CentOS8 服务篇4:FTP文件传输服务搭建与配置 | 您所在的位置:网站首页 › centos 配置ftp › CentOS8 服务篇4:FTP文件传输服务搭建与配置 |
FTP 文件传输服务三种配置模式: 匿名模式 本地用户模式 虚拟用户模式
安装ftp服务 安装完后再根据不同模式进行配置 [root@localhost yum.repos.d]# yum install -y vsftpd ftp (vsftpd是搭建ftp服务器的,ftp是拿来测试的) 一、匿名模式配置配置文件修改[root@localhost ~]# vim /etc/vsftpd/vsftpd.conf 只有第一条是必改的,其他的根据要求添加修改即可 12 anonymous_enable=YES 允许匿名用户访问 28 anon_upload_enable=YES 允许匿名用户上传文件 32 anon_mkdir_write_enable=YES 允许匿名用户创建目录 这两个配置文件里没有,在文件最下面手打 127 anon_umask=022 匿名用户上传文件的umask值 128 anon_other_write_enable=YES 允许匿名用户修改目录名称或删除目录 防火墙设置 一般来说,这两条不打也没问题 清空iptables防火墙策略,保存状态 [root@localhost ~]# iptables -F [root@localhost ~]# iptables-save 会弹一堆东西,是正常的 将ftp服务放行,保存防火墙配置 [root@localhost ~]# firewall-cmd --permanent --zone=public --add-service=ftp success [root@localhost ~]# firewall-cmd --reload success selinux配置 [root@localhost ~]# getsebool -a | grep ftp ftpd_anon_write --> off ftpd_connect_all_unreserved --> off ftpd_connect_db --> off ftpd_full_access --> off ftpd_use_cifs --> off ftpd_use_fusefs --> off ftpd_use_nfs --> off ftpd_use_passive_mode --> off httpd_can_connect_ftp --> off httpd_enable_ftp_server --> off tftp_anon_write --> off tftp_home_dir --> off [root@localhost ~]# setsebool -P ftpd_full_access=on -P 永久生效,不然重启就没了 重启与开机自启服务 [root@localhost ~]# systemctl restart vsftpd [root@localhost ~]# systemctl enable vsftpd Created symlink /etc/systemd/system/multi-user.target.wants/vsftpd.service → /usr/lib/systemd/system/vsftpd.service. 测试 这里给上其他用户权限才能创建目录 这个目录是匿名模式下访问的默认目录 [root@localhost ~]# chmod o=rwx /var/ftp/pub [root@localhost ~]# ftp localhost 客户端验证就输服务器的ip Trying ::1... Connected to localhost (::1). 220 (vsFTPd 3.0.3) Name (localhost:root): anonymous 331 Please specify the password. Password: 230 Login successful. Remote system type is UNIX. Using binary mode to transfer files. ftp> cd pub 250 Directory successfully changed. ftp> mkdir sky 257 "/pub/sky" created 创建成功,验证完成 二、本地用户模式配置文件修改 [root@localhost ~]# vim /etc/vsftpd/vsftpd.conf 默认什么都不改就是可以使用的,下面是一下常用的参数解析 12 anonymous_enable=NO 禁止匿名用户访问 15 local_enable=YES 允许本地用户登录 18 write_enable=YES 允许本地用户上传(允许写入 22 local_umask=022 本地用户创建文件的umask值 用户是否可以切出目录的三个设置,用的时候去掉#号 100 #chroot_local_user=YES 是否开启对本地用户chroot的限制,YES为默认所有用户都不能切出家目录,NO代表默认用户都可以切出家目录 101 #chroot_list_enable=YES 开启特例列表 103 #chroot_list_file=/etc/vsftpd/chroot_list 如果chroot_local_user的值是YES则该文件中的用户是可以切出家目录,如果是NO,该文件中的用户则不能切出家目录,一行一个用户。 禁用用户登录名单配置 只有在 userlist_enable 开启的时候 userlist_deny 才起作用,userlist_deny不打的话默认就是yes 126 userlist_enable=YES 开启“禁用用户名单”,分别为/etc/vsftpd下 /user_list和/ftpusers 127 userlist_deny=NO 只有/etc/vsftpd/user_list 中的用户可以登录ftp YES 只有/etc/vsftpd/user_list和/etc/vsftpd/ftpusers 中的用户不能登录ftp 两个文件只要有一个里面有用户名就无法登录 防火墙配置 一般来说,这两条不打也没问题 清空iptables防火墙策略,保存状态 [root@localhost ~]# iptables -F [root@localhost ~]# iptables-save 会弹一堆东西,是正常的 将ftp服务放行,保存防火墙配置 [root@localhost ~]# firewall-cmd --permanent --zone=public --add-service=ftp success [root@localhost ~]# firewall-cmd --reload success [root@localhost ~]# getsebool -a | grep ftp ftpd_anon_write --> off ftpd_connect_all_unreserved --> off ftpd_connect_db --> off ftpd_full_access --> off ftpd_use_cifs --> off ftpd_use_fusefs --> off ftpd_use_nfs --> off ftpd_use_passive_mode --> off httpd_can_connect_ftp --> off httpd_enable_ftp_server --> off tftp_anon_write --> off tftp_home_dir --> off [root@localhost ~]# setsebool -P ftpd_full_access=on -P 永久生效,不然重启就没了 重启与开机自启服务 [root@localhost ~]# systemctl restart vsftpd [root@localhost ~]# systemctl enable vsftpd Created symlink /etc/systemd/system/multi-user.target.wants/vsftpd.service → /usr/lib/systemd/system/vsftpd.service. 