Debian系统下搭建vsftpd示例

为什么80%的码农都做不了架构师&＃xff1f;>>>

系统环境

# uname -a Linux vsftp.jessie.cn 3.16.0-4-amd64 #1 SMP Debian 3.16.7-ckt9-3~deb8u1 (2015-04-24) x86_64 GNU/Linux # vsftpd -v vsftpd: version 3.0.2

配置文件

Env init

apt-get -y install vsftpd db5.3-util mkdir -pv /etc/vsftpd/roles /data/log/vsftpd /mnt/ftp/higkoo touch /etc/vsftpd/{chroot-list,user-list,issue,accounts,create.sh} /etc/pam.d/vsftpd.ftp openssl req -newkey rsa:2048 -x509 -nodes -days 3650 -out /etc/vsftpd/vsftp-cert.pem -keyout /etc/vsftpd/vsftp-cert.pem chown -R ftp:ftp /mnt/ftp /data/log/vsftpd openssl req -newkey rsa:2048 -x509 -nodes -days 3650 -out /etc/vsftpd/vsftp-cert.pem -keyout /etc/vsftpd/vsftp-cert.pem

/etc/vsftpd.conf

anon_mkdir_write_enable&＃61;NO anon_root&＃61;/dev/zero anon_upload_enable&＃61;NO anon_world_readable_only&＃61;YES anonymous_enable&＃61;NO banner_file&＃61;/etc/vsftpd/issue chroot_local_user&＃61;YES chroot_list_enable&＃61;YES # 安全限制 chroot_list_file&＃61;/etc/vsftpd/chroot-list allow_writeable_chroot&＃61;YES userlist_deny&＃61;YES # 用户黑名单功能 userlist_file&＃61;/etc/vsftpd/user-list data_connection_timeout&＃61;120 dirmessage_enable&＃61;NO ftpd_banner&＃61;Welcome to ops ftp. guest_enable&＃61;YES guest_username&＃61;ftp hide_file&＃61;{\.*} idle_session_timeout&＃61;600 listen_ipv6&＃61;NO connect_from_port_20&＃61;NO ftp_data_port&＃61;50234 listen_port&＃61;21 listen&＃61;YES local_enable&＃61;YES local_umask&＃61;022 log_ftp_protocol&＃61;YES syslog_enable&＃61;NO pam_service_name&＃61;vsftpd.ftp passwd_chroot_enable&＃61;NO pasv_enable&＃61;YES pasv_min_port&＃61;62222 pasv_max_port&＃61;62333 tcp_wrappers&＃61;YES use_localtime&＃61;NO user_config_dir&＃61;/etc/vsftpd/roles userlist_enable&＃61;YES virtual_use_local_privs&＃61;YES write_enable&＃61;YES xferlog_enable&＃61;YES xferlog_enable&＃61;YES xferlog_std_format&＃61;YES xferlog_file&＃61;/data/log/vsftpd/xfer.log vsftpd_log_file&＃61;/data/log/vsftpd/vsftpd.log ssl_enable&＃61;YES force_local_data_ssl&＃61;YES force_local_logins_ssl&＃61;YES ssl_tlsv1&＃61;YES ssl_sslv2&＃61;YES ssl_sslv3&＃61;YES rsa_cert_file&＃61;/etc/vsftpd/vsftp-cert.pem max_per_ip&＃61;30 max_clients&＃61;200 ssl_ciphers&＃61;HIGH require_ssl_reuse&＃61;NO log_ftp_protocol&＃61;yes dual_log_enable&＃61;YES lock_upload_files&＃61;NO

/etc/vsftpd/roles/higkoo

local_root&＃61;/mnt/ftp/higkoo anon_world_readable_only&＃61;NO write_enable&＃61;YES anon_upload_enable&＃61;NO

/etc/vsftpd/create.sh

/bin/mv -fv /etc/vsftpd/accounts.db /tmp /usr/bin/db_load -T -t hash -f /etc/vsftpd/accounts /etc/vsftpd/accounts.db /bin/chmod 0600 /etc/vsftpd/accounts.db /etc/vsftpd/accounts

/etc/pam.d/vsftpd.ftp

auth sufficient /lib/x86_64-linux-gnu/security/pam_userdb.so db&＃61;/etc/vsftpd/accounts account sufficient /lib/x86_64-linux-gnu/security/pam_userdb.so db&＃61;/etc/vsftpd/accounts

/etc/vsftpd/accounts

higkoo MyPassWords

IP限制

&＃61;&＃61;> /etc/hosts.allow <&＃61;&＃61; vsftpd:123.223.233.8:allow vsftpd:192.186.233.:allow&＃61;&＃61;> /etc/hosts.deny <&＃61;&＃61; vsftpd:all:deny

登录日志

ftp客户端

&＃61;&＃61;> /data/log/vsftpd/vsftpd.log <&＃61;&＃61; CONNECT: Client "180.157.70.197" FTP response: Client "123.223.233.8", "220 - biliops" FTP response: Client "123.223.233.8", "220 " FTP command: Client "123.223.233.8", "AUTH TLS" FTP response: Client "123.223.233.8", "234 Proceed with negotiation." FTP command: Client "123.223.233.8", "USER higkoo" [ops] FTP response: Client "123.223.233.8", "331 Please specify the password." [ops] FTP command: Client "123.223.233.8", "PASS " [ops] OK LOGIN: Client "123.223.233.8" [ops] FTP response: Client "123.223.233.8", "230 Login successful." [ops] FTP command: Client "123.223.233.8", "SYST" [ops] FTP response: Client "123.223.233.8", "215 UNIX Type: L8" [ops] FTP command: Client "123.223.233.8", "FEAT" [ops] FTP response: Client "123.223.233.8", "211-Features:" [ops] FTP response: Client "123.223.233.8", " AUTH SSL" [ops] FTP response: Client "123.223.233.8", " AUTH TLS" [ops] FTP response: Client "123.223.233.8", " EPRT" [ops] FTP response: Client "123.223.233.8", " EPSV" [ops] FTP response: Client "123.223.233.8", " MDTM" [ops] FTP response: Client "123.223.233.8", " PASV" [ops] FTP response: Client "123.223.233.8", " PBSZ" [ops] FTP response: Client "123.223.233.8", " PROT" [ops] FTP response: Client "123.223.233.8", " REST STREAM" [ops] FTP response: Client "123.223.233.8", " SIZE" [ops] FTP response: Client "123.223.233.8", " TVFS" [ops] FTP response: Client "123.223.233.8", "211 End" [ops] FTP command: Client "123.223.233.8", "PBSZ 0" [ops] FTP response: Client "123.223.233.8", "200 PBSZ set to 0." [ops] FTP command: Client "123.223.233.8", "PROT P" [ops] FTP response: Client "123.223.233.8", "200 PROT now Private." [ops] FTP command: Client "123.223.233.8", "PWD" [ops] FTP response: Client "123.223.233.8", "257 "/"" [ops] FTP command: Client "123.223.233.8", "TYPE I" [ops] FTP response: Client "123.223.233.8", "200 Switching to Binary mode." [ops] FTP command: Client "123.223.233.8", "PASV" [ops] FTP response: Client "123.223.233.8", "227 Entering Passive Mode (88,123,66,22,223,233)." [ops] FTP command: Client "123.223.233.8", "LIST" [ops] FTP response: Client "123.223.233.8", "150 Here comes the directory listing." [ops] FTP response: Client "123.223.233.8", "226 Directory send OK." [ops] FTP command: Client "123.223.233.8", "MDTM tengine_2.1.1-2_amd64.deb" [ops] FTP response: Client "123.223.233.8", "213 20151229123456"