centos 中的vsftpd 配置

2018/12/23 10:59
阅读数 7

一、安装vsftpd

1.1 检查系统是否已经安装过vsftpd了

1 [root@localhost /]# rpm -aq vsftpd

如果返回结果显示:

1 vsftpd-3.0.2-21.el7.x86_64
#此处是查找vsftpd的返回结果

如果提示已安装,但是你之前配置错了,不知道怎么搞,那么进行1.2步骤

 

1.2 卸载系统目前的vsftpd

 停止vsftpd运行:

1 [root@localhost /]# /sbin/service vsftpd stop

卸载vsftpd

1 [root@localhost /]# rpm -e vsftpd-3.0.2-21.el7.x86_64

此时系统会返回以下信息

1 warning: /etc/vsftpd/vsftpd.conf saved as /etc/vsftpd/vsftpd.conf.rpmsave

接下来直接把上步(系统返回的提示信息)没卸载干净的东西删除

1 rm -rf /etc/vsftpd/vsftpd.conf.rpmsave

1.3 验证vsftpd是否卸载干净

1 [root@localhost /]# /sbin/service vsftpd stop
2 Redirecting to /bin/systemctl stop  vsftpd.service
3 Failed to stop vsftpd.service: Unit vsftpd.service not loaded. #找不到vsftpd
4 [root@localhost /]# /sbin/service vsftpd start
5 Redirecting to /bin/systemctl start  vsftpd.service
6 Failed to start vsftpd.service: Unit not found. #找不到vsftpd

1.4 安装vsftpd

1 [root@localhost /]# yum -y install vsftpd

1.5 启动vsftpd

1 [root@localhost home]# systemctl start vsftpd.service

或者

1 [root@localhost home]# service vsftpd restart

1.6 开放端口

1 [root@localhost /]# firewall-cmd --zone=public --add-port=21/tcp --permanent
2 [root@localhost /]# firewall-cmd --reload

注意ftp是21端口,sftp是22端口,也可以自己配置,但是到这一步,我们只需要了解就行,我们接着配置吧

 

二、分配用户

2.1 在你的linux上新建一个用户,只用来ftp不用来登录服务器

1 useradd Marry -s /sbin/nologin -d /var/ftp

上面的意思是,新建一个不用来登录服务器的用户,Marry,并设置他的ftp空间为/var/ftp 目录下。

接下来配置用户Marry的密码:

1 passwd Marry  #给Marry用户设置密码

接下来按照提示输入你的密码就好

回过头来,说明下上面两个命令的意思

1 /* useradd 使用到3个参数:用户名,-s,-d,三个参数位置可以变动
2 
3    Marry是用户名 
4 
5   -d 后面跟的是我们要给予Marry的家目录
6 
7 */

2.2 设置上面新建用户对文件夹的操作权限

修改/var/ftp的权限为不可写 

1 [root@localhost vsftpd]# chmod a-w /var/ftp/

这是因为我们在上面将/home/ftpuser/taotao文件的权限改为不可写了,那么我们在这个目录下创建一个images文件夹,用来上传文件。并将权限赋值给 ftpuser 用户

 

三、vsftpd配置

3.1 限制系统用户锁定在/home/ftpuser目录

 如果设置为

chroot_local_user=YES
chroot_list_enable=YES(这行可以没有, 也可以有)
chroot_list_file=/etc/vsftpd.chroot_list
那么, 凡是加在文件vsftpd.chroot_list中的用户都是不受限止的用户
即, 可以浏览其主目录的上级目录.

所以, 如果不希望某用户能够浏览其主目录上级目录中的内容,可以如上设置, 然后在
文件vsftpd.chroot_list中不添加该用户即可(此时, 在该文件中的用户都是可以浏览其主目录之外的目录的).
或者, 设置如下
chroot_local_user=NO
chroot_list_enable=YES(这行必须要有, 否则文件vsftpd.chroot_list不会起作用)
chroot_list_file=/etc/vsftpd.chroot_list
然后把所有不希望有这种浏览其主目录之上的各目录权限的用户添加到文件vsftpd.chroot_list(此时, 在该文件中的用户都是不可以浏览其主目录之外的目录的)
中即可(一行一个用户名).

