查看“Vsftpd”的源代码
来自Ubuntu中文
←
Vsftpd
跳到导航
跳到搜索
因为以下原因,您没有权限编辑该页面:
您请求的操作仅限属于该用户组的用户执行:
用户
您可以查看和复制此页面的源代码。
vsftpd,ftp服务端 ==安装== 安装 <pre>sudo apt-get install vsftpd</pre> 查看是否打开21端口 <pre>qii@ubuntu:~$ sudo netstat -tulnp| grep 21 tcp 0 0 0.0.0.0:21 0.0.0.0:* LISTEN 15601/vsftpd </pre> 登录 <pre>ftp localhost</pre> 输入Ubuntu的用户名、密码登录 <pre>ls</pre> 会显示home目录的文件 ==文件结构== 匿名用户根路径 <pre>/srv/ftp</pre> 配置文件 <pre>/etc/vsftpd.conf</pre> 查阅配置文件详细信息 <pre>man 5 vsftpd.conf</pre> 设定log保存位置,默认如下 <pre>xferlog_file=/var/log/vsftpd.log</pre> ==运行== ===standalone=== 最普遍的方式 <pre>sudo service vsftpd start </pre> ===super daemon=== 需要修改vsftpd.conf <pre>listen=NO</pre> 这里若不改成NO,会出现下列错误 <pre>500 OOPS: could not bind listening IPv4 socket</pre> 安装xinetd <pre>sudo apt-get install xinetd </pre> <pre>sudo vi /etc/xinetd.conf</pre> <pre>service ftp { socket_type = stream wait = no user = root server = /usr/sbin/vsftpd log_on_success += DURATION USERID log_on_failure += USERID nice = 10 disable = no }</pre> 停止vsftpd,启动xinetd <pre>sudo service vsftpd stop</pre> <pre>sudo service xinetd start</pre> 查看端口 <pre>qii@ubuntu:~$ sudo netstat -tulnp| grep 21 tcp 0 0 0.0.0.0:21 0.0.0.0:* LISTEN 16787/xinetd </pre> ==/etc/vsftpd.conf== <pre># Example config file /etc/vsftpd.conf # Run standalone? vsftpd can run either from an inetd or as a standalone # daemon started from an initscript. listen=YES # # Run standalone with IPv6? # Like the listen parameter, except vsftpd will listen on an IPv6 socket # instead of an IPv4 one. This parameter and the listen parameter are mutually # exclusive. #listen_ipv6=YES # # Allow anonymous FTP? (Disabled by default) anonymous_enable=NO # # Uncomment this to allow local users to log in. local_enable=NO # # Uncomment this to enable any form of FTP write command. #write_enable=YES # # Default umask for local users is 077. You may wish to change this to 022, # if your users expect that (022 is used by most other ftpd's) #local_umask=022 # # Uncomment this to allow the anonymous FTP user to upload files. This only # has an effect if the above global write enable is activated. Also, you will # obviously need to create a directory writable by the FTP user. #anon_upload_enable=YES # # Uncomment this if you want the anonymous FTP user to be able to create # new directories. #anon_mkdir_write_enable=YES # # Activate directory messages - messages given to remote users when they # go into a certain directory. dirmessage_enable=YES # # If enabled, vsftpd will display directory listings with the time # in your local time zone. The default is to display GMT. The # times returned by the MDTM FTP command are also affected by this # option. use_localtime=YES # # Activate logging of uploads/downloads. xferlog_enable=YES # # Make sure PORT transfer connections originate from port 20 (ftp-data). connect_from_port_20=YES # # If you want, you can arrange for uploaded anonymous files to be owned by # a different user. Note! Using "root" for uploaded files is not # recommended! #chown_uploads=YES #chown_username=whoever # # You may override where the log file goes if you like. The default is shown # below. #xferlog_file=/var/log/vsftpd.log # # If you want, you can have your log file in standard ftpd xferlog format. # Note that the default log file location is /var/log/xferlog in this case. #xferlog_std_format=YES # # You may change the default value for timing out an idle session. #idle_session_timeout=600 # # You may change the default value for timing out a data connection. #data_connection_timeout=120 # # It is recommended that you define on your system a unique user which the # ftp server can use as a totally isolated and unprivileged user. #nopriv_user=ftpsecure # # Enable this and the server will recognise asynchronous ABOR requests. Not # recommended for security (the code is non-trivial). Not enabling it, # however, may confuse older FTP clients. #async_abor_enable=YES # # By default the server will pretend to allow ASCII mode but in fact ignore # the request. Turn on the below options to have the server actually do ASCII # mangling on files when in ASCII mode. # Beware that on some FTP servers, ASCII support allows a denial of service # attack (DoS) via the command "SIZE /big/file" in ASCII mode. vsftpd # predicted this attack and has always been safe, reporting the size of the # raw file. # ASCII mangling is a horrible feature of the protocol. #ascii_upload_enable=YES #ascii_download_enable=YES # # You may fully customise the login banner string: #ftpd_banner=Welcome to blah