美文网首页
CentOS7 搭建FTP服务器

CentOS7 搭建FTP服务器

作者: 申申申申申 | 来源:发表于2018-01-02 22:09 被阅读58次
  • 系统版本
  • 安装 vsftpd
  • 卸载 vsftpd
  • vsftpd.conf 说明

系统版本

[root@shenfeng ~]# lsb_release -a
LSB Version:    :core-4.1-amd64:core-4.1-noarch
Distributor ID: CentOS
Description:    CentOS Linux release 7.3.1611 (Core) 
Release:    7.3.1611
Codename:   Core
[root@shenfeng ~]# 

安装 vsftpd

  1. 查看是否已经安装vsftpd
# 方法1
[root@shenfeng ~]# rpm -q vsftpd
vsftpd-3.0.2-22.el7.x86_64
[root@shenfeng ~]# 

#方法2
[root@shenfeng ~]# vsftpd -v
vsftpd: version 3.0.2
[root@shenfeng ~]# 
  1. 如果没有安装
[root@shenfeng ~]# yum -y install vsftpd
已加载插件:fastestmirror
base                                                                                                                 | 3.6 kB  00:00:00     
epel                                                                                                                 | 4.7 kB  00:00:00     
extras                                                                                                               | 3.4 kB  00:00:00     
gitlab_gitlab-ee/x86_64/signature                                                                                    |  836 B  00:00:00     
gitlab_gitlab-ee/x86_64/signature                                                                                    | 1.0 kB  00:00:00 !!! 
gitlab_gitlab-ee-source/signature                                                                                    |  836 B  00:00:00     
gitlab_gitlab-ee-source/signature                                                                                    |  951 B  00:00:00 !!! 
mysql-connectors-community                                                                                           | 2.5 kB  00:00:00     
mysql-tools-community                                                                                                | 2.5 kB  00:00:00     
mysql56-community                                                                                                    | 2.5 kB  00:00:00     
updates                                                                                                              | 3.4 kB  00:00:00     
Loading mirror speeds from cached hostfile
正在解决依赖关系
--> 正在检查事务
---> 软件包 vsftpd.x86_64.0.3.0.2-22.el7 将被 安装
--> 解决依赖关系完成

依赖关系解决

============================================================================================================================================
 Package                         架构                            版本                                   源                             大小
============================================================================================================================================
正在安装:
 vsftpd                          x86_64                          3.0.2-22.el7                           base                          169 k

事务概要
============================================================================================================================================
安装  1 软件包

总下载量:169 k
安装大小:348 k
Downloading packages:
vsftpd-3.0.2-22.el7.x86_64.rpm                                                                                       | 169 kB  00:00:00     
Running transaction check
Running transaction test
Transaction test succeeded
Running transaction
警告:RPM 数据库已被非 yum 程序修改。
  正在安装    : vsftpd-3.0.2-22.el7.x86_64                                                                                              1/1 
  验证中      : vsftpd-3.0.2-22.el7.x86_64                                                                                              1/1 

