¦bºô»Úºô¸ô¤W±ªº¶Ç¿é¨ó©w·í¤¤¡AFTP(File Transfer Protocol)¥i»¡¬O³Ì¥j¦Ñªº¨ó©w¤§¤@¤F¡I¦´ÁÁÙ¨S¦³³o»ò¦h¦n¥Îªº¨ó©w¤§«e(¨Ò¦pSAMBA)¡A³£¬O¨Ï¥ÎFTP¨Ó¶i¦æ¸ê®Æªº¶Ç»¼ªº©O¡I¥t¥~¡A¤@¯ë¨Ó»¡¸ê®Æªº¶Ç¿é¥HFTP³oÓ¨ó©w¨Ó¶Ç°e¬O¬Û·íªº§Ö³tªº¡A¦Ó¥B¬Y¨Ç³õ¦X·í¤¤¨ä¹ê¤]¬Û·íªº¤è«K¡C¤£¹L¡Aȱoª`·Nªº¬O¡A¨Ï¥ÎFTP¨Ó¶Ç¿é®É¡A¨ä¹ê¬O¨ã¦³¤@©wµ{«×ªº¡y¦MÀI©Ê¡z¡A¦]¬°¸ê®Æ¦bºô»Úºô¸ô¤W±¬O§¹¥þ¨S¦³¨ü¨ì«OÅ@ªº¡y©ú½X¡z¾÷¨î¡I©Ò¥H³¾ô¤£¤Ó«Øij¤j®a¨Ï¥Î³oÓ¦øªA¾¹ªº°Õ¡I¤×¨ä·í§A«Ø¸m¦n¤FFTP¤§«á¡A¦pªG¸g±`¶i¦æ¸ê®Æªº¶Ç»¼¡A¹ï©ó±zªººô¸ôÀW¼e¡y¯uªº¦³«Ü¤jªº·l®`¡z°Ú¡I¤£¹L¡AµL½×¦p¦ó¡AFTP¤´µM¦³¨ä¦s¦bªº¥²n¡I¨Ò¦p¸q¦u¤j¾ÇªºFTP¯¸´N§@ªº¬Û·íªº´Î°Ú¡I¤£¹L¡AFTP¦øªA¾¹ªº¦MÀI©Ê®¼°ªªº¡A¦]¦¹§ÚÌ¿ï¾Ü¤@Ó±j½Õ¦w¥þ©Êªºvsftpd³nÅé¨Ó¬[³]³á¡I |
[root@linux ~]# cat /etc/pam.d/vsftpd #%PAM-1.0 auth required pam_listfile.so item=user sense=deny file=/etc/vsftpd.ftpusers onerr=succeed auth required pam_stack.so service=system-auth auth required pam_shells.so account required pam_stack.so service=system-auth session required pam_stack.so service=system-auth |
[root@linux ~]# cat /etc/vsftpd.ftpusers # Users that are not allowed to login via ftp root bin daemon ....©³¤U¬Ù²¤.... |
[root@linux ~]# /etc/init.d/vsftpd start [root@linux ~]# netstat -tulnp| grep 21 tcp 0 0 0.0.0.0:21 0.0.0.0:* LISTEN 11689/vsftpd # ¬Ý¨ìÅo¡A¬O¥Ñ vsftpd ©Ò±Ò°Êªº©O¡I |
[root@linux ~]# vi /etc/vsftpd/vsftpd.conf # §ä¨ì©³¤U³o¤@¦æ¡G¤j¬ù¦b 109 ¦æ¥ª¥k°Õ¡I listen=YES # ±N¥L§ï¦¨³o¼Ë°Ú¡G listen=NO |
[root@linux ~]# vi /etc/xinetd.d/vsftpd service ftp { socket_type = stream wait = no user = root server = /usr/sbin/vsftpd log_on_success += DURATION USERID log_on_failure += USERID nice = 10 disable = no } |
[root@linux ~]# /etc/init.d/vsftpd stop [root@linux ~]# /etc/init.d/xinetd restart [root@linux ~]# netstat -tulnp| grep 21 tcp 0 0 0.0.0.0:21 0.0.0.0:* LISTEN 32274/xinetd |
[root@linux ~]# vi /etc/vsftpd/vsftpd.conf # ©³¤U³¾ô¶È¦C¥X¦³³]©wªº¶µ¥Ø¡AYµL³]©w®É¡A½Ð¥H±z¨t²Îªº man 5 vsftpd.conf # µ²ªG¥h·j´M¹w³]ȧY¥i³á¡I # 1. »P°Î¦WªÌ¦³Ãöªº¸ê°T¡G anonymous_enable=YES # 2. »P¹êÅé¥Î¤á¦³Ãöªº³]©w local_enable=YES write_enable=YES local_umask=022 userlist_enable=YES # 3. »P¥D¾÷¦³Ãöªº³]©w dirmessage_enable=YES xferlog_enable=YES connect_from_port_20=YES xferlog_std_format=YES pam_service_name=vsftpd listen=YES tcp_wrappers=YES |
