- 系统版本
- 安装 vsftpd
- 卸载 vsftpd
- vsftpd.conf 说明
系统版本
[root@shenfeng ~]# lsb_release -a
LSB Version: :core-4.1-amd64:core-4.1-noarch
Distributor ID: CentOS
Description: CentOS Linux release 7.3.1611 (Core)
Release: 7.3.1611
Codename: Core
[root@shenfeng ~]#
安装 vsftpd
- 查看是否已经安装vsftpd
# 方法1
[root@shenfeng ~]# rpm -q vsftpd
vsftpd-3.0.2-22.el7.x86_64
[root@shenfeng ~]#
#方法2
[root@shenfeng ~]# vsftpd -v
vsftpd: version 3.0.2
[root@shenfeng ~]#
- 如果没有安装
[root@shenfeng ~]# yum -y install vsftpd
已加载插件：fastestmirror
base | 3.6 kB 00:00:00
epel | 4.7 kB 00:00:00
extras | 3.4 kB 00:00:00
gitlab_gitlab-ee/x86_64/signature | 836 B 00:00:00
gitlab_gitlab-ee/x86_64/signature | 1.0 kB 00:00:00 !!!
gitlab_gitlab-ee-source/signature | 836 B 00:00:00
gitlab_gitlab-ee-source/signature | 951 B 00:00:00 !!!
mysql-connectors-community | 2.5 kB 00:00:00
mysql-tools-community | 2.5 kB 00:00:00
mysql56-community | 2.5 kB 00:00:00
updates | 3.4 kB 00:00:00
Loading mirror speeds from cached hostfile
正在解决依赖关系
--> 正在检查事务
---> 软件包 vsftpd.x86_64.0.3.0.2-22.el7 将被 安装
--> 解决依赖关系完成
依赖关系解决
============================================================================================================================================
Package 架构 版本 源 大小
============================================================================================================================================
正在安装:
vsftpd x86_64 3.0.2-22.el7 base 169 k
事务概要
============================================================================================================================================
安装 1 软件包
总下载量：169 k
安装大小：348 k
Downloading packages:
vsftpd-3.0.2-22.el7.x86_64.rpm | 169 kB 00:00:00
Running transaction check
Running transaction test
Transaction test succeeded
Running transaction
警告：RPM 数据库已被非 yum 程序修改。
正在安装 : vsftpd-3.0.2-22.el7.x86_64 1/1
验证中 : vsftpd-3.0.2-22.el7.x86_64 1/1
已安装:
vsftpd.x86_64 0:3.0.2-22.el7
完毕！
[root@shenfeng ~]#
- 查看位置
[root@shenfeng ~]# whereis vsftpd
vsftpd: /usr/sbin/vsftpd /etc/vsftpd /usr/share/man/man8/vsftpd.8.gz
[root@shenfeng ~]#
- 修改配置 vim /etc/vsftpd/vsftpd.conf
- 不允许匿名访问
anonymous_enable=NO - 允许使用本地帐户进行FTP用户登录验证
local_enable=YES - 设定支持ASCII模式的上传和下载功能
ascii_upload_enable=YES
ascii_download_enable=YES - 使用户不能离开主目录
当 chroot_list_enable=YES chroot_local_user=YES 时
在 /etc/vsftpd.chroot_list 文件中列出的用户 可以切换到其他目录
未在文件中列出的用户 不能切换到其他目录
chroot_local_user=YES
chroot_list_enable=YES
chroot_list_file=/etc/vsftpd/chroot_list
在配置文件最后添加allow_writeable_chroot=YES
如果/etc/vsftpd/chroot_list不存在 则需要创建该文件
- 重启 vsftpd.service
# systemctl enable vsftpd.service 设置vsftpd开机自启动
[root@shenfeng vsftpd]# systemctl start vsftpd.service
[root@shenfeng vsftpd]#
- 新建 ftp 用户
[root@shenfeng vsftpd]# useradd -d /var/ftp/public_root -g ftp -s /sbin/nologin ftpff01
[root@shenfeng vsftpd]#
[root@shenfeng vsftpd]# passwd ftpff01
新的 密码：
重新输入新的 密码：
passwd：所有的身份验证令牌已经成功更新。
[root@shenfeng vsftpd]#
- ftp主动模式
如果未启动防火墙，就可以直接访问了
如果使用的是 iptables 防火墙。配置iptablesvim /etc/sysconfig/iptables
新加-A INPUT -m state --state NEW -m tcp -p tcp --dport 21 -j ACCEPT开放21端口
