If you cannot configure a web server properly, your company's website will be unreachable to customers, costing thousands in lost revenue, and you will fail the LPIC-2 exam question. Web and FTP services are the backbone of how files and web pages travel across the internet. For LPIC-2, you must know how to set up Apache HTTPD and vsftpd from scratch, secure them, and troubleshoot why a browser says 'Connection refused'.
Jump to a section
A simple way to picture Web and FTP Services Configuration
Your friend is moving into a new flat and has 14 boxes to transport. You have two choices: you can drive the truck yourself, making 14 trips back and forth, carrying one box each time. That is slow and wastes fuel. Or, your friend can give you the key to their flat, you load all 14 boxes into the truck in one go, drive once, and unload them all at the destination. That is faster and more efficient. The first method is like the Trivial File Transfer Protocol (TFTP) — it sends one small file at a time, with no security or error checking, and works only for simple, quick jobs. The second method is like the File Transfer Protocol (FTP) — it opens a single control connection to give instructions and then, for each file transfer, opens separate data connections to move the actual files. FTP handles multiple files in one session, uses usernames and passwords for basic authentication, and can resume interrupted downloads. In the same way a moving truck uses the key to access the flat directly, FTP uses a control channel to authenticate and manage the transfer, then data channels to move the cargo. The crucial difference is that the truck (FTP) is designed for organised, batch transports, whereas the single-trip car (TFTP) is only for tiny, local moves.
The 14 boxes represent your files. The truck's key is the FTP control connection. The single trips are the data connections. When you configure FTP services on a Linux server, you are setting up the rules for how your server will accept that key and how many trucks can park at once. The default FTP service on a Linux system is called vsftpd (Very Secure FTP Daemon). You configure it by editing files like /etc/vsftpd/vsftpd.conf. Every setting you change — like anonymous_enable=YES or local_enable=YES — decides who gets a key to the flat and how many boxes they can move at once.
Let us start with the web server. A web server is a program that runs on a computer (the server) and waits for requests from browsers (clients). The most common web server on Linux is Apache HTTPD, often just called 'Apache'. When you type 'https://www.example.com' into your browser, your browser sends a request to the server where that website lives. The server's job is to find the correct file (like index.html) and send it back to your browser. The browser then renders that file as a webpage.
How does Apache work? Apache listens on a specific network port. Ports are like numbered doors on a computer. Port 80 is the default door for unencrypted web traffic (HTTP). Port 443 is for encrypted web traffic (HTTPS). When Apache starts, it opens those doors and waits. When a request arrives, Apache looks at its configuration file (usually /etc/httpd/conf/httpd.conf on Red Hat systems or /etc/apache2/apache2.conf on Debian systems) to decide what to do. The configuration file contains 'directives' — instructions like 'DocumentRoot /var/www/html', which tells Apache the folder where your website files are stored.
You can also host multiple websites on one server using 'Virtual Hosts'. A Virtual Host is a block in the configuration file that says 'When someone asks for siteA.com, serve files from this folder. When someone asks for siteB.com, serve files from a different folder.' Apache supports two types: name-based (most common, uses the domain name in the request) and IP-based (uses the server's IP address).
Now, let us talk about FTP services. FTP stands for File Transfer Protocol. It is an older protocol designed to move files between computers on a network. FTP uses two separate connections: one for sending commands (the control connection, usually on port 21) and another for transferring the actual file data (the data connection). There are two modes for the data connection:
Active mode: The client tells the server 'I am listening on this port, connect to me.' The server then initiates the data connection back to the client. This often fails if the client is behind a firewall because the firewall blocks the incoming connection.
Passive mode: The server tells the client 'I am listening on this port, you connect to me.' The client initiates the data connection. This works better through firewalls and is the default in most modern FTP clients.
