[介紹] Centos 下建置 vsftpd virtual user 虛擬用戶

[root@localhost ~]# vim /etc/vsftp/vsftpd.conf

# Example config file /etc/vsftpd/vsftpd.conf

#

# The default compiled in settings are fairly paranoid. This sample file

# loosens things up a bit, to make the ftp daemon more usable.

# Please see vsftpd.conf.5 for all compiled in defaults.

#

# READ THIS: This example file is NOT an exhaustive list of vsftpd options.

# Please read the vsftpd.conf.5 manual page to get a full idea of vsftpd's

# capabilities.

#

# Allow anonymous FTP? (Beware – allowed by default if you comment this out).

# 設定不允許匿名訪問

anonymous_enable=NO

#

# Uncomment this to allow local users to log in.

# 設定本地用戶可以訪問。

# 注意：主要是為虛擬宿主用戶，如果該項目設定為NO那麼所有虛擬用戶將無法訪問。

local_enable=YES

#

# Uncomment this to enable any form of FTP write command.

# 設定可以進行寫操作。

write_enable=YES

#

# Default umask for local users is 077. You may wish to change this to 022,

# if your users expect that (022 is used by most other ftpd's)

# 設定上傳後文件的權限掩碼。

local_umask=022

#

# Uncomment this to allow the anonymous FTP user to upload files. This only

# has an effect if the above global write enable is activated. Also, you will

# obviously need to create a directory writable by the FTP user.

# 禁止匿名用戶上傳

anon_upload_enable=NO

#

# Uncomment this if you want the anonymous FTP user to be able to create

# new directories.

# 匿名用戶不可以建目錄

anon_mkdir_write_enable=NO

# 匿名用戶不可以寫入

anon_other_write_enable=NO

#

# Activate directory messages – messages given to remote users when they

# go into a certain directory.

# 設定開啟目錄標語功能

dirmessage_enable=YES

#

# The target log file can be vsftpd_log_file or xferlog_file.

# This depends on setting xferlog_std_format parameter

# 設定開啟LOG記錄

xferlog_enable=YES

#

# Make sure PORT transfer connections originate from port 20 (ftp-data).

# 設定連接PORT為20

connect_from_port_20=YES

#

# If you want, you can arrange for uploaded anonymous files to be owned by

# a different user. Note! Using "root" for uploaded files is not

# recommended!

# 設定禁止上傳文件更改宿主屬性

chown_uploads=NO

#chown_username=whoever

#

# The name of log file when xferlog_enable=YES and xferlog_std_format=YES

# WARNING – changing this filename affects /etc/logrotate.d/vsftpd.log

# 設定Vsftpd的服務日誌保存路徑。

# 注意，該文件預設不存在。要手動建立，由於更改了Vsftpd的宿主帳號，為手動建立的faq

# 必須修改LOG的寫入權限，否則服務將啟動失敗

xferlog_file=/var/log/vsftpd.log

#

# Switches between logging into vsftpd_log_file and xferlog_file files.

# NO writes to vsftpd_log_file, YES to xferlog_file

# 使用標準log格式

xferlog_std_format=YES

#

# You may change the default value for timing out an idle session.

# Server與Client的資料連線已經成功建立(不論主動還是被動連線)，

# Client在時間內都沒有命令動作，強制離線，預設的時間為600秒

#idle_session_timeout=600

#

# You may change the default value for timing out a data connection.

# 簡單來說就是單次最大連續傳輸時間，超過時間而無動作的話就會被強制斷線，預設為120秒

#data_connection_timeout=120

#

# It is recommended that you define on your system a unique user which the

# ftp server can use as a totally isolated and unprivileged user.

# 設定Vsftpd服務的宿主帳號為手動建立的Vsftpd用戶。

nopriv_user=vsftpd

#

# Enable this and the server will recognise asynchronous ABOR requests. Not

# recommended for security (the code is non-trivial). Not enabling it,

# however, may confuse older FTP clients.

# 設定支持異步傳輸功能

async_abor_enable=YES

#

# By default the server will pretend to allow ASCII mode but in fact ignore

# the request. Turn on the below options to have the server actually do ASCII

# mangling on files when in ASCII mode.

# Beware that on some FTP servers, ASCII support allows a denial of service

# attack (DoS) via the command "SIZE /big/file" in ASCII mode. vsftpd

# predicted this attack and has always been safe, reporting the size of the

# raw file.

# ASCII mangling is a horrible feature of the protocol.

# 設定支持ASCII模式的上傳和下載功能

ascii_upload_enable=YES

ascii_download_enable=YES

#

# You may fully customise the login banner string:

# 設定Vsftpd的登入歡迎辭

ftpd_banner=Welcome the Login ADJ of the FTP SERVER.

