0410vsftpd.htm

鸟哥LINUX 学习课本

<font color="#000066" face="SimSun">使用 port 20 作为主动联机时的
ftp-data 传送埠口；</font></li>

<li>
<font color="#000066" face="SimSun">利用 /etc/hosts.allow(deny) 来管理登入权限；</font></li>

<li>
<font color="#000066" face="SimSun">当 Client 上传/下载档案时，该信息会记录在
/var/log/vsftpd.log 里面；</font></li>

<li>
<font color="#000066" face="SimSun">其它的设定均已默认值来规范(如被动式
port number 等等)。</font></li>
</ul>
　
<table bgcolor="#000000" border="1" cols="1" width="550">
<tbody><tr>
<td><font size="-1" face="SimSun"><font color="#ffffff">[root@test
root]#</font><font color="#ffff00"> vi /etc/xinetd.d/vsftpd</font></font>
<br><font size="-1" color="#ffff00" face="SimSun">service ftp</font>
<br><font size="-1" color="#ffff00" face="SimSun">{</font>
<br><font size="-1" color="#ffff00" face="SimSun">&#160;&#160;&#160;&#160;&#160;&#160;&#160;
socket_type&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;
= stream</font>
<br><font size="-1" color="#ffff00" face="SimSun">&#160;&#160;&#160;&#160;&#160;&#160;&#160;
wait&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;
= no</font>
<br><font size="-1" color="#ffff00" face="SimSun">&#160;&#160;&#160;&#160;&#160;&#160;&#160;
user&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;
= root</font>
<br><font size="-1" color="#ffff00" face="SimSun">&#160;&#160;&#160;&#160;&#160;&#160;&#160;
server&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;
= /usr/local/sbin/vsftpd</font>
<br><font size="-1" color="#ffff00" face="SimSun">&#160;&#160;&#160;&#160;&#160;&#160;&#160;
server_args&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;
= /etc/vsftpd.conf</font>
<br><font size="-1" color="#ff6666" face="SimSun"># 上面这个请依照您的主机环境来设定！尤其是
server_args 请设定您的</font>
<br><font size="-1" color="#ff6666" face="SimSun"># vsftpd.conf
所在目录的完整文件名(含目录名称)！</font>
<br><font size="-1" color="#ffff00" face="SimSun">&#160;&#160;&#160;&#160;&#160;&#160;&#160;
log_on_success&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160; +=
DURATION USERID</font>
<br><font size="-1" color="#ffff00" face="SimSun">&#160;&#160;&#160;&#160;&#160;&#160;&#160;
log_on_failure&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160; +=
USERID</font>
<br><font size="-1" color="#ffff00" face="SimSun">&#160;&#160;&#160;&#160;&#160;&#160;&#160;
nice&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;
= 10</font>
<br><font size="-1" color="#ffff00" face="SimSun">&#160;&#160;&#160;&#160;&#160;&#160;&#160;
disable&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;
= no</font>
<br><font size="-1" color="#ffff00" face="SimSun">}</font>
<br><font size="-1" face="SimSun"><font color="#ffffff">[root@test
root]# </font><font color="#ffff00">vi /etc/vsftpd/vsftpd.conf</font><font color="#ff6666">&#160;
# (或 /etc/vsftpd.conf)</font></font>
<br><font size="-1" color="#ff6666" face="SimSun"># 关于主机与安全性的设定</font>
<br><font size="-1" color="#ffff00" face="SimSun">use_localtime=YES</font>
<br><font size="-1" color="#ffff00" face="SimSun">dirmessage_enable=YES</font>
<br><font size="-1" color="#ffff00" face="SimSun">connect_from_port_20=YES</font>
<br><font size="-1" color="#ffff00" face="SimSun">xferlog_enable=YES</font>
<br><font size="-1" color="#ffff00" face="SimSun">xferlog_std_format=YES</font>
<br><font size="-1" color="#ffff00" face="SimSun">pam_service_name=vsftpd</font>
<br><font size="-1" color="#ffff00" face="SimSun">tcp_wrappers=YES</font>
<br><font size="-1" color="#ff6666" face="SimSun"># 关于 anonymous
的设定</font>
<br><font size="-1" color="#ffff00" face="SimSun">anonymous_enable=YES</font>
<br><font size="-1" color="#ff6666" face="SimSun"># 关于 real
user 的设定</font>
<br><font size="-1" color="#ffff00" face="SimSun">local_enable=YES</font>
<br><font size="-1" color="#ffff00" face="SimSun">write_enable=YES</font>
<br><font size="-1" color="#ffff00" face="SimSun">local_umask=022</font>
<br><font size="-1" color="#ffff00" face="SimSun">userlist_enable=YES</font>
<br><font size="-1" color="#ff6666" face="SimSun"># 以上设定值的意义请往前翻到
<a href="#server_vsftpd.conf">vsftpd.conf
设定值的意义</a> 章节去察看！</font>
<br><font size="-1" face="SimSun"><font color="#ffffff">[root@test
root]#</font><font color="#ffff00"> /etc/rc.d/init.d/xinetd restart</font></font></td>
</tr>
</tbody></table>
<font face="SimSun">　</font>
<br>这样您的最简易的 FTP 服务器就已经设定完成了！简单的很吧！而且还相当的安全呢！
<br>　
<br>
<hr width="100%"><a name="server_real_user"></a><font color="#000099">针对仅有开放实体用户登入的设定</font>
<br>　
<br>好了，这里我们再使用其它的设定值来修正我们的 vsftpd.conf 这个设定档。因为开放
anonymous 毕竟不太安全，所以我们将 anonymous 的登入权限关闭，并且仅让 real
user (实体用户) 登入我们的 vsftpd 时，要如何设定呢？我的要求如下：
<br>　
<ul>
<li>
<font color="#000066">使用台湾本地的时间而不是 GMT 时间；</font></li>

