浅谈ftp服务（二）

先来看看一些基础的设置:

# Example config file /etc/vsftpd/vsftpd.conf
#
# The default compiled in settings are fairly paranoid. This sample file
# loosens things up a bit, to make the ftp daemon more usable.
# Please see vsftpd.conf.5 for all compiled in defaults.
#
# READ THIS: This example file is NOT an exhaustive list of vsftpd options.
# Please read the vsftpd.conf.5 manual page to get a full idea of vsftpd's
# capabilities.
#
# Allow anonymous FTP? (Beware - allowed by default if you comment this out).
anonymous_enable=YES
# 是否允许匿名登录ftp主机 
# Uncomment this to allow local users to log in.
local_enable=YES
#是否允许/etc/passwd 的帐号以实体用户访问主机
# Uncomment this to enable any form of FTP write command.
#write_enable=NO
#是否允许用户上传数据
# Default umask for local users is 077. You may wish to change this to 022,
# if your users expect that (022 is used by most other ftpd's)
local_umask=022
#建立新目录的权限755 和 文件权限644
# Uncomment this to allow the anonymous FTP user to upload files. This only
# has an effect if the above global write enable is activated. Also, you will
# obviously need to create a directory writable by the FTP user.
#anon_upload_enable=YES
#是否让anonymous具有上传的权限
# Uncomment this if you want the anonymous FTP user to be able to create
# new directories.
#anon_mkdir_write_enable=YES
#是否让anonymous 具有新建目录的权限
# Activate directory messages - messages given to remote users when they
# go into a certain directory.
dirmessage_enable=YES
#当用户进入某个目录时，显示文件内容 
# The target log file can be vsftpd_log_file or xferlog_file.
# This depends on setting xferlog_std_format parameter
xferlog_enable=YES
#上传下载操作会被记录下来
# Make sure PORT transfer connections originate from port 20 (ftp-data).
connect_from_port_20=YES
#主动链接ftp 的 服务端口
# If you want, you can arrange for uploaded anonymous files to be owned by
# a different user. Note! Using "root" for uploaded files is not
# recommended!
#chown_uploads=YES
#chown_username=whoever
#
# The name of log file when xferlog_enable=YES and xferlog_std_format=YES
# WARNING - changing this filename affects /etc/logrotate.d/vsftpd.log
#xferlog_file=/var/log/xferlog
#日志文件的文件名
# Switches between logging into vsftpd_log_file and xferlog_file files.
# NO writes to vsftpd_log_file, YES to xferlog_file
xferlog_std_format=NO
#是否使用wu-ftp相同的文件格式
# You may change the default value for timing out an idle session.
#idle_session_timeout=600
#如果用户在600秒内没有命令的操作，强制脱机
# You may change the default value for timing out a data connection.
#data_connection_timeout=120
#如果数据链接已建立 120 秒内数据无法顺利传输 ，链接断开
# It is recommended that you define on your system a unique user which the
# ftp server can use as a totally isolated and unprivileged user.
nopriv_user=nobody
#使用ftpuser 作为此服务的权限
# Enable this and the server will recognise asynchronous ABOR requests. Not
# recommended for security (the code is non-trivial). Not enabling it,
# however, may confuse older FTP clients.
#async_abor_enable=YES
#
# By default the server will pretend to allow ASCII mode but in fact ignore
# the request. Turn on the below options to have the server actually do ASCII
# mangling on files when in ASCII mode.
# Beware that on some FTP servers, ASCII support allows a denial of service
# attack (DoS) via the command "SIZE /big/file" in ASCII mode. vsftpd
# predicted this attack and has always been safe, reporting the size of the
# raw file.
# ASCII mangling is a horrible feature of the protocol.
#ascii_upload_enable=YES
#ascii_download_enable=YES
#优先使用ascii 格式下载上传文件
# You may fully customise the login banner string:
#ftpd_banner=Welcome to blah FTP service.
#显示一些说明文字
# You may specify a file of disallowed anonymous e-mail addresses. Apparently
# useful for combatting certain DoS attacks.
#deny_email_enable=YES
#将某些特殊的email 阻挡住，不让那些anonymous 登录
# (default follows)
#banned_email_file=/etc/vsftpd/banned_emails
#那些email 不可登录
# You may specify an explicit list of local users to chroot() to their home
# directory. If chroot_local_user is YES, then this list becomes a list of
# users to NOT chroot().
#chroot_local_user=YES
#是否将用户限制在自己的主目录内
#chroot_list_enable=YES
#是否启用chroot 写入列表的功能，与下一个chroot_list_file 有关
# (default follows)
#chroot_list_file=/etc/vsftpd/chroot_list
#与chroot-local_user 有关
# You may activate the "-R" option to the builtin ls. This is disabled by
# default to avoid remote users being able to cause excessive I/O on large
# sites. However, some broken FTP clients such as "ncftp" and "mirror" assume
# the presence of the "-R" option, so there is a strong case for enabling it.
#ls_recurse_enable=YES
#
# When "listen" directive is enabled, vsftpd runs in standalone mode and
# listens on IPv4 sockets. This directive cannot be used in conjunction
# with the listen_ipv6 directive.
listen=YES
#vsftpd 以standalong 运行
# This directive enables listening on IPv6 sockets. To listen on IPv4 and IPv6
# sockets, you must run two copies of vsftpd with two configuration files.
# Make sure, that one of the listen options is commented !!
#listen_ipv6=YES
#userlist_enable=NO
#支持/etc/vsftpd/user_list 文件内的帐号登录控制
userlist_deny=NO
#当用户被列入某个文件时，该用户无法登录ftp服务器
userlist_file=/etc/vsftpd/user_list
#这个文件里的帐号都无法登录

