目標：
用源碼方式安裝vsftp,禁止匿名用戶使用FTP；新增系統用戶ftpdemo,並允許ftpdemo使用FTP,ftpdemo在自己的ftp目錄可以上傳、下載、刪除,除了自己的目錄外,ftpdemo看不到其他目錄.
網上相關的文章很多,而且都說比較簡單,但是我在安裝過程並不太順利,幾經周轉,終於讓我碰對了.回顧一下,把這簡單的事情搞複雜的關鍵是vsftp安裝完后,用的是默認的FTP隨xinetd一起啟動,當時覺得這個沒什麼關係,就一直沒改,後來一直配置不成功,實在找不出問題,就把啟動方式改成了獨立啟動,再配置,居然可以正常使用FTP了,
建議各位安裝完vsftp后最好修改成獨立啟動方式,否則下面的配置可能不生效.
安裝
我用的是源代碼安裝
vsftpd需要使用nobody來作為運行者,一般已經存在
#useradd nobody
安裝時需要/usr/share/empty/作為臨時目錄,一般已經存在
#mkdir /usr/share/empty/
解壓
#tar zxvf vsftpd-2.0.4.tar.gz
#cd vsftpd-2.0.4
編譯
#make
#make install
如果make install沒有安裝文件,你可能需要手動執行下面的命令
#cp vsftpd /usr/local/sbin/vsftpd
#cp vsftpd.conf.5 /usr/local/man/man5
#cp vsftpd.8 /usr/local/man/man8
#cp vsftpd.conf /etc
#cp vsftpd.xinetd /etc/xinetd.d/vsftpd
重啟xinetd
#/etc/rc.d/init.d/xinetd restart
安裝完畢
配置
設置為獨立啟動模式
安裝完成後,vsftp是默認隨xinetd一起啟動,最好改成獨立啟動（我就是吃了這個虧,但是覺得沒事,懶得改,導致後來配置總不成功,浪費了好多時間）.打開/etc/xinetd.d/vsftpd文件,把disable=no改成yes,
#vi /etc/xinetd.d/vsftpd
再在/etc/vsftpd.conf文件的
添加listen=yes,
#vi /etc/vsftpd.conf
這樣就改成了STANDALONE獨立模式.
現在我們手動啟動一下vsftp
xinetd已經啟動了vsftpd,而vsftpd設置成了stardalone模式,
,先停止xinetd服務,
#service xinetd stop
或者
#/etc/init.d/xinetd stop
然後後台執行啟動ftp服務
#/usr/local/sbin/vsftpd &
（記得把xinetd服務啟動/etc/init.d/xinetd start）
配置本地用戶登錄
現在的vsftp已經可以使用了,但是只允許匿名用戶登錄（默認配置）,這和我們的目標還有點距離,我們要讓本地用戶ftpdemo可以FTP登錄.
關閉匿名用戶登錄
出於安全性的考慮,我們不允許匿名用戶使用ftp,修改/etc/vsftpd.conf
#vi /etc/vsftpd.conf
找到anonymous_enable項,取消註釋,並把值改成no.重啟vsftp看看,這下匿名用戶不能登錄了.
讓本地用戶登錄,先修改配置
local_enable=YES
write_enable=YES
local_umask=022
使本地用戶能登錄FTP.按照上面的源碼安裝配置我們的FTP還不能讓本地用戶登
錄,
缺少一個認證PAM文件,在源碼目錄下有一個RedHat/vsftpd.pam認證文
件,把它複製到/etc/pam.d/ftp.
#cp RedHat/vsftpd.pam /etc/pam.d/ftp
測試一下,假設有一個本地用戶test,登錄FTP：
#ftp 127.0.0.1
Connected to 127.0.0.1 (127.0.0.1).
220 (vsFTPd 1.2.1)
Name (127.0.0.1:root): test
331 Please specify the password.
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
看來情況很好：)
新建系統用戶ftpdemo
#useradd -s /sbin/nologin -d /var/vhosts/www.gzfyw.com ftpdemo
-s /sbin/nologin 表示用戶只能FTP登錄,不能登錄系統
-d /var/vhosts/www.gzfyw.com 表示用戶主目錄,即登錄后的默認目錄,根據實際情況修改成你需要的路徑
如果上面的這條命令拷貝后執行出錯的話,建議你手動敲入,我就碰到過這種情況
安全起見,馬上給ftpdemo設置密碼
#passwd ftpdemo
修改ftp目錄的所屬者
#chown -R ftpdemo:ftpdemo /var/vhosts/www.gzfyw.com
如果你都執行正確的話,那現在ftpdemo可以FTP登錄了.開心啊...
限制用戶許可權
再用一會,你又會發現有另外一個問題,ftpdemo可以返回到ftp主目錄的上級目錄,這太不安全了,要把ftp用戶禁止在自己的目錄里,不讓他們亂跑,接下來做這個事情,
如果需要將用戶限制在自己的home文件夾中
在/etc/vsftpd.conf中,找到修改或者添加如下兩行
chroot_list_enable=YES
chroot_list_file=/etc/vsftpd.chroot_list
然後修改/創建/etc/vsftpd.chroot_list文件,在裡面加入你想要限制的用戶的用戶名,比如你的用戶名ftpdemo
kill掉vsftp進程,再重啟vsftp,看到了嗎,這下ftpdemo看不到ftp主目錄外的其他目錄,不能到處亂跑了,呵呵.