systemctl restart iptables.service
如果使用ECS 在安全组规则配置允许21端口访问
以阿里云为例 实例-管理-安全组-配置规则 在入方向添加21 port - ftp 被动模式
-
vim /etc/vsftpd/vsftpd.conf
关闭掉vsftpd的主动模式connect_from_port_20=NO
添加
pasv_enable=YES使vsftpd运行在被动模式
pasv_min_port=9000被动模式最小端口号9000
pasv_max_port=9100被动模式最大端口号9100 - 如果使用的是iptables防火墙
编辑iptables配置文件vim /etc/sysconfig/iptables
添加
-A INPUT -p tcp -m state --state NEW -m tcp --dport 21 -j ACCEPT开放ftp协议21端口
-A INPUT -p tcp --dport 9000:9100 -j ACCEPT开放9000-9100号端口
重启服务systemctl restart iptables.service - 如果使用ECS
在安全组规则配置允许21和9000-9100端口访问
以阿里云为例 实例-管理-安全组-配置规则 在入方向添加21/21和9000/9100
卸载 vsftpd
- 查看当前服务器中的vsftpd
[root@shenfeng ~]# rpm -qa | grep vsftpd
vsftpd-3.0.2-22.el7.x86_64
- 执行卸载 卸载时自动备份
[root@shenfeng ~]# rpm -e vsftpd-3.0.2-22.el7.x86_64
警告：/etc/vsftpd/vsftpd.conf 已另存为 /etc/vsftpd/vsftpd.conf.rpmsave
[root@shenfeng ~]#
- 删除遗留的文件
[root@shenfeng ~]# rm -rf /etc/vsftpd
[root@shenfeng ~]#
- 删除用户
[root@shenfeng ~]# userdel ftpff01
[root@shenfeng ~]#
vsftpd.conf 说明
1 # Example config file /etc/vsftpd/vsftpd.conf
2 #
3 # The default compiled in settings are fairly paranoid. This sample file
4 # loosens things up a bit, to make the ftp daemon more usable.
5 # Please see vsftpd.conf.5 for all compiled in defaults.
6 #
7 # READ THIS: This example file is NOT an exhaustive list of vsftpd options.
8 # Please read the vsftpd.conf.5 manual page to get a full idea of vsftpd's
9 # capabilities.
10 #
允许匿名登陆
11 # Allow anonymous FTP? (Beware - allowed by default if you comment this out).
12 anonymous_enable=YES
13 #
允许本地帐户登陆
14 # Uncomment this to allow local users to log in.
15 # When SELinux is enforcing check for SE bool ftp_home_dir
16 local_enable=YES
17 #
允许本地帐户删除和修改文件
18 # Uncomment this to enable any form of FTP write command.
19 write_enable=YES
20 #
FTP上本地的文件权限，�默认是077
21 # Default umask for local users is 077. You may wish to change this to 022,
22 # if your users expect that (022 is used by most other ftpd's)
23 local_umask=022
24 #
允许匿名用户上传权限
25 # Uncomment this to allow the anonymous FTP user to upload files. This only
26 # has an effect if the above global write enable is activated. Also, you will
27 # obviously need to create a directory writable by the FTP user.
28 # When SELinux is enforcing check for SE bool allow_ftpd_anon_write, allow_ftpd_full_access
29 #anon_upload_enable=YES
30 #
允许匿名用户创建目录的同时可以在此目录中上传文件
31 # Uncomment this if you want the anonymous FTP user to be able to create
32 # new directories.
33 #anon_mkdir_write_enable=YES
34 #
切换目录时，显示目录下.message的内容
35 # Activate directory messages - messages given to remote users when they
36 # go into a certain directory.
37 dirmessage_enable=YES
38 #
激活上传和下传的日志
39 # Activate logging of uploads/downloads.
40 xferlog_enable=YES
41 #
主动模式
42 # Make sure PORT transfer connections originate from port 20 (ftp-data).
43 connect_from_port_20=YES
44 #
开启上传后更改文件所属权
45 # If you want, you can arrange for uploaded anonymous files to be owned by
46 # a different user. Note! Using "root" for uploaded files is not
47 # recommended!