[root@localhost vsftpd]# vim /etc/vsftpd/vsftpd.conf

这里有两种方案,我采用第二种,配置如下:

chroot_local_user=NO
chroot_list_enable=YES #(这行必须要有, 否则文件vsftpd.chroot_list不会起作用)
chroot_list_file=/etc/vsftpd/chroot_list

默认chroot_list是不存在的

[root@localhost vsftpd]# vim /etc/vsftpd/chroot_list

然后加入 ftpuser ,表示只有ftpuser不能访问上级目录,重启vsftpd。



3.2 开启PASV(被动模式)

在 /etc/vsftpd/vsftpd.conf 的最下面加入

1 pasv_enable=YES
2 pasv_min_port=30000
3 pasv_max_port=30999

(提示:如果你处于被动模式,发现登陆上了但是,无法上下载数据,并且提示,无法显示,可能是你防火墙的端口没开,还有你的端口

pasv_min_port是最小的端口,
pasv_max_port是最大的端口,不要写错了,还有,端口开了,要重启防火墙才能生效

并且在userlist_enable=YES文件后面添加 

1 userlist_deny=NO
2 userlist_file=/etc/vsftpd/user_list

开启防火墙:

[root@localhost taotao]# firewall-cmd --zone=public --add-port=30000-30999/tcp --permanent 
[root@localhost taotao]# firewall-cmd --reload

 

 3.3 添加用户到

添加用户到chroot_list,等几个文件中

四、最终的vsftpd.conf 文件的配置内容如下:

sz /etc/vsftpd/vsftpd.conf

  1 # Example config file /etc/vsftpd/vsftpd.conf
  2 #
  3 # The default compiled in settings are fairly paranoid. This sample file
  4 # loosens things up a bit, to make the ftp daemon more usable.
  5 # Please see vsftpd.conf.5 for all compiled in defaults.
  6 #
  7 # READ THIS: This example file is NOT an exhaustive list of vsftpd options.
  8 # Please read the vsftpd.conf.5 manual page to get a full idea of vsftpd's
  9 # capabilities.
 10 #
 11 # Allow anonymous FTP? (Beware - allowed by default if you comment this out).
 12 anonymous_enable=YES
 13 #
 14 # Uncomment this to allow local users to log in.
 15 # When SELinux is enforcing check for SE bool ftp_home_dir
 16 local_enable=YES
 17 #
 18 # Uncomment this to enable any form of FTP write command.
 19 write_enable=YES
 20 #
 21 # Default umask for local users is 077. You may wish to change this to 022,
 22 # if your users expect that (022 is used by most other ftpd's)
 23 local_umask=022
 24 #
 25 # Uncomment this to allow the anonymous FTP user to upload files. This only
 26 # has an effect if the above global write enable is activated. Also, you will
 27 # obviously need to create a directory writable by the FTP user.
 28 # When SELinux is enforcing check for SE bool allow_ftpd_anon_write, allow_ftpd_full_access
 29 #anon_upload_enable=YES
 30 #
 31 # Uncomment this if you want the anonymous FTP user to be able to create
 32 # new directories.
 33 #anon_mkdir_write_enable=YES
 34 #
 35 # Activate directory messages - messages given to remote users when they
 36 # go into a certain directory.
 37 dirmessage_enable=YES
 38 #
 39 # Activate logging of uploads/downloads.
 40 xferlog_enable=YES
 41 #
 42 # Make sure PORT transfer connections originate from port 20 (ftp-data).
 43 connect_from_port_20=YES
 44 #
 45 # If you want, you can arrange for uploaded anonymous files to be owned by
 46 # a different user. Note! Using "root" for uploaded files is not
 47 # recommended!
 48 #chown_uploads=YES
 49 #chown_username=whoever
 50 #
 51 # You may override where the log file goes if you like. The default is shown
 52 # below.
 53 #xferlog_file=/var/log/xferlog
 54 #
 55 # If you want, you can have your log file in standard ftpd xferlog format.
 56 # Note that the default log file location is /var/log/xferlog in this case.
 57 xferlog_std_format=YES
 58 #
 59 # You may change the default value for timing out an idle session.
 60 #idle_session_timeout=600
 61 #
 62 # You may change the default value for timing out a data connection.
 63 data_connection_timeout=120
 64 #
 65 # It is recommended that you define on your system a unique user which the
 66 # ftp server can use as a totally isolated and unprivileged user.
 67 #nopriv_user=ftpsecure
 68 #
 69 # Enable this and the server will recognise asynchronous ABOR requests. Not
 70 # recommended for security (the code is non-trivial). Not enabling it,
 71 # however, may confuse older FTP clients.
 72 #async_abor_enable=YES
 73 #
 74 # By default the server will pretend to allow ASCII mode but in fact ignore
 75 # the request. Turn on the below options to have the server actually do ASCII
 76 # mangling on files when in ASCII mode. The vsftpd.conf(5) man page explains
 77 # the behaviour when these options are disabled.
 78 # Beware that on some FTP servers, ASCII support allows a denial of service
 79 # attack (DoS) via the command "SIZE /big/file" in ASCII mode. vsftpd
 80 # predicted this attack and has always been safe, reporting the size of the
 81 # raw file.
 82 # ASCII mangling is a horrible feature of the protocol.
 83 ascii_upload_enable=YES
 84 ascii_download_enable=YES
 85 #
 86 # You may fully customise the login banner string:
 87 ftpd_banner=Welcome to blah FTP service.
 88 #
 89 # You may specify a file of disallowed anonymous e-mail addresses. Apparently
 90 # useful for combatting certain DoS attacks.
 91 #deny_email_enable=YES
 92 # (default follows)
 93 #banned_email_file=/etc/vsftpd/banned_emails
 94 #
 95 # You may specify an explicit list of local users to chroot() to their home
 96 # directory. If chroot_local_user is YES, then this list becomes a list of
 97 # users to NOT chroot().
 98 # (Warning! chroot'ing can be very dangerous. If using chroot, make sure that
 99 # the user does not have write access to the top level directory within the
100 # chroot)
101 chroot_local_user=YES
102 chroot_list_enable=YES
103 # (default follows)
104 chroot_list_file=/etc/vsftpd/chroot_list
105 #
106 # You may activate the "-R" option to the builtin ls. This is disabled by
107 # default to avoid remote users being able to cause excessive I/O on large
108 # sites. However, some broken FTP clients such as "ncftp" and "mirror" assume
109 # the presence of the "-R" option, so there is a strong case for enabling it.
110 ls_recurse_enable=YES
111 #
112 # When "listen" directive is enabled, vsftpd runs in standalone mode and
113 # listens on IPv4 sockets. This directive cannot be used in conjunction
114 # with the listen_ipv6 directive.
115 listen=YES
116 #
117 # This directive enables listening on IPv6 sockets. By default, listening
118 # on the IPv6 "any" address (::) will accept connections from both IPv6
119 # and IPv4 clients. It is not necessary to listen on *both* IPv4 and IPv6
120 # sockets. If you want that (perhaps because you want to listen on specific
121 # addresses) then you must run two copies of vsftpd with two configuration
122 # files.
123 # Make sure, that one of the listen options is commented !!
124 #listen_ipv6=YES
125 
126 pam_service_name=vsftpd
127 userlist_enable=YES
128 userlist_deny=NO
129 local_root=/var/public_home
130 tcp_wrappers=YES
131 use_localtime=YES
132 allow_writeable_chroot=YES
133 pasv_enable=YES
134 pasv_min_port=7666
135 pasv_max_port=7700

