简单介绍一下linux下的ftp服务及相关配置

Love The Way You Lie 2022-01-16 11:09 262阅读 0赞

实验目的搭建一个可以实现上传下载的简易的ftp服务器，

实验环境 vmware 6.5.2+redhatEnterprise linux5 AS

简单了解一下ftp服务器

简单的说 ，我们说支持ftp协议的服务器就是ftp服务器

他的主要功能就是实现文件的上传和下载，通常下载要多一点，在同一个Internet 下的不同操作系统之间实现文件的交流

windows 下利用IIS可以简单的实现ftp服务，利用 Serv-U等第三方工具，也是可以很好的实现ftp服务的

首先我们要明确一点，这个是连接到互联网的，提供一些资料供大家下载的，当然也可以上传，那么他的安全性就显得尤为重要，这也是为什么介绍linux下的ftp服务的原因

常用的服务器端软件，早期的wuftp ，传说中非常安全的vsftp ，以及专业版的proftp

今天的客户端windows server2003 上安装的flashfxp

ftp使用的端口

这么说感觉有点乱，

边做边讲吧，，本文不涉及深刻的原理性的东西

[![clip\_p\_w\_picpath002][clip_p_w_picpath002]][clip_p_w_picpath002_clip_p_w_picpath002]

我的内核版本

\[root@localhost ~\]\# cd /mnt

\[root@localhost mnt\]\# ls

cdrom hgfs

\[root@localhost mnt\]\# mount /dev/cdrom /mnt/cdrom

mount: block device /dev/cdrom is write-protected, mounting read-only

\[root@localhost mnt\]\# pwd

/mnt

\[root@localhost mnt\]\# cd cdrom/Server

\[root@localhost Server\]\#

\[root@localhost Server\]\# rpm -ivh vsftpd-2.0.5-10.el5.i386.rpm

warning: vsftpd-2.0.5-10.el5.i386.rpm: Header V3 DSA signature: NOKEY, key ID 37017186

Preparing... \#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\# \[100%\]

1:vsftpd \#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\# \[100%\]

\[root@localhost Server\]\#

安装ftp服务我们只需要一个包rpm -ivh vsftpd-2.0.5-10.el5.i386.rpm

他的登陆用户

普通用户 （系统用户）

匿名用户 （anonymous）

普通用户大都是在系统内建立的账户，或者属于哪个组，访问需要密码

匿名用户 用户名通常是anonymous密码通常为空，也就是说可以允许很多人访问，

他的相关文件

/etc/vsftpd/vsftpd.conf 配置文件

/etc/vsftpd/ftpusers 用户访问控制文件

/etc/vsftpd/user\_list

任何情况下写进/etc/vsftpd/ftpusers里的用户都将被禁止访问

修改了/etc/vsftpd/vsftpd.conf 配置文件的关键字后，只有写入/etc/vsftpd/user\_list

的用户名，才可以访问

—————————————————————————————————————————————————————————————————————————————————————————————————————————————————————

\# Example config file /etc/vsftpd/vsftpd.conf

\# The default compiled in settings are fairly paranoid. This sample file

\# loosens things up a bit, to make the ftp daemon more usable.

\# Please see vsftpd.conf.5 for all compiled in defaults.

\# READ THIS: This example file is NOT an exhaustive list of vsftpd options.

\# Please read the vsftpd.conf.5 manual page to get a full idea of vsftpd's

\# capabilities.

\# Allow anonymous FTP? (Beware - allowed by default if you comment this out).

anonymous\_enable=YES

启用匿名用户 是

\# Uncomment this to allow local users to log in.

local\_enable=YES

启用本地用户

\# Uncomment this to enable any form of FTP write command.

write\_enable=YES

\# Default umask for local users is 077. You may wish to change this to 022,

\# if your users expect that (022 is used by most other ftpd's)

local\_umask=022

这里是说目录默认权限，

文件的默认权限是666的话那么666-022=644

目录的默认权限是777的话那么777-022=755

这里你把022改大的话，相应的权限会减小的

\# Uncomment this to allow the anonymous FTP user to upload files. This only

\# has an effect if the above global write enable is activated. Also, you will

\# obviously need to create a directory writable by the FTP user.

