ftp有兩種工作模式,主動模式(port)和被動模式(passive)
主動模式:主動模式相對有利於服務端,在客戶端訪問服務端的21端口(默認端口不變的情況下)確認要進行ftp數據傳輸后,是客戶端開放1024以上的隨機端口給服務端去訪問進行數據傳輸,對於客戶端的網絡管理是較不便的。
被動模式:被動模式相對有利於客戶端,在客戶端發送pasv信號通過21端口傳送給服務端口,服務端會響應並開放vsftp.conf文件中配置的pasv_min_port和pasv_max_port范圍內的隨機端口,對於服務端防火牆等配置有要求。
一、准備工作
1、檢查服務器有沒有安裝過vsftp,然后檢查本地yum庫里有沒有安裝包。
[root@docker ~]# rpm -qa | grep vsftpd [root@docker ~]# which vsftpd /usr/bin/which: no vsftpd in (/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/root/bin) 上面說明服務器還沒有安裝ftp server,可以檢查服務器有沒有這個安裝包了 [root@docker ~]# yum list | grep vsftpd vsftpd.x86_64 3.0.3-28.el8 AppStream
2、關閉selinux
二、開始安裝
1、執行yum安裝語句
yum -y isntall vsftpd
2、啟動相關程序
[root@docker ~]# systemctl start vsftpd --啟動ftp [root@docker ~]# systemctl enable vsftpd --將ftp加入到開機自啟動 Created symlink /etc/systemd/system/multi-user.target.wants/vsftpd.service → /usr/lib/systemd/system/vsftpd.service. [root@docker ~]# netstat -antup | grep ftp --檢查ftp服務是否在監聽 tcp6 0 0 :::21 :::* LISTEN 32333/vsftpd
三、vsftp的相關配置解析
[root@docker ~]# cd /etc/vsftpd/
[root@docker vsftpd]# ls
ftpusers user_list vsftpd.conf vsftpd_conf_migrate.sh
1、ftpusers 即ftp黑名單用戶,只要在這個文件內的用戶,均無法使用ftp服務。
2、user_list 是和vsftpd.conf中的userlist_enable和userlist_deny兩個配置項緊密相關的,它可以有效,也可以無效,有效時它可以是一個黑名單,也可以是一個白名單!
(1)userlist_enable和userlist_deny兩個選項聯合起來針對的是:本地全體用戶(除去ftpusers中的用戶)和出現在user_list文件中的用戶以及不在在user_list文件中的用戶這三類用戶集合進行的設置。 (2)當且僅當userlist_enable=YES時:userlist_deny項的配置才有效,user_list文件才會被使用;當其為NO時,無論userlist_deny項為何值都是無效的,本地全體用戶(除去ftpusers中的用戶)都可以登入FTP (3)當userlist_enable=YES時,userlist_deny=YES時:user_list是一個黑名單,即:所有出現在名單中的用戶都會被拒絕登入; (4)當userlist_enable=YES時,userlist_deny=NO時:user_list是一個白名單,即:只有出現在名單中的用戶才會被准許登入(user_list之外的用戶都被拒絕登入);另外需要特別提醒的是:使用白名單后,匿名用戶將無法登入!除非顯式在user_list中加入一行:anonymous
3、配置vsftp.conf
# Example config file /etc/vsftpd/vsftpd.conf # # The default compiled in settings are fairly paranoid. This sample file # loosens things up a bit, to make the ftp daemon more usable. # Please see vsftpd.conf.5 for all compiled in defaults. # # READ THIS: This example file is NOT an exhaustive list of vsftpd options. # Please read the vsftpd.conf.5 manual page to get a full idea of vsftpd's # capabilities. # # Allow anonymous FTP? (Beware - allowed by default if you comment this out). anonymous_enable=NO ---是否允許匿名登錄 # # Uncomment this to allow local users to log in. # When SELinux is enforcing check for SE bool ftp_home_dir local_enable=YES ----是否允許本地用戶登錄FTP服務器 # # Uncomment this to enable any form of FTP write command. write_enable=YES ----是否對登錄用戶開啟寫權限。屬全局性設置。 # # Default umask for local users is 077. You may wish to change this to 022, # if your users expect that (022 is used by most other ftpd's) local_umask=022 --目錄和文件被創建時得到的初始權限,022即目錄權限755,文件權限644 # # Uncomment this to allow the anonymous FTP user to upload files. This only # has an effect if the above global write enable is activated. Also, you will # obviously need to create a directory writable by the FTP user. # When SELinux is enforcing check for SE bool allow_ftpd_anon_write, allow_ftpd_full_access #anon_upload_enable=YES # # Uncomment this if you want the anonymous FTP user to be able to create # new directories. #anon_mkdir_write_enable=YES # # Activate directory messages - messages given to remote users when they # go into a certain directory. dirmessage_enable=YES --當用戶進入某個目錄時,會顯示該目錄需要注意的內容 # # Activate logging of uploads/downloads. xferlog_enable=YES --當設定為 YES 時,使用者上傳與下載文件都會被紀錄起來。 # # Make sure PORT transfer connections originate from port 20 (ftp-data). connect_from_port_20=YES --默認的數據傳輸端口為20 # # If you want, you can arrange for uploaded anonymous files to be owned by # a different user. Note! Using "root" for uploaded files is not # recommended! #chown_uploads=YES #chown_username=whoever # # You may override where the log file goes if you like. The default is shown # below. #xferlog_file=/var/log/xferlog # # If you want, you can have your log file in standard ftpd xferlog format. # Note that the default log file location is /var/log/xferlog in this case. xferlog_std_format=YES # # You may change the default value for timing out an idle session. #idle_session_timeout=600 # # You may change the default value for timing out a data connection. #data_connection_timeout=120 # # It is recommended that you define on your system a unique user which the # ftp server can use as a totally isolated and unprivileged user. #nopriv_user=ftpsecure # # Enable this and the server will recognise asynchronous ABOR requests. Not # recommended for security (the code is non-trivial). Not enabling it, # however, may confuse older FTP clients. #async_abor_enable=YES # # By default the server will pretend to allow ASCII mode but in fact ignore # the request. Turn on the below options to have the server actually do ASCII # mangling on files when in ASCII mode. The vsftpd.conf(5) man page explains # the behaviour when these options are disabled. # Beware that on some FTP servers, ASCII support allows a denial of service # attack (DoS) via the command "SIZE /big/file" in ASCII mode. vsftpd # predicted this attack and has always been safe, reporting the size of the # raw file. # ASCII mangling is a horrible feature of the protocol. #ascii_upload_enable=YES #ascii_download_enable=YES # # You may fully customise the login banner string: #ftpd_banner=Welcome to blah FTP service. # # You may specify a file of disallowed anonymous e-mail addresses. Apparently # useful for combatting certain DoS attacks. #deny_email_enable=YES # (default follows) #banned_email_file=/etc/vsftpd/banned_emails # # You may specify an explicit list of local users to chroot() to their home # directory. If chroot_local_user is YES, then this list becomes a list of # users to NOT chroot(). # (Warning! chroot'ing can be very dangerous. If using chroot, make sure that # the user does not have write access to the top level directory within the # chroot) chroot_local_user=YES ---指定用戶列表文件中的用戶允許切換到上級目錄 chroot_list_enable=YES --是否啟用chroot_list_file配置指定的用戶列表 # (default follows) chroot_list_file=/etc/vsftpd/chroot_list ---默認該文件不存在,需手動創建,主要是在 前兩項均為YES時,配置可以cd到上級目錄的用戶。 # You may activate the "-R" option to the builtin ls. This is disabled by # default to avoid remote users being able to cause excessive I/O on large # sites. However, some broken FTP clients such as "ncftp" and "mirror" assume # the presence of the "-R" option, so there is a strong case for enabling it. #ls_recurse_enable=YES # # When "listen" directive is enabled, vsftpd runs in standalone mode and # listens on IPv4 sockets. This directive cannot be used in conjunction # with the listen_ipv6 directive. listen=NO # # This directive enables listening on IPv6 sockets. By default, listening # on the IPv6 "any" address (::) will accept connections from both IPv6 # and IPv4 clients. It is not necessary to listen on *both* IPv4 and IPv6 # sockets. If you want that (perhaps because you want to listen on specific # addresses) then you must run two copies of vsftpd with two configuration # files. # Make sure, that one of the listen options is commented !! listen_ipv6=YES pam_service_name=vsftpd userlist_enable=YES
allow_writeable_chroot=YES --對vsftpd有用,否則因home目錄權限而無法登錄
pasv_enable=YES
pasv_min_port=50000
pasv_max_port=60000
listen_port=2121 --修改默認端口號
注意
編輯/etc/services文件
修改ftp配置,將21改成2121
重啟vsftpd
[root@docker vsftpd]# systemctl restart vsftpd
測試端口是否已變更。
[root@docker vsftpd]# netstat -antup | grep vsftpd tcp6 0 0 :::2121 :::* LISTEN 33275/vsftpd
四、添加ftp用戶
一般添加ftp服務,都是要存文件之類的,可以指定一個掛在了較大磁盤空間的目錄做為ftp用戶的家目錄。
[root@docker ~]# useradd -d /data -s /sbin/nologin -g ftptest ahftp useradd: warning: the home directory already exists. Not copying any file from skel directory into it.
[root@docker ~]# cat /etc/passwd
ahftp:x:1001:1001::/data:/sbin/nologin
設置ftp用戶nologin后,需要在shell內添加該項。
輸入 cat /etc/pam.d/vsftpd | fgrep pam_shell 后顯示為:
auth required pam_shells.so
看到以上結果后,再次輸入 :echo "/sbin/nologin" >> /etc/shells
五、防火牆策略
[root@docker data]# firewall-cmd --permanent --add-port=2121/tcp success [root@docker data]# firewall-cmd --permanent --add-port=50000-60000/tcp success [root@docker data]# firewall-cmd --reload success [root@docker data]# firewall-cmd --list-all public (active) target: default icmp-block-inversion: no interfaces: ens33 sources: services: cockpit dhcpv6-client ssh ports: 10086/tcp 2121/tcp 50000-60000/tcp protocols: masquerade: no forward-ports: source-ports: icmp-blocks: rich rules:
六、測試
建議先本地測試。