测试 使用“禁用用户列表”以外的本地用户登录,或配置userlist_deny=NO后用root登录 [root@localhost ~]# ftp localhost Trying ::1... Connected to localhost (::1). 220 (vsFTPd 3.0.3) Name (localhost:root): root 331 Please specify the password. Password: 230 Login successful. Remote system type is UNIX. Using binary mode to transfer files. ftp> mkdir cy 257 "/root/cy" created 创建成功,ok 三、虚拟用户模式配置 创建ftp1和fpt2两个虚拟用户,密码都为123[root@localhost ~]# cd /etc/vsftpd/ 创建一个文件并写入,文件名随意 [root@localhost vsftpd]# vim sky.txt ftp1 奇数行为用户 123 偶数行为密码 ftp2 123 使用hash算法将明文转换为数据库文件(为了安全 [root@localhost vsftpd]# db_load -T -t hash -f sky.txt sky.db 降低权限,删除原文件,更安全些,这两步不打也不影响效果 [root@localhost vsftpd]# chmod 600 sky.db [root@localhost vsftpd]# rm -rf sky.txt 创建供虚拟用户映射的本地用户 这个家目录是为了方便管理ftp,也可以换 不让登录是为了安全 [root@localhost ~]# useradd -d /var/ftproot -s /sbin/nologin ftpuser [root@localhost ~]# chmod -Rf 755 /var/ftproot/ 创建PAM文件,直接进入vsftpd更改,或创建vsftpd.vu文件进行编写 [root@localhost ~]# vim /etc/pam.d/vsftpd.vu auth required pam_userdb.so db=/etc/vsftpd/sky account required pam_userdb.so db=/etc/vsftpd/sky
配置文件和虚拟用户权限设置 [root@localhost ~]# vim /etc/vsftpd/vsftpd.conf 12 anonymous_enable=NO 15 local_enable=YES 18 write_enable=YES 22 local_umask=022 最下面添加 127 guest_enable=YES 开启虚拟用户模式 128 guest_username=ftpuser 指定虚拟用户账户(映射用户 129 pam_service_name=vsftpd.vu 指定PAM文件 130 user_config_dir=/etc/vsftpd/user 虚拟用户权限配置文件存放路径 131 allow_writeable_chroot=YES 允许对囚禁的FTP根目录执行写入操作,而且不拒绝用户登录请求 (这个不打就登录不了,应该是家目录的原因,改成其他的普通目录应该就不用加这条了) 创建虚拟用户权限配置文件存放路径 [root@localhost ~]# mkdir /etc/vsftpd/user 目录名随意,但要与配置文件中一致 对应虚拟用户名创建权限配置文件(名字一样),权限使用匿名用户权限配置 [root@localhost ~]# vim /etc/vsftpd/user/ftp1 anon_upload_enable=YES anon_mkdir_write_enable=YES anon_other_write_enable=YES 可以上传文件,创建、修改、删除目录 [root@localhost ~]# touch /etc/vsftpd/user/ftp2 创文件不编辑就是什么权限都不给 防火墙设置 一般来说,这两条不打也没问题 清空iptables防火墙策略,保存状态 [root@localhost ~]# iptables -F [root@localhost ~]# iptables-save 会弹一堆东西,是正常的 将ftp服务放行,保存防火墙配置 [root@localhost ~]# firewall-cmd --permanent --zone=public --add-service=ftp success [root@localhost ~]# firewall-cmd --reload success [root@localhost ~]# getsebool -a | grep ftp ftpd_anon_write --> off ftpd_connect_all_unreserved --> off ftpd_connect_db --> off ftpd_full_access --> off ftpd_use_cifs --> off ftpd_use_fusefs --> off ftpd_use_nfs --> off ftpd_use_passive_mode --> off httpd_can_connect_ftp --> off httpd_enable_ftp_server --> off tftp_anon_write --> off tftp_home_dir --> off [root@localhost ~]# setsebool -P ftpd_full_access=on -P 永久生效,不然重启就没了 重启与开机自启服务 [root@localhost ~]# systemctl restart vsftpd [root@localhost ~]# systemctl enable vsftpd Created symlink /etc/systemd/system/multi-user.target.wants/vsftpd.service → /usr/lib/systemd/system/vsftpd.service. 测试 [root@localhost ~]# ftp localhost Trying ::1... Connected to localhost (::1). 220 (vsFTPd 3.0.3) Name (localhost:root): ftp1 331 Please specify the password. Password: 230 Login successful. Remote system type is UNIX. Using binary mode to transfer files. ftp> mkdir tt 257 "/tt" created 可以创建文件 ftp> quit 221 Goodbye. [root@localhost ~]# ftp localhost Trying ::1... Connected to localhost (::1). 