CentOS7服务器环境下vsftpd安装及配置方法

本文实例讲述了CentOS7服务器环境下vsftpd安装及配置方法。分享给大家供大家参考,具体如下:

0x:卸载vsftpd

  [root@localhost ~]# yum remove vsftpd  [root@localhost ~]# find / -name "vsftpd*"  /etc/vsftpd  /etc/vsftpd/vsftpd.conf.bak  [root@localhost ~]# rm -fr /etc/vsftpd/    

1x:重新安装

  [root@localhost home]#yum -y install vsftpd  [root@localhost home]# systemctl start vsftpd.service  [root@localhost home]# systemctl status vsftpd.service    

  ● vsftpd.service - Vsftpd ftp daemon   Loaded: loaded (/usr/lib/systemd/system/vsftpd.service; disabled; vendor preset: disabled)   Active: active (running) since Thu 2017-11-09 21:15:18 EST; 8s ago   Process: 5716 ExecStart=/usr/sbin/vsftpd /etc/vsftpd/vsftpd.conf (code=exited, status=0/SUCCESS)   Main PID: 5717 (vsftpd)   CGroup: /system.slice/vsftpd.service     └─5717 /usr/sbin/vsftpd /etc/vsftpd/vsftpd.conf  Nov 09 21:15:18 localhost.localdomain systemd[1]: Starting Vsftpd ftp daemon...  Nov 09 21:15:18 localhost.localdomain systemd[1]: Started Vsftpd ftp daemon.  Hint: Some lines were ellipsized, use -l to show in full.    

Active: active (running) 说明安装已完成

2x:本地用户配置

  [root@localhost vsftpd]# useradd test1  [root@localhost vsftpd]# passwd test1  Changing password for user test1.  New password:  BAD PASSWORD: The password is shorter than 8 characters  Retype new password:  passwd: all authentication tokens updated successfully.    

添加test1本地帐户,下面是用业查询本地帐号,及黑名单

  [root@localhost vsftpd]# cat /etc/passwd  [root@localhost vsftpd]# vi /etc/vsftpd/ftpusers  [root@localhost vsftpd]# vi /etc/vsftpd/user_list  [root@localhost vsftpd]# cat /etc/passwd  root:x:0:0:root:/root:/bin/bash  bin:x:1:1:bin:/bin:/sbin/nologin  daemon:x:2:2:daemon:/sbin:/sbin/nologin  adm:x:3:4:adm:/var/adm:/sbin/nologin  lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin  sync:x:5:0:sync:/sbin:/bin/sync  shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown  halt:x:7:0:halt:/sbin:/sbin/halt  mail:x:8:12:mail:/var/spool/mail:/sbin/nologin  operator:x:11:0:operator:/root:/sbin/nologin  games:x:12:100:games:/usr/games:/sbin/nologin  ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin  nobody:x:99:99:Nobody:/:/sbin/nologin  systemd-network:x:192:192:systemd Network Management:/:/sbin/nologin  dbus:x:81:81:System message bus:/:/sbin/nologin  polkitd:x:999:997:User for polkitd:/:/sbin/nologin  postfix:x:89:89::/var/spool/postfix:/sbin/nologin  chrony:x:998:996::/var/lib/chrony:/sbin/nologin  sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin  mysql:x:27:27:MySQL Server:/var/lib/mysql:/bin/bash  www:x:1000:1000::/home/www:/bin/bash  nginx:x:997:995:nginx user:/var/cache/nginx:/sbin/nologin  virtual:x:1001:1001::/home/ftpsite:/bin/bash  virtual1:x:1002:1002::/home/ftpsite:/bin/bash  vsftpd:x:1003:1003::/home/vsftpd:/sbin/nologin  overlord:x:1004:1004::/home/overlord:/sbin/nologin  test1:x:1005:1005::/home/test1:/bin/bash  [root@localhost vsftpd]# vi /etc/vsftpd/ftpusers  # Users that are not allowed to login via ftp  root  bin  daemon  adm  lp  sync  shutdown  halt  mail  news  uucp  operator  games  nobody  [root@localhost vsftpd]# vi /etc/vsftpd/user_list  # vsftpd userlist  # If userlist_deny=NO, only allow users in this file  # If userlist_deny=YES (default), never allow users in this file, and  # do not even prompt for a password.  # Note that the default vsftpd pam config also checks /etc/vsftpd/ftpusers  # for users that are denied.  root  bin  daemon  adm  lp  sync  shutdown  halt  mail  news  uucp  operator  games  nobody    