已安装:
  vsftpd.x86_64 0:3.0.2-22.el7                                                                                                              

完毕!
[root@shenfeng ~]# 
  1. 查看位置
[root@shenfeng ~]# whereis vsftpd
vsftpd: /usr/sbin/vsftpd /etc/vsftpd /usr/share/man/man8/vsftpd.8.gz
[root@shenfeng ~]# 
  1. 修改配置 vim /etc/vsftpd/vsftpd.conf
  • 不允许匿名访问
    anonymous_enable=NO
  • 允许使用本地帐户进行FTP用户登录验证
    local_enable=YES
  • 设定支持ASCII模式的上传和下载功能
    ascii_upload_enable=YES
    ascii_download_enable=YES
  • 使用户不能离开主目录
    chroot_list_enable=YES chroot_local_user=YES
    /etc/vsftpd.chroot_list 文件中列出的用户 可以切换到其他目录
    未在文件中列出的用户 不能切换到其他目录
    chroot_local_user=YES
    chroot_list_enable=YES
    chroot_list_file=/etc/vsftpd/chroot_list
    在配置文件最后添加 allow_writeable_chroot=YES
    如果 /etc/vsftpd/chroot_list 不存在 则需要创建该文件
  1. 重启 vsftpd.service
# systemctl enable vsftpd.service    设置vsftpd开机自启动
[root@shenfeng vsftpd]# systemctl start vsftpd.service
[root@shenfeng vsftpd]#
  1. 新建 ftp 用户
[root@shenfeng vsftpd]# useradd -d /var/ftp/public_root -g ftp -s /sbin/nologin ftpff01
[root@shenfeng vsftpd]# 
[root@shenfeng vsftpd]# passwd ftpff01
新的 密码:
重新输入新的 密码:
passwd:所有的身份验证令牌已经成功更新。
[root@shenfeng vsftpd]# 
  1. ftp主动模式
    如果未启动防火墙,就可以直接访问了
    如果使用的是 iptables 防火墙。配置iptablesvim /etc/sysconfig/iptables
    新加 -A INPUT -m state --state NEW -m tcp -p tcp --dport 21 -j ACCEPT 开放21端口
    systemctl restart iptables.service
    如果使用ECS 在安全组规则配置允许21端口访问
    以阿里云为例 实例-管理-安全组-配置规则 在入方向添加21 port
  2. ftp 被动模式
  • vim /etc/vsftpd/vsftpd.conf
    关闭掉vsftpd的主动模式 connect_from_port_20=NO
    添加
    pasv_enable=YES 使vsftpd运行在被动模式
    pasv_min_port=9000 被动模式最小端口号9000
    pasv_max_port=9100 被动模式最大端口号9100
  • 如果使用的是iptables防火墙
    编辑iptables配置文件 vim /etc/sysconfig/iptables
    添加
    -A INPUT -p tcp -m state --state NEW -m tcp --dport 21 -j ACCEPT 开放ftp协议21端口
    -A INPUT -p tcp --dport 9000:9100 -j ACCEPT 开放9000-9100号端口
    重启服务 systemctl restart iptables.service
  • 如果使用ECS
    在安全组规则配置允许21和9000-9100端口访问
    以阿里云为例 实例-管理-安全组-配置规则 在入方向添加21/21和9000/9100

卸载 vsftpd

  1. 查看当前服务器中的vsftpd
[root@shenfeng ~]# rpm -qa | grep vsftpd
vsftpd-3.0.2-22.el7.x86_64
  1. 执行卸载 卸载时自动备份
[root@shenfeng ~]# rpm -e vsftpd-3.0.2-22.el7.x86_64
警告:/etc/vsftpd/vsftpd.conf 已另存为 /etc/vsftpd/vsftpd.conf.rpmsave
[root@shenfeng ~]# 
  1. 删除遗留的文件
[root@shenfeng ~]# rm -rf /etc/vsftpd
[root@shenfeng ~]# 
  1. 删除用户
[root@shenfeng ~]# userdel ftpff01
[root@shenfeng ~]# 

vsftpd.conf 说明

  1 # Example config file /etc/vsftpd/vsftpd.conf
  2 #
  3 # The default compiled in settings are fairly paranoid. This sample file
  4 # loosens things up a bit, to make the ftp daemon more usable.
  5 # Please see vsftpd.conf.5 for all compiled in defaults.
  6 #
  7 # READ THIS: This example file is NOT an exhaustive list of vsftpd options.
  8 # Please read the vsftpd.conf.5 manual page to get a full idea of vsftpd's
  9 # capabilities.
 10 #

允许匿名登陆

 11 # Allow anonymous FTP? (Beware - allowed by default if you comment this out).
 12 anonymous_enable=YES
 13 #

允许本地帐户登陆

 14 # Uncomment this to allow local users to log in.
 15 # When SELinux is enforcing check for SE bool ftp_home_dir
 16 local_enable=YES
 17 #