[root@linux ~]# vi /etc/vsftpd/vsftpd.conf # ¦b³oÓÀÉ®×·í¤¤¥[¤J³o¤@¥y§Y¥i use_localtime=YES .....©³¤U¬Ù²¤..... [root@linux ~]# /etc/init.d/vsftpd restart |
[root@linux ~]# vi /etc/vsftpd/vsftpd.conf # 1. »P°Î¦WªÌ¬ÛÃöªº¸ê°T¡A¦b³oӮרҤ¤±N°Î¦Wµn¤J¨ú®ø¡G anonymous_enable=NO # 2. »P¹êÅé¥Î¤á¬ÛÃöªº¸ê°T # ¥i¼g¤J¡A¥B·s¼W¥Ø¿ý¡BÀÉ®×Åv¬° 775¡A¦]¬° umask ¬° 002 ¹À¡I local_enable=YES write_enable=YES local_umask=002 # ³]©w©è¾×¬Y¨Ç¨Ï¥ÎªÌµn¤Jªº¶µ¥Ø³]©wÈ¡Iª`·N¡A©³¤UªºÀÉ®×¥²¶·¦s¦b¡I userlist_enable=YES userlist_deny=YES userlist_file=/etc/vsftpd.user_list # 3. »P¥D¾÷¦³Ãöªº³]©w use_localtime=YES dirmessage_enable=YES xferlog_enable=YES connect_from_port_20=YES xferlog_std_format=YES pam_service_name=vsftpd listen=YES tcp_wrappers=YES banner_file=/etc/vsftpd/welcome.txt [root@linux ~]# /etc/init.d/vsftpd restart |
[root@linux ~]# vi /etc/vsftpd/welcome.txt Åwªï¥úÁ{¥»¤p¯¸¡A¥»¯¸´£¨Ñ FTP ªº¬ÛÃöªA°È¡I ¥DnªºªA°È¬O°w¹ï¥»¾÷¹êÅé¥Î¤á´£¨Ñªº¡A Y¦³¥ô¦ó°ÝÃD¡A½Ð»P³¾ôÁpµ¸¡I |
[root@linux ~]# vi /etc/vsftpd.user_list root bin ....©³¤U¬Ù²¤.... |
1. ´ú¸Õ¨Ï¥Î¤wª¾¨Ï¥ÎªÌµn¤J¡A¨Ò¦p dmtsai ³oÓ¹êÅé¥Î¤á¡G [root@linux ~]# ftp localhost Connected to localhost (127.0.0.1). 220-Åwªï¥úÁ{¥»¤p¯¸¡A¥»¯¸´£¨Ñ FTP ªº¬ÛÃöªA°È¡I <==èè«Ø¥ßªºÅwªï°T®§ 220-¥DnªºªA°È¬O°w¹ï¥»¾÷¹êÅé¥Î¤á´£¨Ñªº¡A 220-Y¦³¥ô¦ó°ÝÃD¡A½Ð»P³¾ôÁpµ¸¡I 220 Name (localhost:root): dmtsai <==µn¤JªÌ±b¸¹¡I 331 Please specify the password. Password: <==¿é¤J±K½X¡A¿Ã¹õ¤£·|¦³¥ô¦ó°T®§ªºÅã¥Ü 230 Login successful. Remote system type is UNIX. Using binary mode to transfer files. ftp> bye 221 Goodbye. |
[root@linux ~]# vi /etc/vsftpd/vsftpd.conf # ¼W¥[¬O§_³]©w°w¹ï¬Y¨Ç¨Ï¥ÎªÌ¨Ó chroot ªº¬ÛÃö³]©wËç¡I chroot_list_enable=YES chroot_list_file=/etc/vsftpd.chroot_list [root@linux ~]# /etc/init.d/vsftpd restart |
[root@linux ~]# vi /etc/vsftpd.chroot_list dmtsai bird1 |
[root@linux ~]# vi /etc/vsftpd/vsftpd.conf # ¹w³]©Ò¦³¹êÅé¥Î¤á³Q chroot ¦Ó¶}©ñ¬Y¨Ç¤H¥i§¹¾ã¦s¨ú (¤£ chroot) ªº±¡ªp chroot_local_user=YES chroot_list_enable=YES chroot_list_file=/etc/vsftpd.chroot_list [root@linux ~]# /etc/init.d/vsftpd restart |