<li>
<font color="#000066">所有在 /etc/passwd 里面出现的实体账号均能登入 vsftpd
主机；</font></li>

<li>
<font color="#000066">但是系统账号 (如 root 等， UID 小于 500 的账号)均不能使用
vsftpd ；</font></li>

<li>
<font color="#000066">而且由于 badbird 与 nogoodbird 这两个账号使用者比较不乖，我要让这两个使用者被关在自己的家目录当中(chroot)；</font></li>

<li>
<font color="#000066">并且限制数据的传输速度为 100 Kbytes/second；</font></li>

<li>
<font color="#000066">当使用者进入 /home 这个目录时，显示：『一般使用者家目录』的字样在
Client 端的屏幕上；</font></li>

<li>
<font color="#000066">使用者可以进行上传、下载以及修改档案等等动作。</font></li>
</ul>
　
<table bgcolor="#000000" border="1" cols="1" width="550">
<tbody><tr>
<td><font size="-1" color="#ffffcc" face="SimSun">1. 基础设定档</font>
<br><font size="-1" face="SimSun"><font color="#ffffff">[root@test
root]# </font><font color="#ffff00">vi /etc/vsftpd/vsftpd.conf</font><font color="#ff6666">
(或 /etc/vsftpd.conf)</font></font>
<br><font size="-1" color="#ff6666" face="SimSun"># 关于主机与安全性的设定</font>
<br><font size="-1" color="#ffff00" face="SimSun">use_localtime=YES</font>
<br><font size="-1" color="#ffff00" face="SimSun">dirmessage_enable=YES</font>
<br><font size="-1" color="#ffff00" face="SimSun">xferlog_enable=YES</font>
<br><font size="-1" color="#ffff00" face="SimSun">connect_from_port_20=YES</font>
<br><font size="-1" color="#ffff00" face="SimSun">pam_service_name=vsftpd</font>
<br><font size="-1" color="#ffff00" face="SimSun">tcp_wrappers=YES</font>
<br><font size="-1" color="#ff6666" face="SimSun"># 关于 anonymous
的设定</font>
<br><font size="-1" color="#ffff00" face="SimSun">anonymous_enable=NO</font>
<br><font size="-1" color="#ff6666" face="SimSun"># 关于 Real
User 的设定</font>
<br><font size="-1" color="#ffff00" face="SimSun">local_enable=YES</font>
<br><font size="-1" color="#ffff00" face="SimSun">write_enable=YES</font>
<br><font size="-1" color="#ffff00" face="SimSun">local_umask=022</font>
<br><font size="-1" color="#ffff00" face="SimSun">chroot_list_enable=YES</font>
<br><font size="-1" color="#ffff00" face="SimSun">chroot_list_file=/etc/vsftpd.chroot_list</font>
<br><font size="-1" color="#ffff00" face="SimSun">userlist_deny=YES</font>
<br><font size="-1" color="#ffff00" face="SimSun">userlist_file=/etc/vsftpd.user_list</font>
<br><font size="-1" color="#ffff00" face="SimSun">local_max_rate=100000</font>
<br><font size="-1" color="#ff6666" face="SimSun"># 以上设定值的意义请往前翻到
<a href="#server_vsftpd.conf">vsftpd.conf
设定值的意义</a> 章节去察看！</font>
<br><font size="-1" color="#ffff00" face="SimSun">　</font>
<br><font size="-1" color="#ffffcc" face="SimSun">2. 限制实体用户在自己的家目录内
(chroot) 的设定档</font>
<br><font size="-1" face="SimSun"><font color="#ffffff">[root@test
root]#</font><font color="#ffff00"> vi /etc/vsftpd.chroot_list</font></font>
<br><font size="-1" color="#ffff00" face="SimSun">badbird</font>
<br><font size="-1" color="#ffff00" face="SimSun">nogoodbird</font>
<br><font size="-1" color="#ff6666" face="SimSun"># 没有写到这个档案内的其它用户，就可以离开自己的家目录，</font>
<br><font size="-1" color="#ff6666" face="SimSun"># 而到其它目录里面去浏览了！</font>
<br><font size="-1" color="#ffff00" face="SimSun">　</font>