\#anon\_upload\_enable=YES

允许匿名上传

\# Uncomment this if you want the anonymous FTP user to be able to create

\# new directories.

\#anon\_mkdir\_write\_enable=YES

**是否允许匿名用户有创建目录的权利**

\# Activate directory messages - messages given to remote users when they

\# go into a certain directory.

dirmessage\_enable=YES

是否显示目录说明文件

\# Activate logging of uploads/downloads.

xferlog\_enable=YES

启用日志

\# Make sure PORT transfer connections originate from port 20 (ftp-data).

connect\_from\_port\_20=YES

连接端口 20

\# If you want, you can arrange for uploaded anonymous files to be owned by

\# a different user. Note! Using "root" for uploaded files is not

\# recommended!

\#chown\_uploads=YES

\#chown\_username=whoever

\# You may override where the log file goes if you like. The default is shown

\# below.

\#xferlog\_file=/var/log/vsftpd.log

日志文件存放位置

\# If you want, you can have your log file in standard ftpd xferlog format

xferlog\_std\_format=YES

使用标准的xferlog模式

\# You may change the default value for timing out an idle session.

\#idle\_session\_timeout=600

会话超时闲置\#

\# You may change the default value for timing out a data connection.

\#data\_connection\_timeout=120

数据连接超时

\# It is recommended that you define on your system a unique user which the

\# ftp server can use as a totally isolated and unprivileged user.

\#nopriv\_user=ftpsecure

\# Enable this and the server will recognise asynchronous ABOR requests. Not

\# recommended for security (the code is non-trivial). Not enabling it,

\# however, may confuse older FTP clients.

\#async\_abor\_enable=YES

**是否允许运行特殊的** **ftp** **命令** **async**

\# By default the server will pretend to allow ASCII mode but in fact ignore

\# the request. Turn on the below options to have the server actually do ASCII

\# mangling on files when in ASCII mode.

\# Beware that on some FTP servers, ASCII support allows a denial of service

\# attack (DoS) via the command "SIZE /big/file" in ASCII mode. vsftpd

\# predicted this attack and has always been safe, reporting the size of the

\# raw file.

\# ASCII mangling is a horrible feature of the protocol.

\#ascii\_upload\_enable=YES

\#ascii\_download\_enable=YES

使用ASCII的上传和下载

\# You may fully customise the login banner string:

\#ftpd\_banner=Welcome to blah FTP service.

自定义欢迎信息

\# You may specify a file of disallowed anonymous e-mail addresses. Apparently

\# useful for combatting certain DoS attacks.

\#deny\_email\_enable=YES

\# (default follows)

\#banned\_email\_file=/etc/vsftpd/banned\_emails

**是否允许禁止匿名用户使用某些邮件地址** **,** **如果是，输入禁止的邮件地址的路径和文件名**

\# You may specify an explicit list of local users to chroot() to their home

\# directory. If chroot\_local\_user is YES, then this list becomes a list of

\# users to NOT chroot().

\#chroot\_list\_enable=YES

\# (default follows)

\#chroot\_list\_file=/etc/vsftpd/chroot\_list

\# You may activate the "-R" option to the builtin ls. This is disabled by

\# default to avoid remote users being able to cause excessive I/O on large

\# sites. However, some broken FTP clients such as "ncftp" and "mirror" assume

\# the presence of the "-R" option, so there is a strong case for enabling it.

\#ls\_recurse\_enable=YES

**若是启动此功能，则允许登入者使用** **ls -R**  **这个指令。默认值为** **NO**

\# When "listen" directive is enabled, vsftpd runs in standalone mode and

\# listens on IPv4 sockets. This directive cannot be used in conjunction

\# with the listen\_ipv6 directive.

listen=YES

\# This directive enables listening on IPv6 sockets. To listen on IPv4 and IPv6

\# sockets, you must run two copies of vsftpd whith two configuration files.

\# Make sure, that one of the listen options is commented !!