一次,把vsftp添加到開機啟動項
打開/etc/rc.local,在文件尾增加一行
/usr/local/sbin/vsftpd &
另外：我使用chkconfig vsftpd on總添加不成功
補充：
登錄后,發現FTP客戶端的時間和伺服器的時間不一樣
原因是vsftpd默認使用GMT作為其時間,
可能會導致與系統時間不一致（系統時間不是GMT）
解決方案：在vsftpd.conf文件中增加一行
use_localtime=yes
相關命令：
重啟xinetd服務
/etc/init.d/xinetd restart
查看啟動的ftp進程id
ps -ef | grep ftp
殺掉ftp進程
kill 123
在後台啟動vsftp
/usr/local/sbin/vsftpd &
查看自啟動項
chkconfig --list
新增用戶
useradd -s /sbin/nologin -d /var/vhosts/www.gzfyw.com ftpdemo
passwd ftpdemo
chown -R ftpdemo:ftpdemo /var/vhosts/www.gzfyw.com
vi /etc/vsftpd.chroot_list
附：/etc/vsftpd.conf
# Example config file /etc/vsftpd.conf
#
# The default compiled in settings are fairly paranoid. This sample file
# loosens things up a bit, to make the ftp daemon more usable.
# Please see vsftpd.conf.5 for all compiled in defaults.
#
# READ THIS: This example file is NOT an exhaustive list of vsftpd options.
# Please read the vsftpd.conf.5 manual page to get a full idea of vsftpd's
# capabilities.
#
# Allow anonymous FTP? (Beware - allowed by default if you comment this out).
anonymous_enable=NO
#
# Uncomment this to allow local users to log in.
local_enable=YES
#
# Uncomment this to enable any form of FTP write command.
write_enable=YES
#
# Default umask for local users is 077. You may wish to change this to 022,
# if your users expect that (022 is used by most other ftpd's)
local_umask=022
#
# Uncomment this to allow the anonymous FTP user to upload files. This only
# has an effect if the above global write enable is activated. Also, you will
# obviously need to create a directory writable by the FTP user.
#anon_upload_enable=YES
#
# Uncomment this if you want the anonymous FTP user to be able to create
# new directories.
#anon_mkdir_write_enable=YES
#
# Activate directory messages - messages given to remote users when they
# go into a certain directory.
dirmessage_enable=YES
#
# Activate logging of uploads/downloads.
xferlog_enable=YES
#
# Make sure PORT transfer connections originate from port 20 (ftp-data).
connect_from_port_20=YES
#
# If you want, you can arrange for uploaded anonymous files to be owned by
# a different user. Note! Using "root" for uploaded files is not
# recommended!
#chown_uploads=YES
#chown_username=whoever
#
# You may override where the log file goes if you like. The default is shown
# below.
#xferlog_file=/var/log/vsftpd.log
#
# If you want, you can have your log file in standard ftpd xferlog format
#xferlog_std_format=YES
#
# You may change the default value for timing out an idle session.
#idle_session_timeout=600
#
# You may change the default value for timing out a data connection.
#data_connection_timeout=120
#
# It is recommended that you define on your system a unique user which the
# ftp server can use as a totally isolated and unprivileged user.
#nopriv_user=ftpsecure
#
# Enable this and the server will recognise asynchronous ABOR requests. Not
# recommended for security (the code is non-trivial). Not enabling it,
# however, may confuse older FTP clients.
#async_abor_enable=YES
#
# By default the server will pretend to allow ASCII mode but in fact ignore
# the request. Turn on the below options to have the server actually do ASCII
# mangling on files when in ASCII mode.
# Beware that on some FTP servers, ASCII support allows a denial of service
# attack (DoS) via the command "SIZE /big/file" in ASCII mode. vsftpd
# predicted this attack and has always been safe, reporting the size of the
# raw file.
# ASCII mangling is a horrible feature of the protocol.
#ascii_upload_enable=YES
#ascii_download_enable=YES
#
# You may fully customise the login banner string:
ftpd_banner=Welcome to blah FTP service.
#
# You may specify a file of disallowed anonymous e-mail addresses. Apparently
# useful for combatting certain DoS attacks.
#deny_email_enable=YES
# (default follows)
#banned_email_file=/etc/vsftpd.banned_emails
#
# You may specify an explicit list of local users to chroot() to their home
# directory. If chroot_local_user is YES, then this list becomes a list of
# users to NOT chroot().
chroot_list_enable=YES
# (default follows)
chroot_list_file=/etc/vsftpd.chroot_list
#
# You may activate the "-R" option to the builtin ls. This is disabled by
# default to avoid remote users being able to cause excessive I/O on large
# sites. However, some broken FTP clients such as "ncftp" and "mirror" assume
# the presence of the "-R" option, so there is a strong case for enabling it.
#ls_recurse_enable=YES
listen=yes
use_localtime=yes
本文出自 「學習學習再學習」 博客,請務必保留此出處http://52study.blog.51cto.com/672057/438233