<br><font size="-1" color="#ffffcc" face="SimSun">3. 以 PAM 模块限制某些账号无法登入主机的设定：</font>
<br><font size="-1" face="SimSun"><font color="#ffffff">[root@test
root]#</font><font color="#ffff00"> vi /etc/pam.d/vsftpd</font></font>
<br><font size="-1" color="#ff6666" face="SimSun"># 会发现这样的字句：</font>
<br><font size="-1" color="#ffffff" face="SimSun">auth .....
file=/etc/vsftpd.ftpusers ....</font>
<br><font size="-1" color="#ff6666" face="SimSun"># 那个 file=..
后面接的文件名就是以 PAM 模块抵挡的账号内容了！</font>
<br><font size="-1" face="SimSun"><font color="#ffffff">[root@test
root]# </font><font color="#ffff00">vi /etc/vsftpd.ftpusers</font></font>
<br><font size="-1" color="#ff6666" face="SimSun"># 底下列出的账号将无法使用
vsftpd 喔！与 wu ftp 的 /etc/ftpusers 相同功能</font>
<br><font size="-1" color="#ffffff" face="SimSun">root</font>
<br><font size="-1" color="#ffffff" face="SimSun">bin</font>
<br><font size="-1" color="#ffffff" face="SimSun">daemon</font>
<br><font size="-1" color="#ffffff" face="SimSun">adm</font>
<br><font size="-1" color="#ffffff" face="SimSun">lp</font>
<br><font size="-1" color="#ffffff" face="SimSun">sync</font>
<br><font size="-1" color="#ffffff" face="SimSun">shutdown</font>
<br><font size="-1" color="#ffffff" face="SimSun">halt</font>
<br><font size="-1" color="#ffffff" face="SimSun">mail</font>
<br><font size="-1" color="#ffffff" face="SimSun">news</font>
<br><font size="-1" color="#ffffff" face="SimSun">uucp</font>
<br><font size="-1" color="#ffffff" face="SimSun">operator</font>
<br><font size="-1" color="#ffffff" face="SimSun">games</font>
<br><font size="-1" color="#ffffff" face="SimSun">nobody</font>
<br><font size="-1" color="#ffffff" face="SimSun">　</font>
<br><font size="-1" color="#ffffcc" face="SimSun">4. 以 userlist_file
抵挡某些账号的登入：</font>
<br><font size="-1" color="#ffffcc" face="SimSun"># 事实上，这个功能与上面的
PAM 功能相似啦！只是 PAM 是外挂的，而</font>
<br><font size="-1" color="#ffffcc" face="SimSun"># 这个设定是
vsftpd 预设提供的就是了！</font>
<br><font size="-1" face="SimSun"><font color="#ffffff">[root@test
root]# </font><font color="#ffff00">vi /etc/vsftpd.user_list</font></font>
<br><font size="-1" color="#ff6666" face="SimSun"># 这个档案的设定与上面
/etc/vsftpd.ftpusers 相同即可！</font>
<br><font size="-1" color="#ffffff" face="SimSun">root</font>
<br><font size="-1" color="#ffffff" face="SimSun">bin</font>
<br><font size="-1" color="#ffffff" face="SimSun">daemon</font>
<br><font size="-1" color="#ffffff" face="SimSun">adm</font>
<br><font size="-1" color="#ffffff" face="SimSun">lp</font>
<br><font size="-1" color="#ffffff" face="SimSun">sync</font>
<br><font size="-1" color="#ffffff" face="SimSun">shutdown</font>
<br><font size="-1" color="#ffffff" face="SimSun">halt</font>
<br><font size="-1" color="#ffffff" face="SimSun">mail</font>
<br><font size="-1" color="#ffffff" face="SimSun">news</font>
<br><font size="-1" color="#ffffff" face="SimSun">uucp</font>
<br><font size="-1" color="#ffffff" face="SimSun">operator</font>
<br><font size="-1" color="#ffffff" face="SimSun">games</font>
<br><font size="-1" color="#ffffff" face="SimSun">nobody</font>
<br><font size="-1" color="#ffffff" face="SimSun">　</font>