[root@linux ~]# vi /etc/vsftpd.chroot_list nikky |
[root@linux ~]# vi /etc/vsftpd/vsftpd.conf # ¼W¥[©³¤U³o¤@ӰѼƧY¥i¡G local_max_rate=100000 [root@linux ~]# /etc/init.d/vsftpd restart |
[root@linux ~]# vi /etc/vsftpd/vsftpd.conf # ¼W¥[©³¤Uªº³o¨âӰѼơG max_clients=10 max_per_ip=1 [root@linux ~]# /etc/init.d/vsftpd restart |
[root@linux ~]# vi /etc/vsftpd/vsftpd.conf # ³o´XӰѼƥ²¶·nק令³o¼Ë¡G userlist_enable=YES userlist_deny=NO userlist_file=/etc/vsftpd.user_list [root@linux ~]# /etc/init.d/vsftpd restart |
¨ÒÃD¡G °²³]§A¦]¬°¬Y¨Ç¯S®í»Ý¨D¡A©Ò¥H¥²¶·n¶}©ñroot¨Ï¥ÎFTP¶Ç¿éÀɮסA¨º»ò§AÀ³¸Ón¦p¦ó³B²z¡H µª¡G
|
[root@linux ~]# mkdir /var/ftp/linux [root@linux ~]# mkdir /var/ftp/gnu |
[root@linux ~]# vi /etc/vsftpd/vsftpd.conf # ±N³oÓÀɮק令³o¼Ë¡G # 1. »P°Î¦WªÌ¬ÛÃöªº¸ê°T¡G anonymous_enable=YES # ¤£¥²´£¨Ñ±K½X°Õ¡I¥iª½±µµn¤Jù¡I no_anon_password=YES # ¨î¬y³t°Õ¡I anon_max_rate=30000 # »P³s½u®É¶¡¦³Ãöªº³]©w¶µ¥Ø data_connection_timeout=60 idle_session_timeout=600 # ¨î³s½u¤H¼Æ max_clients=50 max_per_ip=5 # 2. »P¹êÅé¥Î¤á¬ÛÃöªº¸ê°T¡A¥»®×¨Ò¤¤¬°Ãö³¬¥Lªº±¡ªp¡I local_enable=NO # 3. »P¥D¾÷¦³Ãöªº³]©w use_localtime=YES dirmessage_enable=YES xferlog_enable=YES connect_from_port_20=YES xferlog_std_format=YES pam_service_name=vsftpd listen=YES tcp_wrappers=YES banner_file=/etc/vsftpd/anon_welcome.txt [root@linux ~]# /etc/init.d/vsftpd restart |
[root@linux ~]# vi /etc/vsftpd/anon_welcome.txt Åwªï¥úÁ{¥»¯¸©Ò´£¨Ñªº FTP ªA°È¡I ¥»¯¸¥Dn´£¨Ñ Linux §@·~¨t²Î¬ÛÃöÀÉ®×¥H¤Î GNU ¦Û¥Ñ³nÅé³á¡I ¦³°ÝÃD½Ð»P¯¸ªøÁpµ¸¡IÁÂÁ¤j®a¡I ¥Dnªº¥Ø¿ý¬°¡G linux ´£¨Ñ Linux §@·~¨t²Î¬ÛÃö³nÅé gnu ´£¨Ñ GNU ªº¦Û¥Ñ³nÅé |
[root@linux ~]# ftp localhost Connected to localhost (127.0.0.1). 220-Åwªï¥úÁ{¥»¯¸©Ò´£¨Ñªº FTP ªA°È¡I <==¦P¼Ëªº¡A¤@¨ÇÅwªï°T®§ 220-¥»¯¸¥Dn´£¨Ñ Linux §@·~¨t²Î¬ÛÃöÀÉ®×¥H¤Î GNU ¦Û¥Ñ³nÅé³á¡I 220-¦³°ÝÃD½Ð»P¯¸ªøÁpµ¸¡IÁÂÁ¤j®a¡I 220-¥Dnªº¥Ø¿ý¬°¡G 220- 220-linux ´£¨Ñ Linux §@·~¨t²Î¬ÛÃö³nÅé 220-gnu ´£¨Ñ GNU ªº¦Û¥Ñ³nÅé 220 Name (localhost:root): anonymous <==¤@©w±o¬O³oӰΦW±b¸¹ 230 Login successful. Remote system type is UNIX. Using binary mode to transfer files. ftp> dir 227 Entering Passive Mode (127,0,0,1,94,56) 150 Here comes the directory listing. drwxr-xr-x 2 0 0 4096 Dec 18 17:37 gnu drwxr-xr-x 2 0 0 4096 Dec 18 17:37 linux drwxr-xr-x 2 0 0 4096 Aug 13 03:25 pub 226 Directory send OK. ftp> bye 221 Goodbye. |
