天天看點
傳回

vsftpd配置，ubuntu下

版權聲明：本文為部落客原創文章，轉載需要注明出處。 https://blog.csdn.net/px_528/article/details/53931647

一、ftp伺服器搭建與簡單配置

這個部分的教程還是很多的，參考兩個即可：

如何在ubuntu中安裝設定ftp伺服器？

Ubuntu 14.04 FTP伺服器–vsftpd的安裝和配置

總結一下步驟吧：

1、安裝

sudo apt-get install vsftpd
  • 1

2、修改配置檔案/etc/vsftpd.conf

根據具體的情況進行修改，去掉注釋等，接下來會詳細介紹。

3、重新開機vsftpd服務

sudo service vsftpd restart
  • 1

然後檢視服務是否成功開啟

sudo service vsftpd status
  • 1

如果看到active（running）就說明成功了，否則很可能是配置檔案修改出錯。

vsftpd配置，ubuntu下

4、登入測試

實際測試一下是否達到預想的功能。

二、執行個體詳解ftp伺服器配置

我們搭建ftp伺服器想要實作以下特點：

1、user1使用者作為本地最進階使用者在ftp中幾乎不受什麼限制，可以通路全部目錄，可以上傳可以下載下傳，可以删除，建立目錄，建立檔案。

2、user2使用者作為作為本地使用者，ftp登陸後限制在自己的主目錄内（/home/user2），在其主目錄下可以上傳可以下載下傳，可以删除，建立目錄，建立檔案。

3、匿名使用者（其他任何人，不需要專門的密碼就可以通路）限制在/home/ftp目錄下，且隻有下載下傳權限。

如上的特點大概符合一般場景，本地使用者中，管理者自然最大了，想幹啥就幹啥，其他本地使用者就通路自己的目錄就好啦，在自己的範圍内想幹啥就幹啥，然後其他外來人員可以下載下傳指定的資源，這樣管理者可以共享一些東西供其他人下載下傳，其他人隻能下載下傳，不能修改，是以也不能造成什麼破壞。

好啦，照着這個目标，開始配置/etc/vsftpd.conf檔案

允許匿名使用者通路，并且對匿名使用者的目錄進行限制，限制到/home/ftp

anonymous_enable=YES
anon_root=/home/ftp
  • 1
  • 2

這裡特别說明，/home/ftp目錄，不能有w權限，這是一個隻讀的目錄，否者會報錯。修改權限可以使用

sudo chmod a-w /home/ftp

本地使用者能夠通路，且擁有寫的權限

local_enable=YES
write_enable=YES
  • 1
  • 2

本地使用者登入後限制在自己的主目錄下，同時通過檔案/etc/vsftpd.chroot_list來指定不用限制目錄的使用者（比如我們的user1不用限制目錄，是以要在該檔案下寫上user1），同時允許使用者對自己的主目錄進行修改。

chroot_local_user=YES
chroot_list_enable=YES
chroot_list_file=/etc/vsftpd.chroot_list
allow_writeable_chroot=YES
  • 1
  • 2
  • 3
  • 4

啟用使用者清單，不在清單中的使用者禁止登陸（是以我們要在etc/allowed_users中寫上user1，user2，anonymous，ftp，其中最後兩個都表示匿名登入）

user_list_enable=YES
user_list_deny=NO
userlist_file=/etc/allowed_users
  • 1
  • 2
  • 3

這個是經驗項，配置了據說可以避免一些錯誤，參考文獻中有介紹。

seccomp_sandbox=NO

到此，還注意到，裡面涉及到了兩個檔案，一個是/etc/vsftpd.chroot_list，一個是/etc/allowed_users，我們儲存了之後需要自己手動建立這兩個檔案，

sudo touch /etc/vsftpd.chroot_list
sudo touch /etc/allowed_users
  • 1
  • 2

然後在/etc/vsftpd.chroot_list中的使用者不被限制目錄，這個例子中我們要寫入user1，/etc/allowed_users中要寫入允許通路伺服器的使用者，這裡就是user1，user2，還有匿名使用者anonymous，ftp，注意寫的時候每行隻寫一個使用者名。