 

sz /etc/vsftpd/chroot_list

1 Bob
2 porter

 

 sz /etc/vsftpd/user_list 

 1 # vsftpd userlist
 2 # If userlist_deny=NO, only allow users in this file
 3 # If userlist_deny=YES (default), never allow users in this file, and
 4 # do not even prompt for a password.
 5 # Note that the default vsftpd pam config also checks /etc/vsftpd/ftpusers
 6 # for users that are denied.
 7 Bob
 8 porter
 9 root
10 bin
11 daemon
12 adm
13 lp
14 sync
15 shutdown
16 halt
17 mail
18 news
19 uucp
20 operator
21 games
22 nobody

 

sz /etc/vsftpd/ftpusers

 1 # Users that are not allowed to login via ftp
 2 root
 3 bin
 4 daemon
 5 adm
 6 lp
 7 sync
 8 shutdown
 9 halt
10 mail
11 news
12 uucp
13 operator
14 games
15 nobody

 

之一FTP上传,第一次可以用“”“FlashFXP 5”,这个挺好用的

 参考链接:

系统的配置(整个,包括新建用户,权限,vsftp安装)

详细的vsftpd配置详解(vsftp.conf)

简单的配置(权限)

 

展开阅读全文
打赏
0
0 收藏
分享
加载中
更多评论
打赏
0 评论
0 收藏
0
分享
返回顶部
顶部