[root@linux ~]# vi /etc/vsftpd/vsftpd.conf # ·s¼W©³¤U³o´X¦æ°Ú¡I write_enable=YES anon_other_write_enable=YES anon_mkdir_write_enable=YES anon_upload_enable=YES [root@linux ~]# /etc/init.d/vsftpd restart |
[root@linux ~]# mkdir /var/ftp/upload [root@linux ~]# chown ftp /var/ftp/upload |
[root@linux ~]# vi /etc/vsftpd/vsftpd.conf # ±N³o´X¦æµ¹¥L§ï¤@§ï¥ý¡I write_enable=YES anon_mkdir_write_enable=YES anon_upload_enable=YES chown_uploads=YES chown_username=root [root@linux ~]# /etc/init.d/vsftpd restart |
[root@linux ~]# vi /etc/vsftpd/vsftpd.conf # ¼W¥[©³¤U³o´X¦æ§Y¥i°Ú¡I pasv_min_port=65400 pasv_max_port=65410 [root@linux ~]# /etc/init.d/vsftpd restart |
iptables -A INPUT -p TCP -i $EXTIF --dport 21 -j ACCEPT |
iptables -A INPUT -p TCP -i $EXTIF --dport 65400:65410 -j ACCEPT |
[root@linux ~]# vi /etc/hosts.allow vsftpd: 192.168.1.0/255.255.255.0 [root@linux ~]# vi /etc/hosts.deny vsftpd: ALL |
[root@linux ~]# vi /etc/xinetd.d/vsftpd # vsftpd is the secure FTP server. service ftp { disable = no socket_type = stream wait = no user = root server = /usr/sbin/vsftpd server_args = /etc/vsftpd/vsftpd.conf # ¤W±³oÓ server ªº³]©w½Ð¨Ì·Ó±zªº¥D¾÷Àô¹Ò¨Ó³]©w¡I # ¦Ü©ó server_args «h½Ð¼g¤J±zªº vsftpd ªº³]©wÀɧ¹¾ãÀɦW§Y¥i¡I per_source = 5 <==»P¦P¤@ IP ªº³s½u¼Æ¥Ø¦³Ãö instances = 200 <==¦P¤@®É¶¡³Ì¦hªº³s½u¼Æ¥Ø no_access = 192.168.1.3 banner_fail = /etc/vsftpd/vsftpd.busy_banner # ¤W±³oÓÀÉ®×´N¬O·í¥D¾÷¦£¸L¤¤¡A«h¦b Client ºÝÅã¥Üªº¤º®e¡I log_on_success += PID HOST DURATION log_on_failure += HOST } [root@linux ~]# vi /etc/vsftpd/vsftpd.conf # ½T©w³oÓÀɮפº¦s¦b³oӰѼƳá¡I listen=NO [root@linux ~]# vi /etc/vsftpd/vsftpd.busy_banner 421 «Ü©êºp¡A¦øªA¾¹²{¦b¤W½u¤H¼Æ¹L¦h¡A½Ð«Ý·|¨à¦A³s½u¡I # ¨ºÓ 421 ¬O¿ù»~¥N½Xù¡I [root@linux ~]# /etc/init.d/vsftpd stop [root@linux ~]# /etc/init.d/xinetd restart |