linux安裝vsftp--centos8


ftp有兩種工作模式,主動模式(port)和被動模式(passive)

主動模式:主動模式相對有利於服務端,在客戶端訪問服務端的21端口(默認端口不變的情況下)確認要進行ftp數據傳輸后,是客戶端開放1024以上的隨機端口給服務端去訪問進行數據傳輸,對於客戶端的網絡管理是較不便的。

被動模式:被動模式相對有利於客戶端,在客戶端發送pasv信號通過21端口傳送給服務端口,服務端會響應並開放vsftp.conf文件中配置的pasv_min_port和pasv_max_port范圍內的隨機端口,對於服務端防火牆等配置有要求。

 

一、准備工作

1、檢查服務器有沒有安裝過vsftp,然后檢查本地yum庫里有沒有安裝包。

[root@docker ~]# rpm -qa | grep vsftpd
[root@docker ~]# which vsftpd
/usr/bin/which: no vsftpd in (/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/root/bin)
上面說明服務器還沒有安裝ftp server,可以檢查服務器有沒有這個安裝包了
[root@docker ~]# yum list | grep vsftpd
vsftpd.x86_64                                        3.0.3-28.el8                                      AppStream 

2、關閉selinux

 

二、開始安裝

1、執行yum安裝語句

yum -y isntall vsftpd

 

 2、啟動相關程序

[root@docker ~]# systemctl start vsftpd     --啟動ftp
[root@docker ~]# systemctl enable vsftpd    --將ftp加入到開機自啟動
Created symlink /etc/systemd/system/multi-user.target.wants/vsftpd.service → /usr/lib/systemd/system/vsftpd.service.
[root@docker ~]# netstat -antup | grep ftp   --檢查ftp服務是否在監聽
tcp6       0      0 :::21                   :::*                    LISTEN      32333/vsftpd

 

三、vsftp的相關配置解析

[root@docker ~]# cd /etc/vsftpd/
[root@docker vsftpd]# ls
ftpusers  user_list  vsftpd.conf  vsftpd_conf_migrate.sh

1、ftpusers   即ftp黑名單用戶,只要在這個文件內的用戶,均無法使用ftp服務。

2、user_list 是和vsftpd.conf中的userlist_enable和userlist_deny兩個配置項緊密相關的,它可以有效,也可以無效,有效時它可以是一個黑名單,也可以是一個白名單!

(1)userlist_enable和userlist_deny兩個選項聯合起來針對的是:本地全體用戶(除去ftpusers中的用戶)和出現在user_list文件中的用戶以及不在在user_list文件中的用戶這三類用戶集合進行的設置。
(2)當且僅當userlist_enable=YES時:userlist_deny項的配置才有效,user_list文件才會被使用;當其為NO時,無論userlist_deny項為何值都是無效的,本地全體用戶(除去ftpusers中的用戶)都可以登入FTP
(3)當userlist_enable=YES時,userlist_deny=YES時:user_list是一個黑名單,即:所有出現在名單中的用戶都會被拒絕登入;
(4)當userlist_enable=YES時,userlist_deny=NO時:user_list是一個白名單,即:只有出現在名單中的用戶才會被准許登入(user_list之外的用戶都被拒絕登入);另外需要特別提醒的是:使用白名單后,匿名用戶將無法登入!除非顯式在user_list中加入一行:anonymous