现在使用Windows ftp 来登录及测试

  C:Usersxiaor>ftp 192.168.5.147  连接到 192.168.5.147。  220 (vsFTPd 3.0.2)  200 Always in UTF8 mode.  用户(192.168.5.147:(none)): test1  331 Please specify the password.  密码:  230 Login successful.  ftp> pwd  257 "/home/test1"  ftp> ls  200 PORT command successful. Consider using PASV.  150 Here comes the directory listing.  226 Directory send OK.  ftp>    

  [root@localhost vsftpd]# touch /home/test1/showme.txt    

  ftp> ls  200 PORT command successful. Consider using PASV.  150 Here comes the directory listing.  showme.txt  226 Directory send OK.  ftp: 收到 15 字节,用时 0.00秒 15.00千字节/秒。  ftp>  ftp> get showme.txt  200 PORT command successful. Consider using PASV.  150 Opening BINARY mode data connection for showme.txt (0 bytes).  226 Transfer complete.  ftp>  ftp> put winfile1.txt  200 PORT command successful. Consider using PASV.  150 Ok to send data.  226 Transfer complete.  ftp: 发送 9 字节,用时 0.00秒 4.50千字节/秒。  ftp>    

  [root@localhost vsftpd]# ls /home/test1/  showme.txt winfile1.txt    

坚信vsftp安装后不对/etc/vsftpd/vsftpd.conf做任何修改就可以通过新建的Linux用户(本地用户)访问下载和上传文件。

其它与次无关

  cat /etc/vsftpd/chroot_list  userlist_enable=YES  userlist_deny=NO  userlist_file=/etc/vsftpd/user_list  tcpdump -i eth0 src host hostname(明文)  touch /home/test1/test1.txt  local_root=/tmp/test1_root/  local_max_rate=0  groupadd tg  gpasswd -a test1 tg  chown root:tg /tmp/test1_root/  chmod 775 /tmp/test1_root/  ll /temp/  chroot_local_user=YES  chroot_list_enable=YES  # (default follows)  chroot_list_file=/etc/vsftpd/chroot_list    

3x:匿名用户配置

  [root@localhost vsftpd]# vi /etc/vsftpd/vsftpd.conf  anonymous_enable=YES  anon_upload_enable=YES  anon_mkdir_write_enable=YES  [root@localhost vsftpd]# systemctl restart vsftpd  [root@localhost vsftpd]# touch /var/ftp/pub/lm.txt  [root@localhost vsftpd]# chown ftp /var/ftp/pub    

服务器配置上面的就可以访问并上传文件到pub目录下

可能会出现的问题:

1、想当然给 ftp用户 /var/ftp/目录 权限出现下面问题

  [root@localhost vsftpd]# chown ftp /var/ftp/  [root@localhost vsftpd]# ll -d /var/ftp/  drwxr-xr-x. 3 ftp root 4096 Nov 10 17:03 /var/ftp/  C:Usersxiaor>ftp 192.168.5.147  连接到 192.168.5.147。  220 (vsFTPd 3.0.2)  200 Always in UTF8 mode.  用户(192.168.5.147:(none)): anonymous  331 Please specify the password.  密码:  500 OOPS: vsftpd: refusing to run with writable root inside chroot()  远程主机关闭连接。    

解决方法:

  [root@localhost vsftpd]# chown root /var/ftp  [root@localhost vsftpd]# chown ftp/var/ftp/pub    

2、Windows CMD(命令行)会出下面错误及处理

  C:Usersxiaor>ftp 192.168.5.147  连接到 192.168.5.147。  220 (vsFTPd 3.0.2)  200 Always in UTF8 mode.  用户(192.168.5.147:(none)): anonymous  331 Please specify the password.  密码:  230 Login successful.  ftp>  ftp> ls  200 PORT command successful. Consider using PASV.  425 Failed to establish connection.  ftp>    

解决方法:

可以在ftp下使用命令:quote PASV 

4x:虚拟用户配置(重头戏,最推荐)

1、添加虚拟用户口令文件并生成认证文件

  [root@localhost vsftpd]# vi /etc/vsftpd/vuser.txt  [root@localhost vsftpd]# yum -y install db4-utils  [root@localhost vsftpd]# db_load -T -t hash -f /etc/vsftpd/vuser.txt /etc/vsftpd/vuser.db    