220 (vsFTPd 3.0.3) Name (localhost:root): ftp2 331 Please specify the password. Password: 230 Login successful. Remote system type is UNIX. Using binary mode to transfer files. ftp> mkdir cc 550 Permission denied. 无权限创建文件 其余配置文件参数 自带 42 connect_from_port_20=YES 允许服务器主动模式(从20端口建立数据连接) 114 listen=NO 是否以独立运行方式监听服务 手打 pasv_enable=YES 允许服务器被动模式 listen_address=IP地址 设置要监听的IP地址 listen_port=21 设置FTP服务的监听端口 download_enable=YES 是否允许下载文件 max_clients=0 设置最大连接数,0为不限制 max_per_ip=0 同一IP的最大连接数,0为不限制 local_root=/home 限制本地用户活动目录 anon_root=/home 限制匿名用户活动目录 ftp连接后的基本命令 get 下载文件 put 上传文件 mget mput 一次下载 上传 多个文件 dir 查看当前目录下的目录 !dir 查看本地的 pwd 当前目录路径 lcd 更改到本地目录 bye 退出 配置文件详解 [root@localhost ~]# vim /etc/vsftpd/vsftpd.conf # Example config file /etc/vsftpd/vsftpd.conf # # The default compiled in settings are fairly paranoid. This sample file # loosens things up a bit, to make the ftp daemon more usable. # Please see vsftpd.conf.5 for all compiled in defaults. # # READ THIS: This example file is NOT an exhaustive list of vsftpd options. # Please read the vsftpd.conf.5 manual page to get a full idea of vsftpd's # capabilities. 匿名用户访问,YES是允许,NO是拒绝 # Allow anonymous FTP? (Beware - allowed by default if you comment this out). anonymous_enable=NO # Uncomment this to allow local users to log in. # 本地用户登录,YES是允许,NO是拒绝.默认访问的是本地用户家目录,如果你开启了selinux # 请设置开启布尔值ftp_home_dir为ON # When SELinux is enforcing check for SE bool ftp_home_dir local_enable=YES #允许本地用户上传 # Uncomment this to enable any form of FTP write command. write_enable=YES # Default umask for local users is 077. You may wish to change this to 022, # 上传的权限是022,使用的是umask权限。对应的目录是755,文件是644 # if your users expect that (022 is used by most other ftpd's) local_umask=022 # Uncomment this to allow the anonymous FTP user to upload files. This only # has an effect if the above global write enable is activated. Also, you will # obviously need to create a directory writable by the FTP user. # When SELinux is enforcing check for SE bool allow_ftpd_anon_write, allow_ftpd_full_access # 开启匿名用户上传功能,默认是拒绝的 #anon_upload_enable=YES # Uncomment this if you want the anonymous FTP user to be able to create # new directories. # 开启匿名用户创建文件或文件夹权限 #anon_mkdir_write_enable=YES # Activate directory messages - messages given to remote users when they # go into a certain directory. # 开启目录欢迎消息,一般对命令行登陆有效 dirmessage_enable=YES # Activate logging of uploads/downloads. # 开启上传和下载日志记录功能 xferlog_enable=YES #使用标准模式 # Make sure PORT transfer connections originate from port 20 (ftp-data). connect_from_port_20=YES # If you want, you can arrange for uploaded anonymous files to be owned by # a different user. Note! Using "root" for uploaded files is not # recommended! # 声明匿名用户上传文件的所有者 # 允许更改匿名用户上传文件的所有者 #chown_uploads=YES #所有者为whoever #chown_username=whoever # You may override where the log file goes if you like. The default is shown # below. # 日志文件路径 #xferlog_file=/var/log/xferlog # If you want, you can have your log file in standard ftpd xferlog format. # Note that the default log file location is /var/log/xferlog in this case. # 日志文件采用标准格斯 xferlog_std_format=YES # You may change the default value for timing out an idle session. # 会话超时时间 #idle_session_timeout=600 # You may change the default value for timing out a data connection. # 数据传输超时时间 #data_connection_timeout=120 # It is recommended that you define on your system a unique user which the # ftp server can use as a totally isolated and unprivileged user. # FTP子进程管理用户 #nopriv_user=ftpsecure # Enable this and the server will recognise asynchronous ABOR requests. Not # recommended for security (the code is non-trivial). Not enabling it, # however, may confuse older FTP clients. # 是否允许客户端发起“async ABOR”请求,该操作是不安全的默认禁止。 #async_abor_enable=YES # By default the server will pretend to allow ASCII mode but in fact ignore # the request. Turn on the below options to have the server actually do ASCII # mangling on files when in ASCII mode. The vsftpd.conf(5) man page explains # the behaviour when these options are disabled. # Beware that on some FTP servers, ASCII support allows a denial of service # attack (DoS) via the command "SIZE /big/file" in ASCII mode. vsftpd # predicted this attack and has always been safe, reporting the size of the # raw file. # ASCII mangling is a horrible feature of the protocol. # 该选项用于指定是否允许上传时以ASCII模式传输数据 #ascii_upload_enable=YES #该选项用于指定是否允许下载时以ASCII模式传输数据 #ascii_download_enable=YES # You may fully customise the login banner string: # FTP文本界面登陆欢迎词 #ftpd_banner=Welcome to blah FTP service. # You may specify a file of disallowed anonymous e-mail addresses. Apparently # useful for combatting certain DoS attacks. # 是否开启拒绝的Email功能 #deny_email_enable=YES # (default follows) # 指定保存被拒接的Email地址的文件 #banned_email_file=/etc/vsftpd/banned_emails # You may specify an explicit list of local users to chroot() to their home # directory. If chroot_local_user is YES, then this list becomes a list of # users to NOT chroot(). # (Warning! chroot'ing can be very dangerous. If using chroot, make sure that # the user does not have write access to the top level directory within the # chroot) # 是否开启对本地用户chroot的限制,YES为默认所有用户都不能切出家目录,NO代表默认用户都可以切出家目录 # 设置方法类似于:YES拒绝所有,允许个别 NO 允许所有拒绝个别 #chroot_local_user=YES #开启特例列表 #chroot_list_enable=YES # (default follows) # 如果chroot_local_user的值是YES则该文件中的用户是可以切出家目录,如果是NO,该文件中的用户则不能切出家目录 # 一行一个用户。 #chroot_list_file=/etc/vsftpd/chroot_list # You may activate the "-R" option to the builtin ls. This is disabled by # default to avoid remote users being able to cause excessive I/O on large # sites. However, some broken FTP clients such as "ncftp" and "mirror" assume # the presence of the "-R" option, so there is a strong case for enabling it. # 是否开启ls 递归查询功能 ls -R #ls_recurse_enable=YES # When "listen" directive is enabled, vsftpd runs in standalone mode and # listens on IPv4 sockets. This directive cannot be used in conjunction # with the listen_ipv6 directive. # 是否开启ftp独立模式在IPV4 listen=NO # This directive enables listening on IPv6 sockets. By default, listening # on the IPv6 "any" address (::) will accept connections from both IPv6 # and IPv4 clients. It is not necessary to listen on *both* IPv4 and IPv6 # sockets. If you want that (perhaps because you want to listen on specific # addresses) then you must run two copies of vsftpd with two configuration # files. # Make sure, that one of the listen options is commented !! # 是否开启ftp独立模式在ipv6 listen_ipv6=YES #启用pam模块验证 pam_service_name=vsftpd #是否开启userlist功能. #是否启用用户列表功能 userlist_enable=YES |
CopyRight 2018-2019 实验室设备网 版权所有 |