On Linux, the most commonly used FTP server is vsftpd (Very Secure FTP Daemon). Its main configuration file is /etc/vsftpd/vsftpd.conf. Key settings include:
anonymous_enable=YES: Allows anyone to log in without a password (usually only for downloading public files).
local_enable=YES: Allows users with accounts on the server to log in using their username and password.
write_enable=YES: Allows users to upload files to the server.
chroot_local_user=YES: Restricts a user to their home directory, so they cannot see other parts of the server's file system.
FTP sends all data, including usernames and passwords, in plain text. That means anyone snooping on the network can read your credentials. For secure transfers, you should use FTPS (FTP over SSL/TLS) or SFTP (SSH File Transfer Protocol), but those are different protocols. LPIC-2 tests FTP configuration specifically, so you must know how to edit vsftpd.conf to toggle these settings.
For the web server part, you also need to understand 'modules'. Apache is modular — you can add or remove features by enabling or disabling modules. For example, mod_ssl enables HTTPS encryption, mod_rewrite allows you to change URLs dynamically, and mod_proxy makes Apache act as a gateway to other servers. You enable modules with commands like 'a2enmod ssl' on Debian-based systems.
Finally, both services must be started and set to run on boot. On systemd-based Linux systems (which is nearly all modern distributions), you use:
systemctl start httpd (to start Apache)
systemctl enable httpd (to make it start at boot)
systemctl start vsftpd
systemctl enable vsftpd
And you check their status with 'systemctl status httpd' or 'systemctl status vsftpd'. If something is wrong, the status output often tells you exactly what failed.
Install the Apache web server
Use your package manager to install Apache HTTPD. On Red Hat/CentOS/Fedora, the package is called 'httpd' and you install it with 'yum install httpd' or 'dnf install httpd'. On Debian/Ubuntu, the package is 'apache2' and you install it with 'apt install apache2'. This step puts the Apache binary and default configuration files onto your system.
Configure a Virtual Host for your website
Create a new configuration file in the appropriate directory (on Red Hat, it's /etc/httpd/conf.d/; on Debian, it's /etc/apache2/sites-available/). Inside the file, write a <VirtualHost> block that specifies the ServerName (your domain), DocumentRoot (the folder with your website files), and any Directory permissions. This tells Apache which requests go to which site.
Enable the site and restart Apache
On Debian systems, run 'a2ensite yoursite.conf' to symlink the site from sites-available to sites-enabled, then 'systemctl reload apache2'. On Red Hat systems, just restart httpd with 'systemctl restart httpd'. This step makes Apache read the new configuration. If you skip the restart, the changes do not take effect.
Install and configure vsftpd for FTP access
Install vsftpd with your package manager ('yum install vsftpd' or 'apt install vsftpd'). Then edit /etc/vsftpd/vsftpd.conf. Set anonymous_enable=NO, local_enable=YES, write_enable=YES, and chroot_local_user=YES. Adjust timeouts for large file transfers. This configuration allows local users to upload files securely while restricting them to their home directories.
Start services and test access
Run 'systemctl start vsftpd' and 'systemctl enable vsftpd' to start the FTP service and ensure it restarts on boot. Then test from a client: open a browser and type the server's IP or domain to see the Apache test page or your website. Use an FTP client like FileZilla to test logging in with a local user account and uploading a file. Check /var/log/vsftpd.log for any errors.
Secure the services with firewall rules
Configure the firewall to allow traffic on port 80 (HTTP), 443 (HTTPS if you enable mod_ssl), and 21 (FTP). For passive FTP, also open a range of high ports (e.g., 30000-31000) and set pasv_min_port and pasv_max_port in vsftpd.conf. On Red Hat, use firewall-cmd; on Debian, use ufw. This prevents the services from being unreachable from outside the server.
Imagine you work for a small media company called 'PixelPress'. You have just been hired as the junior system administrator. Your boss says, 'We need to launch our new website, and our video editors need a place to upload large video files from their remote laptops to the office server.' Your job is to set up both Apache and vsftpd on a single Linux server.
