CentOS7 配置 vsftpd

vsftpd setup

# yum install vsftpd -y

# yum install ftp -y

先测试

# service vsftpd start

# netstat -lnet | grep 21

tcp6 0 0 :::21 :::* LISTEN 0 21107

登陆匿名账户(空密码)

# ftp localhost

Trying ::1...

Connected to localhost (::1).

220 (vsFTPd 3.0.2)

Name (localhost:root): anonymous

331 Please specify the password.

Password:

230 Login successful.

Remote system type is UNIX.

Using binary mode to transfer files.

ftp> ls

229 Entering Extended Passive Mode (|||50042|).

150 Here comes the directory listing.

drwxr-xr-x 2 0 0 6 Jun 10 2014 pub

226 Directory send OK.

ftp> 221 Goodbye.

-------------------------------

开始修改配置文件

# cp /etc/vsftpd/vsftpd.conf /etc/vsftpd/vsftpd.conf.bak

# vim /etc/vsftpd/vsftpd.conf

anonymous_enable=NO

anon_umask=033

#connect_from_port_20=YES

xferlog_file=/var/log/xferlog

#xferlog_std_format=YES

chroot_local_user=YES

listen=YES

#listen_ipv6=YES

guest_enable=YES

guest_username=ftp

user_config_dir=/etc/vsftpd/vuser_conf

allow_writeable_chroot=YES

完整文档如下:-------------------------------------------

# Example config file /etc/vsftpd/vsftpd.conf

#

# The default compiled in settings are fairly paranoid. This sample file

# loosens things up a bit, to make the ftp daemon more usable.

# Please see vsftpd.conf.5 for all compiled in defaults.

#

# READ THIS: This example file is NOT an exhaustive list of vsftpd options.

# Please read the vsftpd.conf.5 manual page to get a full idea of vsftpd's

# capabilities.

#

# Allow anonymous FTP? (Beware - allowed by default if you comment this out).

anonymous_enable=NO

#

# Uncomment this to allow local users to log in.

# When SELinux is enforcing check for SE bool ftp_home_dir

local_enable=YES

#

# Uncomment this to enable any form of FTP write command.

write_enable=YES

#

# Default umask for local users is 077. You may wish to change this to 022,

# if your users expect that (022 is used by most other ftpd's)

local_umask=022

anon_umask=033

#

# Uncomment this to allow the anonymous FTP user to upload files. This only

# has an effect if the above global write enable is activated. Also, you will

# obviously need to create a directory writable by the FTP user.

# When SELinux is enforcing check for SE bool allow_ftpd_anon_write, allow_ftpd_full_access

#anon_upload_enable=YES

#

# Uncomment this if you want the anonymous FTP user to be able to create

# new directories.

#anon_mkdir_write_enable=YES

#

# Activate directory messages - messages given to remote users when they

# go into a certain directory.

dirmessage_enable=YES

#

# Activate logging of uploads/downloads.

xferlog_enable=YES

#

# Make sure PORT transfer connections originate from port 20 (ftp-data).

#connect_from_port_20=YES

#

# If you want, you can arrange for uploaded anonymous files to be owned by

# a different user. Note! Using "root" for uploaded files is not

# recommended!

#chown_uploads=YES

#chown_username=whoever

#

# You may override where the log file goes if you like. The default is shown

# below.

xferlog_file=/var/log/xferlog

#

# If you want, you can have your log file in standard ftpd xferlog format.

# Note that the default log file location is /var/log/xferlog in this case.

#xferlog_std_format=YES

#

# You may change the default value for timing out an idle session.

#idle_session_timeout=600

#

# You may change the default value for timing out a data connection.

#data_connection_timeout=120

#

# It is recommended that you define on your system a unique user which the

# ftp server can use as a totally isolated and unprivileged user.

#nopriv_user=ftpsecure