2、编辑vsftpd的PAM认证文件

  [root@localhost vsftpd]# vi /etc/pam.d/vsftpd  在其文件中添加下面两行,并注释其它行  auth required /lib64/security/pam_userdb.so db=/etc/vsftpd/vuser  account required /lib64/security/pam_userdb.so db=/etc/vsftpd/vuser  #%PAM-1.0  #session  optional   pam_keyinit.so  force revoke  #auth    required  pam_listfile.so item=user sense=deny file=/etc/vsftpd/ftpusers onerr=succeed  #auth    required  pam_shells.so  #auth    include   password-auth  #account  include   password-auth  #session  required   pam_loginuid.so  #session  include   password-auth  auth required /lib64/security/pam_userdb.so db=/etc/vsftpd/vuser  account required /lib64/security/pam_userdb.so db=/etc/vsftpd/vuser    

3、建立本地映射用户并设置宿主目录权限

  [root@localhost vsftpd]# useradd -d /home/vftproot -s /sbin/nologin vuser  [root@localhost vsftpd]# ll /home/  [root@localhost vsftpd]# chmod 555 /home/vftproot/  [root@localhost vsftpd]# ll /home/    

4、修改配置文件,重启vsftpd服务,并测试

  [root@localhost vsftpd]# vi /etc/vsftpd/vsftpd.conf  guest_enable=YES  guest_username=vuser  pam_service_name=vsftpd  [root@localhost vsftpd]# systemctl restart vsftpd.service    

5、调整虚拟用户权限,并继续设置:到此下载可以但上传是不是行的

  [root@localhost vsftpd]# vi /etc/vsftpd/vsftpd.conf  anonymous_enable=NO  local_enable=YES  anon_upload_enable=YES  anon_mkdir_write_enable=YES  anon_other_write_enable=YES  [root@localhost_centos vsftpd]# systemctl restart vsftpd.service   [root@localhost vsftpd]# mkdir /home/vftproot/pub   [root@localhost vsftpd]# chmod 777 /home/vftproot/pub   [root@localhost vsftpd]# ll -d /home//vftproot/pub   drwxrwxrwx. 2 root root 4096 Nov 12 16:33 /home//vftproot/pub    

至此虚拟用户上传也是可以了!

  C:Usersxiaor>ftp 192.168.5.147  连接到 192.168.5.147。  220 (vsFTPd 3.0.2)  200 Always in UTF8 mode.  用户(192.168.5.147:(none)): ftpxrl  331 Please specify the password.  密码:  230 Login successful.  ftp> ls  200 PORT command successful. Consider using PASV.  150 Here comes the directory listing.  pub  t1.txt  226 Directory send OK.  ftp: 收到 16 字节,用时 0.00秒 16000.00千字节/秒。  ftp> cd pub  250 Directory successfully changed.  ftp> put abc.txt  200 PORT command successful. Consider using PASV.  150 Ok to send data.  226 Transfer complete.  ftp>    

6、设置可能会碰到的问题

A、500 OOPS: vsftpd: refusing to run with writable root inside chroot()

  C:Usersxiaor>ftp 192.168.5.147  连接到 192.168.5.147。  220 (vsFTPd 3.0.2)  200 Always in UTF8 mode.  用户(192.168.5.147:(none)): ftpxrl  331 Please specify the password.  密码:  500 OOPS: vsftpd: refusing to run with writable root inside chroot()  远程主机关闭连接。    

  [root@localhost vsftpd]# chmod 555 /home/vftproot/    

  C:Usersxiaor>ftp 192.168.5.147  连接到 192.168.5.147。  220 (vsFTPd 3.0.2)  200 Always in UTF8 mode.  用户(192.168.5.147:(none)): ftpxrl  331 Please specify the password.  密码:  230 Login successful.  ftp>    

B、530 Login incorrect

解决办法:/etc/pam.d/下面的vsftpd里面的/lib 修改为/lib64

5x:防火墙设置

3、配置ftp

打开etc/vsftpd.conf

将chroot_list_enable=NO改为chroot_list_enable=YES

设置被动模式端口

  pasv_min_port=30000  pasv_max_port=30000    

5、防火墙设置

添加30000端口为被动模式用,如果要开户主动模式则需要添加20端口

  firewall-cmd --zone=public --add-port=30000/tcp --permanent   firewall-cmd --reload    

通过命令:firewall-cmd --list-ports 查看开通的端口

希望本文所述对大家CentOS服务器配置有所帮助。

参与评论