儲存好了就重新開機服務，驗證即可。

最後，一點注意，匿名使用者隻能通路/home/ftp目錄，那麼裡面的檔案需要超級使用者複制進去，并且所有檔案需要有可讀的權限，否者其他使用者下載下傳會出錯。

貼一下配置檔案的整體代碼，友善大家比對。

# Example config file /etc/vsftpd.conf
#
# The default compiled in settings are fairly paranoid. This sample file
# loosens things up a bit, to make the ftp daemon more usable.
# Please see vsftpd.conf.5 for all compiled in defaults.
#
# READ THIS: This example file is NOT an exhaustive list of vsftpd options.
# Please read the vsftpd.conf.5 manual page to get a full idea of vsftpd's
# capabilities.
#
#
# Run standalone?  vsftpd can run either from an inetd or as a standalone
# daemon started from an initscript.
listen=NO
#
# This directive enables listening on IPv6 sockets. By default, listening
# on the IPv6 "any" address (::) will accept connections from both IPv6
# and IPv4 clients. It is not necessary to listen on *both* IPv4 and IPv6
# sockets. If you want that (perhaps because you want to listen on specific
# addresses) then you must run two copies of vsftpd with two configuration
# files.
listen_ipv6=YES
#
# Allow anonymous FTP? (Disabled by default).
anonymous_enable=YES
anon_root=/home/ftp
#
# Uncomment this to allow local users to log in.
local_enable=YES
#
# Uncomment this to enable any form of FTP write command.
write_enable=YES
#
# Default umask for local users is 077. You may wish to change this to 022,
# if your users expect that (022 is used by most other ftpd's)
#local_umask=022
#
# Uncomment this to allow the anonymous FTP user to upload files. This only
# has an effect if the above global write enable is activated. Also, you will
# obviously need to create a directory writable by the FTP user.
#anon_upload_enable=YES
#
# Uncomment this if you want the anonymous FTP user to be able to create
# new directories.
#anon_mkdir_write_enable=YES
#
# Activate directory messages - messages given to remote users when they
# go into a certain directory.
dirmessage_enable=YES
#
# If enabled, vsftpd will display directory listings with the time
# in  your  local  time  zone.  The default is to display GMT. The
# times returned by the MDTM FTP command are also affected by this
# option.
use_localtime=YES
#
# Activate logging of uploads/downloads.
xferlog_enable=YES
#
# Make sure PORT transfer connections originate from port 20 (ftp-data).
connect_from_port_20=YES
#
# If you want, you can arrange for uploaded anonymous files to be owned by
# a different user. Note! Using "root" for uploaded files is not
# recommended!
#chown_uploads=YES
#chown_username=whoever
#
# You may override where the log file goes if you like. The default is shown
# below.
#xferlog_file=/var/log/vsftpd.log
#
# If you want, you can have your log file in standard ftpd xferlog format.
# Note that the default log file location is /var/log/xferlog in this case.
#xferlog_std_format=YES
#
# You may change the default value for timing out an idle session.
#idle_session_timeout=600
#
# You may change the default value for timing out a data connection.
#data_connection_timeout=120
#
# It is recommended that you define on your system a unique user which the
# ftp server can use as a totally isolated and unprivileged user.
#nopriv_user=ftpsecure
#
# Enable this and the server will recognise asynchronous ABOR requests. Not
# recommended for security (the code is non-trivial). Not enabling it,
# however, may confuse older FTP clients.
#async_abor_enable=YES
#
# By default the server will pretend to allow ASCII mode but in fact ignore
# the request. Turn on the below options to have the server actually do ASCII
# mangling on files when in ASCII mode.
# Beware that on some FTP servers, ASCII support allows a denial of service
# attack (DoS) via the command "SIZE /big/file" in ASCII mode. vsftpd
# predicted this attack and has always been safe, reporting the size of the
# raw file.
# ASCII mangling is a horrible feature of the protocol.
#ascii_upload_enable=YES
#ascii_download_enable=YES
#
# You may fully customise the login banner string:
#ftpd_banner=Welcome to blah FTP service.
#
# You may specify a file of disallowed anonymous e-mail addresses. Apparently
# useful for combatting certain DoS attacks.
#deny_email_enable=YES
# (default follows)
#banned_email_file=/etc/vsftpd.banned_emails
#
# You may restrict local users to their home directories.  See the FAQ for
# the possible risks in this before using chroot_local_user or
# chroot_list_enable below.
#chroot_local_user=YES
#
# You may specify an explicit list of local users to chroot() to their home
# directory. If chroot_local_user is YES, then this list becomes a list of
# users to NOT chroot().
# (Warning! chroot'ing can be very dangerous. If using chroot, make sure that
# the user does not have write access to the top level directory within the
# chroot)
chroot_local_user=YES
chroot_list_enable=YES
# (default follows)
chroot_list_file=/etc/vsftpd.chroot_list
#
# You may activate the "-R" option to the builtin ls. This is disabled by
# default to avoid remote users being able to cause excessive I/O on large
# sites. However, some broken FTP clients such as "ncftp" and "mirror" assume
# the presence of the "-R" option, so there is a strong case for enabling it.
#ls_recurse_enable=YES
#
# Customization
#
# Some of vsftpd's settings don't fit the filesystem layout by
# default.
#
# This option should be the name of a directory which is empty.  Also, the
# directory should not be writable by the ftp user. This directory is used
# as a secure chroot() jail at times vsftpd does not require filesystem
# access.
secure_chroot_dir=/var/run/vsftpd/empty
#
# This string is the name of the PAM service vsftpd will use.
pam_service_name=vsftpd
#
# This option specifies the location of the RSA certificate to use for SSL
# encrypted connections.
rsa_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem
rsa_private_key_file=/etc/ssl/private/ssl-cert-snakeoil.key
ssl_enable=NO