First, you log into the server via SSH. You install Apache using your package manager. On a Red Hat-based system, you run 'yum install httpd'. On Debian-based, 'apt install apache2'. You then verify the installation by opening a browser and typing the server's IP address — you should see the default Apache test page.
Next, you configure the website. Your boss gives you the domain name 'pixelpress.com'. You create a new directory: /var/www/pixelpress. Inside that, you place an index.html file with the company's landing page. Then you edit the Apache configuration to add a Virtual Host. You create a file called pixelpress.conf in /etc/httpd/conf.d/ on Red Hat, or /etc/apache2/sites-available/ on Debian. The file looks like this:
<VirtualHost *:80> ServerName pixelpress.com DocumentRoot /var/www/pixelpress </VirtualHost>
You enable the site. On Debian, you run 'a2ensite pixelpress.conf'. On Red Hat, you just need to restart Apache. You restart Apache with 'systemctl restart httpd'. Now, when anyone types pixelpress.com, Apache serves the files from the pixelpress folder.
Now for the FTP part. The video editors need to upload their files. You install vsftpd with 'yum install vsftpd' or 'apt install vsftpd'. You then edit the configuration file at /etc/vsftpd/vsftpd.conf. You set:
anonymous_enable=NO (you do not want strangers uploading files)
local_enable=YES
write_enable=YES
chroot_local_user=YES (so each video editor stays in their own home folder)
You create user accounts for each video editor with 'useradd' and 'passwd'. You start vsftpd with 'systemctl start vsftpd' and enable it with 'systemctl enable vsftpd'.
Now a problem occurs. A video editor calls you and says, 'I can connect to the FTP server, but when I try to upload a 2GB file, it fails halfway through.' You check the vsftpd log file at /var/log/vsftpd.log. You see an error about 'timeout'. You realise the default timeout settings in vsftpd.conf are too low for large files. You edit the file and increase:
data_connection_timeout=600 (10 minutes instead of default 300)
idle_session_timeout=1200 (20 minutes)
You restart vsftpd. The editor tries again, and the upload succeeds. The next day, your boss asks you to add HTTPS support to the website. You install the mod_ssl module, generate a self-signed certificate, and update the Virtual Host to listen on port 443. Now the site is accessible via https://pixelpress.com.
In a real IT job, you will also need to configure firewalls (firewalld or iptables) to allow traffic on ports 80, 443, and 21 (FTP). And you will need to monitor disk space to ensure the FTP uploads do not fill up the server.
The LPIC-2 exam objective 201.4 directly tests your ability to configure Apache HTTPD and vsftpd. The exam questions are almost entirely based on editing configuration files and understanding what each directive does. There are no GUI tools on the exam — you must know the text-based configuration.
For Apache, the exam focuses on:
Virtual Host configuration: You will be given a scenario with multiple websites. You must know how to write a Virtual Host block, including ServerName, DocumentRoot, and Directory directives. Traps: They might ask you what happens when two Virtual Hosts match the same request (the first one defined wins). They might give you a configuration where ServerName is missing and ask what Apache does (it uses the first Virtual Host as the default).
The difference between IP-based and name-based Virtual Hosts: Know that name-based uses the Host header from the browser.
Access control with Directory directives: You will see <Directory /var/www/html> blocks with 'Require all granted' or 'Require ip 192.168.1.0/24'. Know which one allows or denies access.
Modules: You need to know the common ones — mod_ssl, mod_rewrite, mod_proxy, mod_userdir — and what they do. A typical question: 'Which module must be enabled to allow Apache to serve HTTPS traffic?' Answer: mod_ssl.
Configuration file locations: On Red Hat systems, the main config is /etc/httpd/conf/httpd.conf. On Debian, it is /etc/apache2/apache2.conf. Know which distribution uses which path.
For vsftpd, the exam focuses on:
The main configuration file /etc/vsftpd/vsftpd.conf.