48 #chown_uploads=YES
上传后更改文件所属权的用户名
49 #chown_username=whoever
50 #
日志文件
51 # You may override where the log file goes if you like. The default is shown
52 # below.
53 #xferlog_file=/var/log/xferlog
54 #
使用标准的日志格式
55 # If you want, you can have your log file in standard ftpd xferlog format.
56 # Note that the default log file location is /var/log/xferlog in this case.
57 xferlog_std_format=YES
58 #
用户会话空闲后10分钟（秒）
59 # You may change the default value for timing out an idle session.
60 #idle_session_timeout=600
61 #
将数据连接空闲2分钟断（秒）
62 # You may change the default value for timing out a data connection.
63 #data_connection_timeout=120
64 #
???
65 # It is recommended that you define on your system a unique user which the
66 # ftp server can use as a totally isolated and unprivileged user.
67 #nopriv_user=ftpsecure
68 #
允许使用 async ABOR 命令，一般不用，容易出问题
69 # Enable this and the server will recognise asynchronous ABOR requests. Not
70 # recommended for security (the code is non-trivial). Not enabling it,
71 # however, may confuse older FTP clients.
72 #async_abor_enable=YES
73 #
启用上传的ascii传输方式
启用下载的ascii传输方式
74 # By default the server will pretend to allow ASCII mode but in fact ignore
75 # the request. Turn on the below options to have the server actually do ASCII
76 # mangling on files when in ASCII mode.
77 # Beware that on some FTP servers, ASCII support allows a denial of service
78 # attack (DoS) via the command "SIZE /big/file" in ASCII mode. vsftpd
79 # predicted this attack and has always been safe, reporting the size of the
80 # raw file.
81 # ASCII mangling is a horrible feature of the protocol.
82 #ascii_upload_enable=YES
83 #ascii_download_enable=YES
84 #
显示欢迎信息
85 # You may fully customise the login banner string:
86 #ftpd_banner=Welcome to blah FTP service.
87 #
???
88 # You may specify a file of disallowed anonymous e-mail addresses. Apparently
89 # useful for combatting certain DoS attacks.
90 #deny_email_enable=YES
???
91 # (default follows)
92 #banned_email_file=/etc/vsftpd/banned_emails
93 #
限制本地所有帐户只能在自己的目录中
94 # You may specify an explicit list of local users to chroot() to their home
95 # directory. If chroot_local_user is YES, then this list becomes a list of
96 # users to NOT chroot().
97 # (Warning! chroot'ing can be very dangerous. If using chroot, make sure that
98 # the user does not have write access to the top level directory within the
99 # chroot)
100 #chroot_local_user=YES
文件中的名单可以调用
101 #chroot_list_enable=YES
102 # (default follows)
用户列表文件，生效前提是 chroot_local_user=NO
103 #chroot_list_file=/etc/vsftpd/chroot_list
104 #
是否能使用ls -R命令以防止浪费大量的服务器资源
105 # You may activate the "-R" option to the builtin ls. This is disabled by
106 # default to avoid remote users being able to cause excessive I/O on large
107 # sites. However, some broken FTP clients such as "ncftp" and "mirror" assume
108 # the presence of the "-R" option, so there is a strong case for enabling it.
109 #ls_recurse_enable=YES
110 #
独立的vsftpd服务器
111 # When "listen" directive is enabled, vsftpd runs in standalone mode and
112 # listens on IPv4 sockets. This directive cannot be used in conjunction
113 # with the listen_ipv6 directive.
114 listen=NO
115 #
???
116 # This directive enables listening on IPv6 sockets. By default, listening
117 # on the IPv6 "any" address (::) will accept connections from both IPv6
118 # and IPv4 clients. It is not necessary to listen on *both* IPv4 and IPv6
119 # sockets. If you want that (perhaps because you want to listen on specific
120 # addresses) then you must run two copies of vsftpd with two configuration
121 # files.
122 # Make sure, that one of the listen options is commented !!
123 listen_ipv6=YES
124
定义PAM所使用的名称，预设为vsftpd
125 pam_service_name=vsftpd
开启userlist_file进行访问限制，且开启后，userlist_deny选项才生效
126 userlist_enable=YES
开启tcp_wrappers支持
127 tcp_wrappers=YES
不定期更新 不合适的地方 还请指点~ 感激不尽