允许本地帐户删除和修改文件

 18 # Uncomment this to enable any form of FTP write command.
 19 write_enable=YES
 20 #

FTP上本地的文件权限,�默认是077

 21 # Default umask for local users is 077. You may wish to change this to 022,
 22 # if your users expect that (022 is used by most other ftpd's)
 23 local_umask=022
 24 #

允许匿名用户上传权限

 25 # Uncomment this to allow the anonymous FTP user to upload files. This only
 26 # has an effect if the above global write enable is activated. Also, you will
 27 # obviously need to create a directory writable by the FTP user.
 28 # When SELinux is enforcing check for SE bool allow_ftpd_anon_write, allow_ftpd_full_access
 29 #anon_upload_enable=YES
 30 #

允许匿名用户创建目录的同时可以在此目录中上传文件

 31 # Uncomment this if you want the anonymous FTP user to be able to create
 32 # new directories.
 33 #anon_mkdir_write_enable=YES
 34 #

切换目录时,显示目录下.message的内容

 35 # Activate directory messages - messages given to remote users when they
 36 # go into a certain directory.
 37 dirmessage_enable=YES
 38 #

激活上传和下传的日志

 39 # Activate logging of uploads/downloads.
 40 xferlog_enable=YES
 41 #

主动模式

 42 # Make sure PORT transfer connections originate from port 20 (ftp-data).
 43 connect_from_port_20=YES
 44 #

开启上传后更改文件所属权

 45 # If you want, you can arrange for uploaded anonymous files to be owned by
 46 # a different user. Note! Using "root" for uploaded files is not
 47 # recommended!
 48 #chown_uploads=YES

上传后更改文件所属权的用户名

 49 #chown_username=whoever
 50 #

日志文件

 51 # You may override where the log file goes if you like. The default is shown
 52 # below.
 53 #xferlog_file=/var/log/xferlog
 54 #

使用标准的日志格式

 55 # If you want, you can have your log file in standard ftpd xferlog format.
 56 # Note that the default log file location is /var/log/xferlog in this case.
 57 xferlog_std_format=YES
 58 #

用户会话空闲后10分钟(秒)

 59 # You may change the default value for timing out an idle session.
 60 #idle_session_timeout=600
 61 #

将数据连接空闲2分钟断(秒)

 62 # You may change the default value for timing out a data connection.
 63 #data_connection_timeout=120
 64 #

???

 65 # It is recommended that you define on your system a unique user which the
 66 # ftp server can use as a totally isolated and unprivileged user.
 67 #nopriv_user=ftpsecure
 68 #

允许使用 async ABOR 命令,一般不用,容易出问题

 69 # Enable this and the server will recognise asynchronous ABOR requests. Not
 70 # recommended for security (the code is non-trivial). Not enabling it,
 71 # however, may confuse older FTP clients.
 72 #async_abor_enable=YES
 73 #

启用上传的ascii传输方式
启用下载的ascii传输方式

 74 # By default the server will pretend to allow ASCII mode but in fact ignore
 75 # the request. Turn on the below options to have the server actually do ASCII
 76 # mangling on files when in ASCII mode.
 77 # Beware that on some FTP servers, ASCII support allows a denial of service
 78 # attack (DoS) via the command "SIZE /big/file" in ASCII mode. vsftpd
 79 # predicted this attack and has always been safe, reporting the size of the
 80 # raw file.
 81 # ASCII mangling is a horrible feature of the protocol.
 82 #ascii_upload_enable=YES
 83 #ascii_download_enable=YES
 84 #

显示欢迎信息

 85 # You may fully customise the login banner string:
 86 #ftpd_banner=Welcome to blah FTP service.
 87 #

???

 88 # You may specify a file of disallowed anonymous e-mail addresses. Apparently
 89 # useful for combatting certain DoS attacks.
 90 #deny_email_enable=YES

???