pam_service_name=vsftpd
#pam模块的功能，在/etc/pam.d/vsftpd 下
tcp_wrappers=YES
#支持tcp—wapper的防火墙机制
use_localtime=YES
local_max_rate=1000000
#最大传输带宽1mb/s
#max_clients=10
#max_per_ip=1
banner_file=/etc/vsftpd/welcome

下来具体谈谈匿名用户，及虚拟用于的设置 ，（个人不建议用实体用户登录）。

I）如果只是匿名用户，最主要的仅仅只要设置两条语句：

 

其余的服务器环境参考上面的基础设置。

如果想要让匿名用户具有上传下载的能力，需要添加如下设置：

 

 

解释一下：最后那个“chown_username=daemon” 主要是针对用户上传一些不合法的文件，所以我将文件的所有者改为daemon ，这样其他人必须经过管理员的同意才可以下载那个上传文件。

可能有的人在实际测试中会遇到一下问题，这是也有可能是sellinux的问题，这时：

 

然后将"setsebool -P  allow_ftpd_anon_write=1",将allow_ftpd_full_access,ftp_home_dir也设置成1 即可。

II)关于虚拟用户的设置（这个比较难，也有点意思）

先看看：

 

在/etc/pam.d/下创建一个ftp.vu的文件，内容如下：

建立一个帐号，密码认证文件，比如：

# cat /home/test.txt

test（帐号）

123456（密码）  #一行一个帐号，密码 不要邮空行

hello

654321

生成数据库文件：

#db_load -T -t hash -f /home/test.txt /etc/vsftpd/ftp.db

下来建立一个帐号

# useradd -d /home/ftp -s /sbin/nologin virtual

#chmod 700 /home/ftp

#chown ftp /home/ftp

最后配置虚拟用户的个人设置：

#mkdir /etc/vsftpd/user_conf ,在下面创建以用户名命名的配置文件 test,hello （这里test和hello的文件属性必须要是root ）

否则：500 OOPS: config file not owned by correct user, or not a file

 

设置完毕，/etc/init.d/vsftpd restart 即可。祝你顺利！