 3、配置vsftp.conf

# Example config file /etc/vsftpd/vsftpd.conf
#
# The default compiled in settings are fairly paranoid. This sample file
# loosens things up a bit, to make the ftp daemon more usable.
# Please see vsftpd.conf.5 for all compiled in defaults.
#
# READ THIS: This example file is NOT an exhaustive list of vsftpd options.
# Please read the vsftpd.conf.5 manual page to get a full idea of vsftpd's
# capabilities.
#
# Allow anonymous FTP? (Beware - allowed by default if you comment this out).
anonymous_enable=NO   ---是否允許匿名登錄 
#
# Uncomment this to allow local users to log in.
# When SELinux is enforcing check for SE bool ftp_home_dir
local_enable=YES     ----是否允許本地用戶登錄FTP服務器
#
# Uncomment this to enable any form of FTP write command.
write_enable=YES     ----是否對登錄用戶開啟寫權限。屬全局性設置。
#
# Default umask for local users is 077. You may wish to change this to 022,
# if your users expect that (022 is used by most other ftpd's)
local_umask=022    --目錄和文件被創建時得到的初始權限,022即目錄權限755,文件權限644
#
# Uncomment this to allow the anonymous FTP user to upload files. This only
# has an effect if the above global write enable is activated. Also, you will
# obviously need to create a directory writable by the FTP user.
# When SELinux is enforcing check for SE bool allow_ftpd_anon_write, allow_ftpd_full_access
#anon_upload_enable=YES
#
# Uncomment this if you want the anonymous FTP user to be able to create
# new directories.
#anon_mkdir_write_enable=YES
#
# Activate directory messages - messages given to remote users when they
# go into a certain directory.
dirmessage_enable=YES  --當用戶進入某個目錄時,會顯示該目錄需要注意的內容
#
# Activate logging of uploads/downloads.
xferlog_enable=YES --當設定為 YES 時,使用者上傳與下載文件都會被紀錄起來。
#
# Make sure PORT transfer connections originate from port 20 (ftp-data).
connect_from_port_20=YES  --默認的數據傳輸端口為20
#
# If you want, you can arrange for uploaded anonymous files to be owned by
# a different user. Note! Using "root" for uploaded files is not
# recommended!
#chown_uploads=YES
#chown_username=whoever
#
# You may override where the log file goes if you like. The default is shown
# below.
#xferlog_file=/var/log/xferlog
#
# If you want, you can have your log file in standard ftpd xferlog format.
# Note that the default log file location is /var/log/xferlog in this case.
xferlog_std_format=YES
#
# You may change the default value for timing out an idle session.
#idle_session_timeout=600
#
# You may change the default value for timing out a data connection.
#data_connection_timeout=120
#
# It is recommended that you define on your system a unique user which the
# ftp server can use as a totally isolated and unprivileged user.
#nopriv_user=ftpsecure
#
# Enable this and the server will recognise asynchronous ABOR requests. Not
# recommended for security (the code is non-trivial). Not enabling it,
# however, may confuse older FTP clients.
#async_abor_enable=YES
#
# By default the server will pretend to allow ASCII mode but in fact ignore
# the request. Turn on the below options to have the server actually do ASCII
# mangling on files when in ASCII mode. The vsftpd.conf(5) man page explains
# the behaviour when these options are disabled.
# Beware that on some FTP servers, ASCII support allows a denial of service
# attack (DoS) via the command "SIZE /big/file" in ASCII mode. vsftpd
# predicted this attack and has always been safe, reporting the size of the
# raw file.
# ASCII mangling is a horrible feature of the protocol.
#ascii_upload_enable=YES
#ascii_download_enable=YES
#
# You may fully customise the login banner string:
#ftpd_banner=Welcome to blah FTP service.
#
# You may specify a file of disallowed anonymous e-mail addresses. Apparently
# useful for combatting certain DoS attacks.
#deny_email_enable=YES
# (default follows)
#banned_email_file=/etc/vsftpd/banned_emails
#
# You may specify an explicit list of local users to chroot() to their home
# directory. If chroot_local_user is YES, then this list becomes a list of
# users to NOT chroot().
# (Warning! chroot'ing can be very dangerous. If using chroot, make sure that
# the user does not have write access to the top level directory within the
# chroot)
chroot_local_user=YES   ---指定用戶列表文件中的用戶允許切換到上級目錄
chroot_list_enable=YES --是否啟用chroot_list_file配置指定的用戶列表
# (default follows)
chroot_list_file=/etc/vsftpd/chroot_list ---默認該文件不存在,需手動創建,主要是在
前兩項均為YES時,配置可以cd到上級目錄的用戶。
# You may activate the "-R" option to the builtin ls. This is disabled by
# default to avoid remote users being able to cause excessive I/O on large
# sites. However, some broken FTP clients such as "ncftp" and "mirror" assume
# the presence of the "-R" option, so there is a strong case for enabling it.
#ls_recurse_enable=YES
#
# When "listen" directive is enabled, vsftpd runs in standalone mode and
# listens on IPv4 sockets. This directive cannot be used in conjunction
# with the listen_ipv6 directive.
listen=NO   
#
# This directive enables listening on IPv6 sockets. By default, listening
# on the IPv6 "any" address (::) will accept connections from both IPv6
# and IPv4 clients. It is not necessary to listen on *both* IPv4 and IPv6
# sockets. If you want that (perhaps because you want to listen on specific
# addresses) then you must run two copies of vsftpd with two configuration
# files.
# Make sure, that one of the listen options is commented !!
listen_ipv6=YES

pam_service_name=vsftpd
userlist_enable=YES

  allow_writeable_chroot=YES  --對vsftpd有用,否則因home目錄權限而無法登錄

  pasv_enable=YES

  pasv_min_port=50000

  pasv_max_port=60000   

 listen_port=2121 --修改默認端口號

  注意

   編輯/etc/services文件

修改ftp配置,將21改成2121

  

重啟vsftpd

[root@docker vsftpd]# systemctl restart vsftpd

測試端口是否已變更。

[root@docker vsftpd]# netstat -antup | grep vsftpd
tcp6       0      0 :::2121                 :::*                    LISTEN      33275/vsftpd 

 

四、添加ftp用戶

一般添加ftp服務,都是要存文件之類的,可以指定一個掛在了較大磁盤空間的目錄做為ftp用戶的家目錄。

[root@docker ~]# useradd -d /data -s /sbin/nologin -g ftptest ahftp
useradd: warning: the home directory already exists.
Not copying any file from skel directory into it.
[root@docker ~]# cat /etc/passwd

   ahftp:x:1001:1001::/data:/sbin/nologin

設置ftp用戶nologin后,需要在shell內添加該項。

輸入 cat /etc/pam.d/vsftpd | fgrep pam_shell 后顯示為:

auth       required     pam_shells.so

看到以上結果后,再次輸入 :echo "/sbin/nologin" >> /etc/shells

 

 

五、防火牆策略

[root@docker data]# firewall-cmd --permanent --add-port=2121/tcp
success
[root@docker data]# firewall-cmd --permanent --add-port=50000-60000/tcp
success
[root@docker data]# firewall-cmd --reload
success
[root@docker data]# firewall-cmd --list-all
public (active)
  target: default
  icmp-block-inversion: no
  interfaces: ens33
  sources: 
  services: cockpit dhcpv6-client ssh
  ports: 10086/tcp 2121/tcp 50000-60000/tcp
  protocols: 
  masquerade: no
  forward-ports: 
  source-ports: 
  icmp-blocks: 
  rich rules: 

六、測試

建議先本地測試。

 


免責聲明!

本站轉載的文章為個人學習借鑒使用,本站對版權不負任何法律責任。如果侵犯了您的隱私權益,請聯系本站郵箱yoyou2525@163.com刪除。



 
粵ICP備18138465號   © 2018-2025 CODEPRJ.COM