vsftpd安装配置[ubuntu下亲测可用]

说明

本文所使用的是ubuntu操作系统&＃xff0c;或许和其他版本的linux系统存在一定的区别。 实验环境

ubuntu 16.4 安装

$ sudo apt-get install vsftpd 检测端口

$ sudo netstat -npltu | grep 21 成功结果&＃xff1a; tcp6 0 0 :::21 :::* LISTEN 885/vsftpd 提示&＃xff1a;若未出现此结果&＃xff0c;则说明你的21端口未打开。默认情况是不需要修改的 接测安装是否成功

$ ftp localhost输入用户名和密码即可登入&＃xff08;不可输入root用户默认的拦截root用户的&＃xff09; 修改配置

$ sudo gedit /etc/vsftpd.conf具体的配置需要根据自己来选择listen&＃61; :设置为YES时vsftpd以独立运行方式启动&＃xff0c;设置为NO时以xinetd方式启动&＃xff08;xinetd是管理守护进程的&＃xff0c;将服务集中管理&＃xff0c;可以减少大量服务的资源消耗&＃xff09; listen_port&＃61; :设置控制连接的监听端口号&＃xff0c;默认为21 listen_address&＃61; :将在绑定到指定IP地址运行&＃xff0c;适合多网卡 connect_from_port_20&＃61; :若为YES&＃xff0c;则强迫FTP&＃xff0d;DATA的数据传送使用port 20&＃xff0c;默认YES pasv_enable&＃61; :是否使用被动模式的数据连接&＃xff0c;如果客户机在防火墙后&＃xff0c;请开启为YES pasv_min_port&＃61; pasv_max_port&＃61; :设置被动模式后的数据连接端口范围在n和m之间,建议为50000&＃xff0d;60000端口 message_file&＃61; :设置使用者进入某个目录时显示的文件内容&＃xff0c;默认为 .message dirmessage_enable&＃61; :设置使用者进入某个目录时是否显示由message_file指定的文件内容 ftpd_banner&＃61; :设置用户连接服务器后的显示信息&＃xff0c;就是欢迎信息 banner_file&＃61; :设置用户连接服务器后的显示信息存放在指定的filename文件中 connect_timeout&＃61; :如果客户机连接服务器超过N秒&＃xff0c;则强制断线&＃xff0c;默认60 accept_timeout&＃61; :当使用者以被动模式进行数据传输时&＃xff0c;服务器发出passive port指令等待客户机超过N秒&＃xff0c;则强制断线&＃xff0c;默认60 accept_connection_timeout&＃61; :设置空闲的数据连接在N秒后中断&＃xff0c;默认120 data_connection_timeout&＃61; : 设置空闲的用户会话在N秒后中断&＃xff0c;默认300 max_clients&＃61; : 在独立启动时限制服务器的连接数&＃xff0c;0表示无限制 max_per_ip&＃61; :在独立启动时限制客户机每IP的连接数&＃xff0c;0表示无限制&＃xff08;不知道是否跟多线程下载有没干系&＃xff09; local_enable&＃61; :设置是否支持本地用户帐号访问 guest_enable&＃61; :设置是否支持虚拟用户帐号访问 write_enable&＃61; :是否开放本地用户的写权限 local_umask&＃61; :设置本地用户上传的文件的生成掩码&＃xff0c;默认为077 local_max_rate :设置本地用户最大的传输速率&＃xff0c;单位为bytes/sec&＃xff0c;值为0表示不限制 local_root&＃61; :设置本地用户登陆后的目录&＃xff0c;默认为本地用户的主目录 chroot_local_user&＃61; :当为YES时&＃xff0c;所有本地用户可以执行chroot chroot_list_enable&＃61; chroot_list_file&＃61; :当chroot_local_user&＃61;NO 且 chroot_list_enable&＃61;YES时&＃xff0c;只有filename文件指定的用户可以执行chroot anonymous_enable&＃61; :设置是否支持匿名用户访问 anon_max_rate&＃61; :设置匿名用户的最大传输速率&＃xff0c;单位为B/s&＃xff0c;值为0表示不限制 anon_world_readable_only&＃61; 是否开放匿名用户的浏览权限 anon_upload_enable&＃61; 设置是否允许匿名用户上传 anon_mkdir_write_enable&＃61; :设置是否允许匿名用户创建目录 anon_other_write_enable&＃61; :设置是否允许匿名用户其他的写权限&＃xff08;注意&＃xff0c;这个在安全上比较重要&＃xff0c;一般不建议开&＃xff0c;不过关闭会不支持续传&＃xff09; anon_umask&＃61; :设置匿名用户上传的文件的生成掩码&＃xff0c;默认为077 提示

一般只需要设置如下内容

允许匿名访问

Allow anonymous FTP? (Disabled by default) anonymous_enable&＃61;YES

上传文件

write_enable&＃61;YES anon_mkdir_write_enable&＃61;YES anon_upload_enable&＃61;YES

权限设置

local_umask&＃61;022 等同于权限755&＃xff08;即777-022&＃xff09;

配置禁止用户

sudo vim /etc/ftpusers去掉你想登录的账户 个人配置&＃xff08;仅供参考&＃xff09;

