to the specified folder, check the following:

• Have you entered the folder path exactly according to the hosting structure? (Usually starts with /home/username/)
• Does the target folder exist? If not, create it first via File Manager.
• Check the folder permissions. The folder must have at least 755 permissions for the FTP user to enter.

Issue: Error 530 Authentication failed

This error is usually due to a mistake in the username or password. In cPanel, the full username is typically in the form mainuser@domain.com. In DirectAdmin, it might be just mainuser_ftpuser. Make sure to use the correct format.

Issue: Connection Succeeds but Cannot Upload Files

If the user can log in but cannot upload files, the folder permissions are likely incorrect. The target folder should have 755 or 775 permissions. Also, ensure that the set quota is not full.

Final Security Tips for Managing FTP Accounts

• Use Secure FTP (SFTP/FTPS): If your control panel supports SFTP, be sure to use it. SFTP encrypts traffic and is more secure.
• Enable Logging: In cPanel, you can enable FTP logs to see who uploaded or deleted which file. This helps with troubleshooting.
• IP Restriction: If your colleagues use static IPs, you can restrict FTP access to specific IPs only. This is possible through the firewall or cPanel settings.
• Avoid Using FTP for Sensitive File Transfers: FTP is not encrypted by default. For transferring sensitive files like banking information, use SFTP or HTTPS.

By following these tips, you can use your FTP account securely and efficiently and manage colleague access precisely. If you need further guidance, the ServerNet support team is ready to assist you.