Key directives: anonymous_enable, local_enable, write_enable, chroot_local_user, anon_upload_enable, anon_mkdir_write_enable. Traps: They might set anonymous_enable=YES but forget to set anon_upload_enable=YES — then anonymous uploads will be silently ignored.
Passive vs active mode: Know that passive mode (pasv_enable=YES) is the default and works through firewalls. A trap could be the system administrator sets pasv_min_port and pasv_max_port but forgets to open those ports in the firewall.
Security concerns: FTP sends passwords in plain text. The exam may ask 'Which configuration change would reduce the risk of credential sniffing?' Answer: Use FTPS by enabling ssl_enable=YES and providing certificate files.
chroot jails: The exam loves chroot_local_user=YES. They might ask what happens if a user is chrooted and tries to access /etc/passwd (they cannot, because they are locked in their home directory).
Common exam traps:
A question presents a configuration file with a typo, like 'anonumous_enable=YES'. The candidate who memorises the exact spelling will spot the mistake. Others will not.
They give you output from 'netstat -tulpn' showing that nothing is listening on port 21, and ask why FTP is not working. The answer is that vsftpd is not running.
They ask you to restart the service after making configuration changes. The correct command is 'systemctl restart vsftpd' or 'systemctl reload httpd' (reload applies changes without dropping connections).
To memorise: The directive names are case-sensitive, must be typed exactly as shown, and most are boolean (YES/NO). The default for many security-sensitive options like anonymous_enable is NO, but you should verify by reading the config file.
Apache HTTPD's main configuration file is /etc/httpd/conf/httpd.conf on Red Hat systems and /etc/apache2/apache2.conf on Debian systems.
Virtual Hosts allow one Apache server to host multiple websites, distinguished by the ServerName directive.
FTP uses two connections: a control connection on port 21 and a data connection on port 20 (active mode) or a random high port (passive mode).
vsftpd's configuration file is /etc/vsftpd/vsftpd.conf; key settings include anonymous_enable, local_enable, write_enable, and chroot_local_user.
FTP transmits all data, including credentials, in plain text; for security, enable FTPS with ssl_enable=YES or use SFTP instead.
After changing any configuration file for Apache or vsftpd, you must restart or reload the service using systemctl restart or systemctl reload for changes to take effect.
Passive FTP mode (pasv_enable=YES) is the default and works through firewalls, but you must configure pasv_min_port and pasv_max_port to open a range of ports for data connections.
Apache modules like mod_ssl, mod_rewrite, and mod_proxy extend functionality; you enable them with commands like a2enmod on Debian or by editing the config file on Red Hat.
These come up on the exam all the time. Here's how to tell them apart.
Apache HTTPD
Serves web pages and files via HTTP/HTTPS on ports 80 and 443.
Configuration file is /etc/httpd/conf/httpd.conf (Red Hat) or /etc/apache2/apache2.conf (Debian).
Supports Virtual Hosts to host multiple websites on a single server.
vsftpd
Transfers files via FTP on control port 21 and data ports (20 or passive range).
Configuration file is /etc/vsftpd/vsftpd.conf on both Red Hat and Debian systems.
Supports different user types (anonymous, local, virtual) but not Virtual Hosts.
Active FTP Mode
Client opens a random port and tells the server to connect back to it for data.
Often blocked by client-side firewalls because the server initiates the connection.
Uses port 20 for data from the server side.
Passive FTP Mode
Server opens a random port (within a configurable range) and tells the client to connect to it for data.
Works through most firewalls because the client initiates both connections.
Uses ports defined by pasv_min_port and pasv_max_port in vsftpd.conf.
HTTP (Port 80)
Data is transmitted in plain text, readable by anyone intercepting the network.
No SSL/TLS certificate required.
Faster than HTTPS because no encryption overhead.
HTTPS (Port 443)
Data is encrypted using SSL/TLS, preventing eavesdropping.
Requires an SSL certificate (self-signed or from a Certificate Authority).
Slightly slower due to encryption/decryption overhead.