#

# You may specify a file of disallowed anonymous e-mail addresses. Apparently

# useful for combatting certain DoS attacks.

#deny_email_enable=YES

# (default follows)

#banned_email_file=/etc/vsftpd/banned_emails

#

# You may specify an explicit list of local users to chroot() to their home

# directory. If chroot_local_user is YES, then this list becomes a list of

# users to NOT chroot().

# 禁止用戶登出自己的FTP主目錄

chroot_list_enable=NO

# (default follows)

#chroot_list_file=/etc/vsftpd/chroot_list

#

# You may activate the "-R" option to the builtin ls. This is disabled by

# default to avoid remote users being able to cause excessive I/O on large

# sites. However, some broken FTP clients such as "ncftp" and "mirror" assume

# the presence of the "-R" option, so there is a strong case for enabling it.

# 禁止用戶登陸FTP後使用"ls -R"的命令。該命令會對Server性能造成負擔。

ls_recurse_enable=NO

#

# When "listen" directive is enabled, vsftpd runs in standalone mode and

# listens on IPv4 sockets. This directive cannot be used in conjunction

# with the listen_ipv6 directive.

# 若設定為YES表示vsftpd是以stand alone來啟動。若是NO就以super daemon來啟動

# 所謂StandAlone模式就是該服務擁有自己的程序。則SuperDaemon模式，而是由Xinetd來代替

# 同時Vsftp服務的許多功能將無法使用。

listen=YES

# vsftp所使用的命令通到port。此port可依各人需求更改。

listen_port=21

#

# This directive enables listening on IPv6 sockets. To listen on IPv4 and IPv6

# sockets, you must run two copies of vsftpd whith two configuration files.

# Make sure, that one of the listen options is commented !!

# 不監聽ipv6

listen_ipv6=NO

# 這個是pam模組的名稱，PAM驗證將參考/etc/pam.d/下的vsftpd文件配置

pam_service_name=vsftpd

# userlist_file中的User不得使用FTP

userlist_enable=YES

# 設定支持TCP Wrappers

tcp_wrappers=YES

# 不可離開家目錄

chroot_local_user=YES

# 設定啟用虛擬用戶功能

guest_enable=YES

# 指定虛擬用戶的宿主用戶

guest_username=vsftpduser

# 設定虛擬用戶的權限和宿主帳號的一樣

virtual_use_local_privs=YES

# 設定虛擬用戶個人Vsftp的配置文件存放路徑。

# 需要注意的地方就是這些配置文件名必須和虛擬用戶名相同。

user_config_dir=/etc/vsftpd/vconf

#指定連接PORT的範圍，才不會因PORT亂跳，不好設定防火牆

pasv_enable=YES

pasv_min_port=65400

pasv_max_port=65410

# 使用當地時間

use_localtime=YES

[root@localhost ~]#  vi /etc/pam.d/vsftpd

#%PAM-1.0

#session    optional     pam_keyinit.so    force revoke

#auth       required    pam_listfile.so item=user sense=deny file=/etc/vsftpd/ftpusers onerr=succeed

#auth       required    pam_shells.so

#auth       include     system-auth

#account    include     system-auth

#session    include     system-auth

#session    required     pam_loginuid.so

auth       required    /lib/security/pam_userdb.so    db=/etc/vsftpd/ftp-userlist

account    required    /lib/security/pam_userdb.so    db=/etc/vsftpd/ftp-userlist

[root@localhost ~]#  vi /etc/pam.d/vsftpd

#%PAM-1.0

#session    optional     pam_keyinit.so    force revoke

#auth       required    pam_listfile.so item=user sense=deny file=/etc/vsftpd/ftpusers onerr=succeed

#auth       required    pam_shells.so

#auth       include     system-auth

#account    include     system-auth

#session    include     system-auth

#session    required     pam_loginuid.so

auth       required    /lib64/security/pam_userdb.so    db=/etc/vsftpd/ftp-userlist

account    required    /lib64/security/pam_userdb.so    db=/etc/vsftpd/ftp-userlist

# 一般user權限，能下載、上傳和刪除

# 檔案存放路徑(若設定的路徑內，沒有指定的資料夾時，請自行建立)

local_root=/home/upload/

# 設定不允許匿名用戶訪問。

anonymous_enable=NO

# 設定Vsftpd服務的宿主帳號為手動建立的Vsftpd用戶。

nopriv_user=vsftpd

# 指定虛擬用戶的宿主用戶

guest_username=vsftpduser

#設定是否允許寫操作

write_enable=YES

#設定是否允許下載

download_enable=YES

#設定上傳文件權限掩碼

local_umask=022

#當使用者進入某個目錄時，會顯示該目錄需要注意的內容

dirmessage_enable=YES

#當設定為 YES 時，使用者上傳與下載檔案都會被紀錄起來

xferlog_enable=YES

#這就是 ftp-data 的埠號

connect_from_port_20=YES

# Standard Format

xferlog_std_format=YES 

#若設定為 YES 表示 vsftpd 是以 standalone 的方式來啟動的

listen=YES

#這個是 pam 模組的名稱，我們放置在 /etc/pam.d/vsftpd

pam_service_name=vsftpd

#是否藉助 vsftpd 的抵擋機制來處理某些不受歡迎的帳號

userlist_enable=YES

#支援 TCP Wrappers

tcp_wrappers=YES

#限制空閒連接時間

idle_session_timeout=600

#設定單次連續傳輸最大時間

data_connection_timeout=120

#設定同時客戶端連線數

max_clients=5

#限制單一客戶端最大連線數

max_per_ip=10

#設定該用戶的最大傳輸速率 單位b/s

local_max_rate=600000

#將使用者限制在自己的家目錄之內(chroot)

chroot_local_user=YES

#設定匿名是否可讀檔

anon_world_readable_only=NO

#是否讓 anonymous 具有上傳資料的功能，預設是 NO

anon_upload_enable=NO

#是否讓 anonymous 具有建立目錄的權限？預設值是 NO

anon_mkdir_write_enable=NO

#是否允許 anonymous 具有寫入的權限？預設是 NO

anon_other_write_enable=NO

# Allow FTP

iptables -A INPUT -p tcp --dport 20 -j ACCEPT

iptables -A INPUT -p tcp --dport 21 -j ACCEPT

iptables -A INPUT -p tcp --dport 65400:65410 -j ACCEPT