#

# Enable this and the server will recognise asynchronous ABOR requests. Not

# recommended for security (the code is non-trivial). Not enabling it,

# however, may confuse older FTP clients.

#async_abor_enable=YES

#

# By default the server will pretend to allow ASCII mode but in fact ignore

# the request. Turn on the below options to have the server actually do ASCII

# mangling on files when in ASCII mode.

# Beware that on some FTP servers, ASCII support allows a denial of service

# attack (DoS) via the command "SIZE /big/file" in ASCII mode. vsftpd

# predicted this attack and has always been safe, reporting the size of the

# raw file.

# ASCII mangling is a horrible feature of the protocol.

#ascii_upload_enable=YES

#ascii_download_enable=YES

#

# You may fully customise the login banner string:

#ftpd_banner=Welcome to blah FTP service.

#

# You may specify a file of disallowed anonymous e-mail addresses. Apparently

# useful for combatting certain DoS attacks.

#deny_email_enable=YES

# (default follows)

#banned_email_file=/etc/vsftpd/banned_emails

#

# You may specify an explicit list of local users to chroot() to their home

# directory. If chroot_local_user is YES, then this list becomes a list of

# users to NOT chroot().

# (Warning! chroot'ing can be very dangerous. If using chroot, make sure that

# the user does not have write access to the top level directory within the

# chroot)

chroot_local_user=YES

#chroot_list_enable=YES

# (default follows)

#chroot_list_file=/etc/vsftpd/chroot_list

#

# You may activate the "-R" option to the builtin ls. This is disabled by

# default to avoid remote users being able to cause excessive I/O on large

# sites. However, some broken FTP clients such as "ncftp" and "mirror" assume

# the presence of the "-R" option, so there is a strong case for enabling it.

#ls_recurse_enable=YES

#

# When "listen" directive is enabled, vsftpd runs in standalone mode and

# listens on IPv4 sockets. This directive cannot be used in conjunction

# with the listen_ipv6 directive.

listen=YES

listen_port=11021

pasv_min_port=40000

pasv_max_port=40999

#

# This directive enables listening on IPv6 sockets. By default, listening

# on the IPv6 "any" address (::) will accept connections from both IPv6

# and IPv4 clients. It is not necessary to listen on *both* IPv4 and IPv6

# sockets. If you want that (perhaps because you want to listen on specific

# addresses) then you must run two copies of vsftpd with two configuration

# files.

# Make sure, that one of the listen options is commented !!

#listen_ipv6=YES

pam_service_name=vsftpd

userlist_enable=YES

tcp_wrappers=YES

guest_enable=YES

guest_username=ftp

user_config_dir=/etc/vsftpd/vuser_conf

allow_writeable_chroot=YES

--------------------------------------------------------------------------------

创建虚拟用户名,密码文件

# vim /etc/vsftpd/vuser.txt

test

testpwd

test1

test1pwd

说明:奇数行为用户名,偶数行为密码

使用db_load创建数据库文件

# db_load -T -t hash -f /etc/vsftpd/vuser.txt /etc/vsftpd/vuser.db

# ll

rw-r--r--. 1 root root 4 1月 26 21:23 chroot_list

-rw-------. 1 root root 125 6月 9 2014 ftpusers

-rw-------. 1 root root 361 6月 9 2014 user_list

-rw-------. 1 root root 5102 1月 26 21:21 vsftpd.conf

-rw-------. 1 root root 5030 1月 26 21:17 vsftpd.conf.bak

-rwxr--r--. 1 root root 338 6月 9 2014 vsftpd_conf_migrate.sh

-rw-r--r--. 1 root root 12288 1月 26 21:28 vuser.db

-rw-r--r--. 1 root root 29 1月 26 21:28 vuser.txt

生成虚拟用户认证文件,注释掉所有内容,后添加代码如下(注意是64位系统,所以是lib64目录)