 91 # (default follows)
 92 #banned_email_file=/etc/vsftpd/banned_emails
 93 #

限制本地所有帐户只能在自己的目录中

 94 # You may specify an explicit list of local users to chroot() to their home
 95 # directory. If chroot_local_user is YES, then this list becomes a list of
 96 # users to NOT chroot().
 97 # (Warning! chroot'ing can be very dangerous. If using chroot, make sure that
 98 # the user does not have write access to the top level directory within the
 99 # chroot)
100 #chroot_local_user=YES

文件中的名单可以调用

101 #chroot_list_enable=YES
102 # (default follows)

用户列表文件,生效前提是 chroot_local_user=NO

103 #chroot_list_file=/etc/vsftpd/chroot_list
104 #

是否能使用ls -R命令以防止浪费大量的服务器资源

105 # You may activate the "-R" option to the builtin ls. This is disabled by
106 # default to avoid remote users being able to cause excessive I/O on large
107 # sites. However, some broken FTP clients such as "ncftp" and "mirror" assume
108 # the presence of the "-R" option, so there is a strong case for enabling it.
109 #ls_recurse_enable=YES
110 #

独立的vsftpd服务器

111 # When "listen" directive is enabled, vsftpd runs in standalone mode and
112 # listens on IPv4 sockets. This directive cannot be used in conjunction
113 # with the listen_ipv6 directive.
114 listen=NO
115 #

???

116 # This directive enables listening on IPv6 sockets. By default, listening
117 # on the IPv6 "any" address (::) will accept connections from both IPv6
118 # and IPv4 clients. It is not necessary to listen on *both* IPv4 and IPv6
119 # sockets. If you want that (perhaps because you want to listen on specific
120 # addresses) then you must run two copies of vsftpd with two configuration
121 # files.
122 # Make sure, that one of the listen options is commented !!
123 listen_ipv6=YES
124 

定义PAM所使用的名称,预设为vsftpd

125 pam_service_name=vsftpd

开启userlist_file进行访问限制,且开启后,userlist_deny选项才生效

126 userlist_enable=YES

开启tcp_wrappers支持

127 tcp_wrappers=YES

不定期更新 不合适的地方 还请指点~ 感激不尽

相关文章

  • ftp服务器的搭建-linux

    一、前言 企业中linux搭建ftp服务器还是很实用的,所以本文针对centos7和centos6搭建ftp服务器...

  • Google Cloud 搭建ftp服务

    开放防火墙: 21端口 流程如下: Centos7安装搭建FTP服务器(最简便方法) PASV被动模式 https...

  • 自动化安装linux(2)

    接下来,我们就尝试一下,如何用光盘引导启动,并选择ftp方式安装。 一、搭建ftp服务器 ftp服务器搭建,可以参...

  • 服务器的搭建

    FTP服务器的搭建 搭建FTP服务器要用到Ser-U软件,下载好安装包以后双击安装,打开软件配置服务器 然后要设置...

  • CentOS搭建FTP服务

    Linux 云服务器搭建 FTP 服务 操作场景 Vsftpd(very secure FTP daemon)是众...

  • FTP客户端(FileZilla)连接服务器问题集|FTP

    服务器环境:CentOS7 场景:安装WDCP进行服务器管理,新建站点和FTP账户后,使用ftp客户端登录碰到的问...

  • 4.ftp文件服务&ssh服务搭建

    ftp文件服务搭建 1. 搭建ftp服务 FTP:文件传输协议,用于文件在本地和服务器上的双向传输,"下载"(Do...

  • FTP

    FTP 一.FTP简介和原理 FTP即文件传输协议, CS架构, Linux下搭建ftp服务器需要安装vsftpd...

  • 部署网络半自动系统安装服务器

    前提:已有一个ftp服务器,里面共享着centos6/7的镜像,有三台机器 A:ftp服务器(centos7):i...

  • FTP服务器的搭建

    ubuntu14.04下的ftp服务器的搭建

网友评论

      本文标题:CentOS7 搭建FTP服务器

      本文链接:https://www.haomeiwen.com/subject/awhfnxtx.html