userlist_enable=YES
userlist_deny=NO
userlist_file=/etc/allowed_users
#local_root=/home
seccomp_sandbox=NO
allow_writeable_chroot=YES
#
# Uncomment this to indicate that vsftpd use a utf8 filesystem.
#utf8_filesystem=YES
  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19
  • 20
  • 21
  • 22
  • 23
  • 24
  • 25
  • 26
  • 27
  • 28
  • 29
  • 30
  • 31
  • 32
  • 33
  • 34
  • 35
  • 36
  • 37
  • 38
  • 39
  • 40
  • 41
  • 42
  • 43
  • 44
  • 45
  • 46
  • 47
  • 48
  • 49
  • 50
  • 51
  • 52
  • 53
  • 54
  • 55
  • 56
  • 57
  • 58
  • 59
  • 60
  • 61
  • 62
  • 63
  • 64
  • 65
  • 66
  • 67
  • 68
  • 69
  • 70
  • 71
  • 72
  • 73
  • 74
  • 75
  • 76
  • 77
  • 78
  • 79
  • 80
  • 81
  • 82
  • 83
  • 84
  • 85
  • 86
  • 87
  • 88
  • 89
  • 90
  • 91
  • 92
  • 93
  • 94
  • 95
  • 96
  • 97
  • 98
  • 99
  • 100
  • 101
  • 102
  • 103
  • 104
  • 105
  • 106
  • 107
  • 108
  • 109
  • 110
  • 111
  • 112
  • 113
  • 114
  • 115
  • 116
  • 117
  • 118
  • 119
  • 120
  • 121
  • 122
  • 123
  • 124
  • 125
  • 126
  • 127
  • 128
  • 129
  • 130
  • 131
  • 132
  • 133
  • 134
  • 135
  • 136
  • 137
  • 138
  • 139
  • 140
  • 141
  • 142
  • 143
  • 144
  • 145
  • 146
  • 147
  • 148
  • 149
  • 150
  • 151
  • 152
  • 153
  • 154
  • 155
  • 156
  • 157
  • 158
  • 159
  • 160
  • 161
  • 162
  • 163 
<link href="https://csdnimg.cn/release/phoenix/mdeditor/markdown_views-7f770a53f2.css" target="_blank" rel="external nofollow"  rel="stylesheet">
            </div>
Linux系統使用 linux下伺服器配置
上一篇: Ubuntu下ftp伺服器配置方法 （進階配置）
下一篇: Linux系統之CentOS磁盤挂載

繼續閱讀