FTP service. # # You may specify a file of disallowed anonymous e-mail addresses. Apparently # useful for combatting certain DoS attacks. #deny_email_enable=YES # (default follows) #banned_email_file=/etc/vsftpd.banned_emails # # You may restrict local users to their home directories. See the FAQ for # the possible risks in this before using chroot_local_user or # chroot_list_enable below. #chroot_local_user=YES # # You may specify an explicit list of local users to chroot() to their home # directory. If chroot_local_user is YES, then this list becomes a list of # users to NOT chroot(). #chroot_local_user=YES #chroot_list_enable=YES # (default follows) #chroot_list_file=/etc/vsftpd.chroot_list # # You may activate the "-R" option to the builtin ls. This is disabled by # default to avoid remote users being able to cause excessive I/O on large # sites. However, some broken FTP clients such as "ncftp" and "mirror" assume # the presence of the "-R" option, so there is a strong case for enabling it. #ls_recurse_enable=YES # # Debian customization # # Some of vsftpd's settings don't fit the Debian filesystem layout by # default. These settings are more Debian-friendly. # # This option should be the name of a directory which is empty. Also, the # directory should not be writable by the ftp user. This directory is used # as a secure chroot() jail at times vsftpd does not require filesystem # access. secure_chroot_dir=/var/run/vsftpd/empty # # This string is the name of the PAM service vsftpd will use. pam_service_name=vsftpd # # This option specifies the location of the RSA certificate to use for SSL # encrypted connections. rsa_cert_file=/etc/ssl/private/vsftpd.pem</pre> ==匿名用户== 先备份 <pre>sudo cp /etc/vsftpd.conf /etc/vsftpd.conf.old</pre> 打开 <pre>sudo vi /etc/vsftpd.conf</pre> 允许匿名访问 <pre># Allow anonymous FTP? (Disabled by default) anonymous_enable=YES</pre> 允许匿名上传 <pre>anon_upload_enable=YES</pre> ==认证FTP配置== 设定vsftp认证系统用户,并允许他们上传文件,编辑 /etc/vsftpd.conf: <pre>local_enable=YES write_enable=YES</pre> 重启vsftp <pre>sudo service vsftpd restart</pre> 系统用户登录ftp便进入他们的home目录 ==Chroot== ===限制所有=== 限制登录用户访问其他目录,改之前登录显示的路径比如是 /home/qii ,改之后则是 /。 <pre>chroot_local_user=YES</pre> ===开放所有,限制特定=== 可指定一组用户限制 <pre>chroot_local_user=NO chroot_list_enable=YES chroot_list_file=/etc/vsftpd.chroot_list</pre> 随后创建列表 <pre>sudo vi /etc/vsftpd.chroot_list</pre> 一行一个用户名 重启vsftp <pre>sudo service vsftpd restart</pre> ===限制所有,开放特定=== 上面的规则是限制 /etc/vsftpd.chroot_list 中的用户,反过来限制一切,只解禁 /etc/vsftpd.chroot_list 的用户。这样: <pre>chroot_local_user=YES chroot_list_enable=YES chroot_list_file=/etc/vsftpd.chroot_list</pre> ==账号登录== ===/etc/ftpusers文件=== 该文件内的用户一律禁止ftp连接,默认列表包括了root, daemon, nobody等。需要禁止某个用户,添加进来便是。 这个文件是由PAM模块的 /etc/pam.d/vsftpd 指定的 <pre>qii@ubuntu:~$ sudo cat /etc/pam.d/vsftpd # Standard behaviour for ftpd(8). auth required pam_listfile.so item=user sense=deny file=/etc/ftpusers onerr=succeed # Note: vsftpd handles anonymous logins on its own. Do not enable pam_ftp.so. # Standard pam includes @include common-account @include common-session @include common-auth auth required pam_shells.so </pre> ===userlist_file 文件=== vsftpd自订的列表,跟/etc/ftpusers类似,具体文件名和路径是由用户自己指定的。这边设成 /etc/vsftpd.user_list 添加配置文件字段: <pre>userlist_enable=YES userlist_deny=YES userlist_file=/etc/vsftpd.user_list</pre> ===限制一切,开放特定=== 上述2个方法都是限制列表文件中的用户,如果要反过来,限制一切用户登录,只允许列表文件中的用户,用 userlist_file,这样: <pre>userlist_enable=YES userlist_deny=NO userlist_file=/etc/vsftpd.user_list</pre> ==限制== ===限制连接数=== 前者为服务器最大支持连接数,后者为每个ip允许最多连接数。 <pre>max_clients=数字 max_per_ip=数字</pre> ===限制下载速度=== 单位是字节,所以需要换算。比如我想让匿名用户和vsFTP上的用户都以80KB下载,所以这个数字应该是1024x80=81920 <pre>anon_max_rate=数字 #匿名用户下载速度 local_max_rate=数字 #普通用户下载速度</pre> ==欢迎信息== <pre>dirmessage_enable=YES</pre> 然后编辑各用户home目录下的.message <pre>vi .message</pre> <pre>qii@ubuntu:~$ cat .message 欢迎来到vsftpd </pre> <pre>qii@ubuntu:~$ ftp localhost Connected to localhost. 220 (vsFTPd 2.2.2) Name (localhost:qii): qii 331 Please specify the password. Password: 230-欢迎来到vsftpd 230 Login successful. Remote system type is UNIX. Using binary mode to transfer files. ftp> </pre> 若是匿名用户,就放到 <pre>/var/ftp</pre> ==虚拟路径== 比如我的ftp的默认目录是/srv/ftp,我想把/mnt/LinG/WinSoft文件夹,映射到/srv/ftp目录中,我就如下操作 命令: <pre>#mount --bind [原有的目录] [新目录]</pre> 先创建文件夹 <pre>sudo mkdir /srv/ftp/WinSoft</pre> 执行mount命令 <pre>sudo mount --bind /mnt/LinG/WinSoft /srv/ftp/WinSoft</pre> [[Category:服务器]]
返回
Vsftpd
。
导航菜单
页面操作
页面
讨论
阅读
查看源代码
历史
页面操作
页面
讨论
更多
工具
个人工具
登录
导航
首页
最近更改
随机页面
页面分类
帮助
搜索
编辑
编辑指南
沙盒
新闻动态
字词处理
工具
链入页面
相关更改
特殊页面
页面信息