# vim /etc/pam.d/vsftpd

#%PAM-1.0

#session optional pam_keyinit.so force revoke

#auth required pam_listfile.so item=user sense=deny file=/etc/vsftpd/ftpusers onerr=succeed

#auth required pam_shells.so

#auth include password-auth

#account include password-auth

#session required pam_loginuid.so

#session include password-auth

auth required /lib64/security/pam_userdb.so db=/etc/vsftpd/vuser

account required /lib64/security/pam_userdb.so db=/etc/vsftpd/vuser

说明:db=/etc/vsftpd/uvser 对应 /etc/vsftpd/vuser.db

创建每个虚拟用户的配置文件,配置文件存放在/etc/vsftpd/vuser_conf目录,以用户名对应文件名

# mkdir /etc/vsfptd/vuser_conf

# vim /etc/vsftpd/vuser_conf/test

anon_world_readable_only=NO

write_enable=YES

anon_upload_enable=YES

anon_mkdir_write_enable=YES

anon_other_write_enable=YES

local_root=/var/ftp/test

# vim /etc/vsftpd/vuser_conf/test1

anon_world_readable_only=NO

write_enable=YES

anon_upload_enable=YES

anon_mkdir_write_enable=YES

anon_other_write_enable=YES

local_root=/var/ftp/test1

调整目录权限:

# chmow 600 /etc/vsftpd/vuser.txt /etc/vsftpd/vuser.db /etc/vsftpd/vuser_conf /etc/vsftpd/vsftpd.conf

# chown -R ftp:ftp /var/ftp

# mkdir /var/ftp/test

# mkdir /var/ftp/test1

最后测试:

# service vsftpd restart

# ftp localhost

Trying ::1...

Connected to localhost (::1).

220 (vsFTPd 3.0.2)

Name (localhost:root): test

331 Please specify the password.

Password:

530 Login incorrect.

Login failed.

日志

#tail /var/log/secure -f

查看selinux ftp变量

# getsebool -a | grep ftp

ftp_home_dir --> off

ftpd_anon_write --> off

ftpd_connect_all_unreserved --> off

ftpd_connect_db --> off

ftpd_full_access --> off

ftpd_use_cifs --> off

ftpd_use_fusefs --> off

ftpd_use_nfs --> off

ftpd_use_passive_mode --> off

httpd_can_connect_ftp --> off

httpd_enable_ftp_server --> off

sftpd_anon_write --> off

sftpd_enable_homedirs --> off

sftpd_full_access --> off

sftpd_write_ssh_home --> off

tftp_anon_write --> off

tftp_home_dir --> off

修改selinux ftp 变量值

# setsebool -P ftpd_anon_write 1

# setsebool -P ftpd_full_access 1

# getsebool -a | grep grep ftp

ftp_home_dir --> off

ftpd_anon_write --> on

ftpd_connect_all_unreserved --> off

ftpd_connect_db --> off

ftpd_full_access --> on

ftpd_use_cifs --> off

ftpd_use_fusefs --> off

ftpd_use_nfs --> off

ftpd_use_passive_mode --> off

httpd_can_connect_ftp --> off

httpd_enable_ftp_server --> off

sftpd_anon_write --> off

sftpd_enable_homedirs --> off

sftpd_full_access --> off

sftpd_write_ssh_home --> off

tftp_anon_write --> off

tftp_home_dir --> off

重启vsftpd

# service vsftpd restart

防火墙设置

iptables:

#vsftpd

-A INPUT -m state --state NEW -m tcp -p tcp --dport 11021 -j ACCEPT

-A INPUT -p tcp -m tcp --dport 40000:40999 -j ACCEPT

错误处理

500 OOPS: vsftpd: refusing to run with writable root inside chroot ()

解决方案:vsftpd.conf 添加 allow_writeable_chroot=YES

参考:

/article/5444757.html

http://eamin.net/vsftpd-500-oops/

http://biancheng.dnbcw.info/linux/428812.html

/article/8406770.html