# Example config file /etc/vsftpd.conf # # The default compiled in settings are fairly paranoid. This sample file # loosens things up a bit, to make the ftp daemon more usable. # Please see vsftpd.conf.5 for all compiled in defaults. # # READ THIS: This example file is NOT an exhaustive list of vsftpd options. # Please read the vsftpd.conf.5 manual page to get a full idea of vsftpd&＃39;s # capabilities. # # # Run standalone? vsftpd can run either from an inetd or as a standalone # daemon started from an initscript. listen&＃61;NO # # This directive enables listening on IPv6 sockets. By default, listening # on the IPv6 "any" address (::) will accept connections from both IPv6 # and IPv4 clients. It is not necessary to listen on *both* IPv4 and IPv6 # sockets. If you want that (perhaps because you want to listen on specific # addresses) then you must run two copies of vsftpd with two configuration # files. listen_ipv6&＃61;YES # # Allow anonymous FTP? (Disabled by default). anonymous_enable&＃61;YES # # Uncomment this to allow local users to log in. local_enable&＃61;YES # # Uncomment this to enable any form of FTP write command. write_enable&＃61;YES # # Default umask for local users is 077. You may wish to change this to 022, # if your users expect that (022 is used by most other ftpd&＃39;s) local_umask&＃61;022# # Uncomment this to allow the anonymous FTP user to upload files. This only # has an effect if the above global write enable is activated. Also, you will #obviously need to create a directory writable by the FTP user. anon_upload_enable&＃61;YES # # Uncomment this if you want the anonymous FTP user to be able to create # new directories. anon_mkdir_write_enable&＃61;YES # # Activate directory messages - messages given to remote users when they # go into a certain directory. dirmessage_enable&＃61;YES # # If enabled, vsftpd will display directory listings with the time # in your local time zone. The default is to display GMT. The # times returned by the MDTM FTP command are also affected by this # option. use_localtime&＃61;YES # # Activate logging of uploads/downloads. xferlog_enable&＃61;YES # # Make sure PORT transfer connections originate from port 20 (ftp-data). connect_from_port_20&＃61;YES # # If you want, you can arrange for uploaded anonymous files to be owned by # a different user. Note! Using "root" for uploaded files is not # recommended! #chown_uploads&＃61;YES #chown_username&＃61;whoever # # You may override where the log file goes if you like. The default is shown # below. #xferlog_file&＃61;/var/log/vsftpd.log # # If you want, you can have your log file in standard ftpd xferlog format. # Note that the default log file location is /var/log/xferlog in this case. #xferlog_std_format&＃61;YES # # You may change the default value for timing out an idle session. #idle_session_timeout&＃61;600 # # You may change the default value for timing out a data connection. #data_connection_timeout&＃61;120 # # It is recommended that you define on your system a unique user which the # ftp server can use as a totally isolated and unprivileged user. #nopriv_user&＃61;ftpsecure # # Enable this and the server will recognise asynchronous ABOR requests. Not # recommended for security (the code is non-trivial). Not enabling it, # however, may confuse older FTP clients. #async_abor_enable&＃61;YES # # By default the server will pretend to allow ASCII mode but in fact ignore # the request. Turn on the below options to have the server actually do ASCII # mangling on files when in ASCII mode. # Beware that on some FTP servers, ASCII support allows a denial of service # attack (DoS) via the command "SIZE /big/file" in ASCII mode. vsftpd # predicted this attack and has always been safe, reporting the size of the # raw file. # ASCII mangling is a horrible feature of the protocol. ascii_upload_enable&＃61;YES ascii_download_enable&＃61;YES # # You may fully customise the login banner string: ftpd_banner&＃61;Welcome to engle&＃39;s computer! # # You may specify a file of disallowed anonymous e-mail addresses. Apparently # useful for combatting certain DoS attacks. #deny_email_enable&＃61;YES # (default follows) #banned_email_file&＃61;/etc/vsftpd.banned_emails # # You may restrict local users to their home directories. See the FAQ for # the possible risks in this before using chroot_local_user or # chroot_list_enable below. #chroot_local_user&＃61;YES # # You may specify an explicit list of local users to chroot() to their home # directory. If chroot_local_user is YES, then this list becomes a list of # users to NOT chroot(). # (Warning! chroot&＃39;ing can be very dangerous. If using chroot, make sure that # the user does not have write access to the top level directory within the # chroot) #chroot_local_user&＃61;YES #chroot_list_enable&＃61;YES # (default follows) #chroot_list_file&＃61;/etc/vsftpd.chroot_list # # You may activate the "-R" option to the builtin ls. This is disabled by # default to avoid remote users being able to cause excessive I/O on large # sites. However, some broken FTP clients such as "ncftp" and "mirror" assume # the presence of the "-R" option, so there is a strong case for enabling it. #ls_recurse_enable&＃61;YES # # Customization # # Some of vsftpd&＃39;s settings don&＃39;t fit the filesystem layout by # default. # # This option should be the name of a directory which is empty. Also, the # directory should not be writable by the ftp user. This directory is used # as a secure chroot() jail at times vsftpd does not require filesystem # access. secure_chroot_dir&＃61;/var/run/vsftpd/empty # # This string is the name of the PAM service vsftpd will use. pam_service_name&＃61;vsftpd # # This option specifies the location of the RSA certificate to use for SSL # encrypted connections. rsa_cert_file&＃61;/etc/ssl/certs/ssl-cert-snakeoil.pem rsa_private_key_file&＃61;/etc/ssl/private/ssl-cert-snakeoil.key ssl_enable&＃61;NO# # Uncomment this to indicate that vsftpd use a utf8 filesystem. #utf8_filesystem&＃61;YES