Vsftpd安装配置

发表于 | 分类于 | 阅读次数

安装vsftp

1
yum install -y vsftpd

将vsftpd加入系统自启动，并启动服务

1
2
service vsftpd start
chkconfig --level 3 vsftpd on

配置文件：

/etc/vsftpd/vsftpd.conf //主配置文件
/etc/vsftpd/ftpusers //被禁止登录FTP的用户文件
/etc/vsftpd/user_list //允许登录FTP的用户文件
/etc/vsftpd/userconfig //用户目录配置文件

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
#匿名账号是否允许登陆
#anonymous_enable=YES
 
#设定本地用户可以访问。注：如使用虚拟宿主用户，在该项目设定为NO的情况下所有虚拟用户将无法访问。
local_enable=YES
 
#使用户不能离开主目录
#chroot_local_user=YES
 
#是否可以写入
write_enable=YES
 
# Default umask for local users is 077. You may wish to change this to 022,
# if your users expect that (022 is used by most other ftpd's)
#设定上传后文件的权限掩码
local_umask=022
#
# Uncomment this to allow the anonymous FTP user to upload files. This only
# has an effect if the above global write enable is activated. Also, you will
# obviously need to create a directory writable by the FTP user.
#匿名用户是否可以上传
#anon_upload_enable=YES
anon_upload_enable=NO
#
# Uncomment this if you want the anonymous FTP user to be able to create
# new directories.
#匿名用户是否可以建立目录
#anon_mkdir_write_enable=YES
anon_mkdir_write_enable=NO
#
# Activate directory messages - messages given to remote users when they
# go into a certain directory.
#进入每个目录是否显示欢迎信息，在每个目录下建立.message文件在里面写欢迎信息
dirmessage_enable=YES
#
# The target log file can be vsftpd_log_file or xferlog_file.
# This depends on setting xferlog_std_format parameter
#上传/下载文件时是否记录日志
xferlog_enable=YES
#
# Make sure PORT transfer connections originate from port 20 (ftp-data).
#是否使用port主动模式
port_enable=YES
#是否使用20端口传输数据
connect_from_port_20=YES
#不使用20端口时，指定port模式的端口号
#ftp_data_port=2020
#是否使用安全的port模式
port_promiscuous=NO
#
# If you want, you can arrange for uploaded anonymous files to be owned by
# a different user. Note! Using "root" for uploaded files is not
# recommended!
#匿名用户上传文件是否更改宿主
#chown_uploads=YES
#匿名用户上传文件宿主更改为谁
#chown_username=whoever
#
# The name of log file when xferlog_enable=YES and xferlog_std_format=YES
# WARNING - changing this filename affects /etc/logrotate.d/vsftpd.log
#设定Vsftpd的服务日志保存路径，需手动创建该文件并有写入权限
xferlog_file=/var/log/xferlog
#
# Switches between logging into vsftpd_log_file and xferlog_file files.
# NO writes to vsftpd_log_file, YES to xferlog_file
#设定日志使用标准的记录格式
xferlog_std_format=YES
#
# You may change the default value for timing out an idle session.
#设定空闲连接超时时间，如果不指定的话，还是使用这里的默认值600，单位秒
#idle_session_timeout=600
#
# You may change the default value for timing out a data connection.
#设定单次最大连续传输时间，如果不指定的话，还是使用这里的默认值120，单位秒
#data_connection_timeout=120
#
# It is recommended that you define on your system a unique user which the
# ftp server can use as a totally isolated and unprivileged user.
#设定支撑Vsftpd服务的宿主用户
#nopriv_user=ftpsecure
#
# Enable this and the server will recognise asynchronous ABOR requests. Not
# recommended for security (the code is non-trivial). Not enabling it,
# however, may confuse older FTP clients.
#设定是否支持异步传输功能
#async_abor_enable=YES
#
# By default the server will pretend to allow ASCII mode but in fact ignore
# the request. Turn on the below options to have the server actually do ASCII
# mangling on files when in ASCII mode.
# Beware that on some FTP servers, ASCII support allows a denial of service
# attack (DoS) via the command "SIZE /big/file" in ASCII mode. vsftpd
# predicted this attack and has always been safe, reporting the size of the
# raw file.
# ASCII mangling is a horrible feature of the protocol.
#设定支持ASCII模式的上传和下载功能
ascii_upload_enable=YES
ascii_download_enable=YES
 
# You may fully customise the login banner string:
#设定Vsftpd的登陆标语
#ftpd_banner=Welcome to blah FTP service.
#
# You may specify a file of disallowed anonymous e-mail addresses. Apparently
# useful for combatting certain DoS attacks.
#deny_email_enable=YES
# (default follows)
#banned_email_file=/etc/vsftpd/banned_emails
#
# You may specify an explicit list of local users to chroot() to their home
# directory. If chroot_local_user is YES, then this list becomes a list of
# users to NOT chroot().
#是否限制所有的本地用户在自家目录
#chroot_local_user=YES
#是否允许chroot_list中用户登出自己的FTP主目录
#chroot_list_enable=YES
# (default follows)
#配置chroot_list文件路径
#chroot_list_file=/etc/vsftpd/chroot_list
#
# You may activate the "-R" option to the builtin ls. This is disabled by
# default to avoid remote users being able to cause excessive I/O on large
# sites. However, some broken FTP clients such as "ncftp" and "mirror" assume
# the presence of the "-R" option, so there is a strong case for enabling it.
#是否允许使用ls -R命令，该命令会对服务器性能造成巨大开销
#ls_recurse_enable=YES
#
# When "listen" directive is enabled, vsftpd runs in standalone mode and
# listens on IPv4 sockets. This directive cannot be used in conjunction
# with the listen_ipv6 directive.
#开启ipv4监听
listen=YES
#设定ipv4监听端口
listen_port=2121
#
# This directive enables listening on IPv6 sockets. To listen on IPv4 and IPv6
# sockets, you must run two copies of vsftpd with two configuration files.
# Make sure, that one of the listen options is commented !!
#开启ipv6监听
#listen_ipv6=YES
 
#使用pam模块控制，vsftpd文件在/etc/pam.d目录下
pam_service_name=vsftpd
 
#userlist_enable、userlist_deny配合使用，userlist_enable选项被激活后，vsftpd将读取userlist_file参数所指定的文件中的用户列表，而userlist_deny选项定义list中用户是否被禁止登陆。当列表中的用户登录FTP服务器时，该用户在提示输入密码之前就被禁止了。即该用户名输入后，vsftpd查到该用户名在列表中，vsftpd就直接禁止掉该用户，不会再进行询问密码等后续步聚
#userlist_enable=YES
#userlist_file=/etc/vsftpd/vsftpd.user_list
#userlist_deny=YES
 
#是否允许tcp_wrappers管理
tcp_wrappers=YES
 
#所有用户的根目录，，对匿名用户无效
#local_root=/home/ftp
 
#匿名用户的最大传输速度，单位是Byts/s
#anon_max_rate=1024000
 
#本地用户的最大传输速度，单位是Byts/s
#local_max_rate=1024000
 
#是否使用pasv被动模式
pasv_enable=YES
#指定被动模式的最小、最大端口
pasv_min_port=2123
pasv_max_port=2125
#是否屏蔽对pasv进行安全检查
pasv_promiscuous=NO
#被动模式是否用设置好的的地址返回给客户端
#pasv_addr_resolve=YES
#服务器传回的ip地址，让客户端知道
#pasv_address=101.71.51.65

基于本地用户的Vsftp配置
Vsftp服务器配置详解