Red Hat Family (RHEL/CentOS/Fedora)
Apache package name is httpd.
Main config file: /etc/httpd/conf/httpd.conf.
Virtual Host configs are placed in /etc/httpd/conf.d/ and enabled by default.
Debian Family (Debian/Ubuntu)
Apache package name is apache2.
Main config file: /etc/apache2/apache2.conf.
Virtual Host configs are in /etc/apache2/sites-available/ and must be enabled with a2ensite.
Mistake
FTP is secure because it requires a username and password.
Correct
FTP sends usernames and passwords in plain text over the network, making them easy to intercept. It is not secure unless encrypted with SSL/TLS (FTPS) or replaced with SFTP.
People confuse 'having authentication' with 'having encryption'. Many protocols use passwords but send them insecurely.
Mistake
If I set chroot_local_user=YES, the user cannot write files to their home directory.
Correct
chroot_local_user restricts the user to their home directory but does not prevent writing. You still need write_enable=YES to allow uploads.
Beginners think 'chroot' means 'read-only', but chroot just changes the root directory view; permissions are controlled separately.
Mistake
Apache's default DocumentRoot is the same on all Linux distributions.
Correct
On Red Hat systems, the default DocumentRoot is /var/www/html. On Debian systems, it is /var/www/html as well, but the configuration files are in /etc/apache2/ instead of /etc/httpd/.
Beginners often use one distribution for study and assume all others work identically. LPIC-2 tests both major families (Red Hat and Debian).
Mistake
You need to open port 21 in the firewall for FTP to work in passive mode.
Correct
You need to open port 21 for the control connection AND a range of high-numbered ports for the data connections (defined by pasv_min_port and pasv_max_port). If you only open port 21, passive transfers will fail.
People forget that FTP uses a second set of ports for actual data transfer. They think 'port 21 = FTP' covers everything.
Mistake
If Apache is running, any website hosted on it is automatically accessible from the internet.
Correct
Apache may be running, but the website might not be accessible if the Virtual Host is misconfigured, the firewall blocks the port, or the Service Name (ServerName) does not match the DNS entry.
Beginners think 'service running' equals 'website working'. There are multiple layers (network, DNS, configuration) that can fail independently.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
HTTP uses port 80 and sends data in plain text. HTTPS uses port 443 and encrypts the data with SSL/TLS. To enable HTTPS, you must enable the mod_ssl module, obtain an SSL certificate, and configure a VirtualHost that listens on port 443 with the SSLEngine directive.
This usually means the FTP client is in active mode but the server cannot connect back to the client because of a firewall. Switch your client to passive mode (PASV). On the server, ensure pasv_enable=YES and that the passive port range (pasv_min_port and pasv_max_port) is open in the firewall.
Set anonymous_enable=YES, anon_upload_enable=YES, and anon_mkdir_write_enable=YES in /etc/vsftpd/vsftpd.conf. You must also ensure the anonymous FTP directory (usually /var/ftp/) is writable by the anonymous user. This is very insecure and should only be used in isolated test environments.
DocumentRoot tells Apache which directory on the server's file system contains the website files. For example, DocumentRoot /var/www/html means that when someone requests the homepage, Apache looks for the index file in /var/www/html. If you host multiple sites, each Virtual Host has its own DocumentRoot.
Edit the Listen directive in the main configuration file (httpd.conf or apache2.conf). For example, 'Listen 8080' tells Apache to listen on port 8080 instead of the default port 80. You must also update your Virtual Host to match the new port and open the port in the firewall.
FTP is the File Transfer Protocol that uses two separate connections and sends data in plain text. SFTP is the SSH File Transfer Protocol, which runs over an SSH connection (port 22) and encrypts everything. SFTP is more secure and does not require separate configuration for passive mode. LPIC-2 tests FTP specifically, not SFTP.
You've finished Web and FTP Services Configuration. Continue through the LPIC-2 study guide to build a complete picture of the exam.
Done with this chapter?