\#listen\_ipv6=YES

pam\_service\_name=vsftpd

userlist\_enable=YES

tcp\_wrappers=YES

——————————————————————————————————————————————————————————————————————————————

我们暂时先不做任何修改

确保我们的DNS解析正常

重启服务

\[root@localhost Server\]\# service vsftpd restart

关闭 vsftpd： \[失败\]

为 vsftpd 启动 vsftpd： \[确定\]

\[root@localhost Server\]\#

服务器的ip是192.168.0.5 客户端用windows server2003

我用aa用户密码为空登陆ftp服务器ls后显示有一个pub目录

上面装了 flashfxp客户端我们打开FlashFxp

[![clip\_p\_w\_picpath004][clip_p_w_picpath004]][clip_p_w_picpath004_clip_p_w_picpath004]

[![clip\_p\_w\_picpath006][clip_p_w_picpath006]][clip_p_w_picpath006_clip_p_w_picpath006] [![clip\_p\_w\_picpath008][clip_p_w_picpath008]][clip_p_w_picpath008_clip_p_w_picpath008] [![clip\_p\_w\_picpath010][clip_p_w_picpath010]][clip_p_w_picpath010_clip_p_w_picpath010]

我们双击上层目录，就会发现，它是可以打开得，也是可以下载的，

[![clip\_p\_w\_picpath012][clip_p_w_picpath012]][clip_p_w_picpath012_clip_p_w_picpath012]

[![clip\_p\_w\_picpath014][clip_p_w_picpath014]][clip_p_w_picpath014_clip_p_w_picpath014] [![clip\_p\_w\_picpath016][clip_p_w_picpath016]][clip_p_w_picpath016_clip_p_w_picpath016]

用记事本打开

[![clip\_p\_w\_picpath018][clip_p_w_picpath018]][clip_p_w_picpath018_clip_p_w_picpath018]

虽然这不能看到密码，但这也是很不安全的，想想看我们的ftp服务器是要放到公网上去的，所以我们自身的安全就显得尤为重要，

[![clip\_p\_w\_picpath020][clip_p_w_picpath020]][clip_p_w_picpath020_clip_p_w_picpath020]

如果用户用匿名登陆不用填写用户名直接勾选复选款即可

[![clip\_p\_w\_picpath022][clip_p_w_picpath022]][clip_p_w_picpath022_clip_p_w_picpath022]

还有就是 [![clip\_p\_w\_picpath024][clip_p_w_picpath024]][clip_p_w_picpath024_clip_p_w_picpath024]

注意这里的 用户名是anonymous 密码是空

\[root@localhost ~\]\# vi /etc/vsftpd/vsftpd.conf

我们来修改一下配置文件解决这个问题

chroot\_local\_user=YES

添加这么一句

注意大小写

保存退出

重启服务

\[root@localhost ~\]\# service vsftpd restart

关闭 vsftpd： \[确定\]

为 vsftpd 启动 vsftpd： \[确定\]

\[root@localhost ~\]\#

这时不论你是用的匿名用户还是普通用户，都不能对上层目录进行访问，添加的这一句就是把用户限定在，只能访问自己家目录下的文件，

第二个应用 限定特定用户访问，

记得这两个用户控制文件

/etc/vsftpd/ftpusers

[![clip\_p\_w\_picpath026][clip_p_w_picpath026]][clip_p_w_picpath026_clip_p_w_picpath026]把aa用户加入到这个文件之后，会发现aa就访问不了了

[![clip\_p\_w\_picpath028][clip_p_w_picpath028]][clip_p_w_picpath028_clip_p_w_picpath028]

/etc/vsftpd/user\_list

还有一种方法是

修改配置文件

\[root@localhost ~\]\# vi /etc/vsftpd/vsftpd.conf

userlist\_enable=YES

userlist\_deny=NO

userlist\_file=/etc/vsftpd/user\_list

这三句话的意思是，只有写入/etc/vsftpd/user\_list 的文件中的用户才可以访问其他用户不允许访问

修改完配置文件后重启服务

\[root@localhost ~\]\# vi /etc/vsftpd/user\_list

在这个文件里添加用户

[![clip\_p\_w\_picpath030][clip_p_w_picpath030]][clip_p_w_picpath030_clip_p_w_picpath030]

比如说添加了aa bb anonymous

三个用户

[![clip\_p\_w\_picpath032][clip_p_w_picpath032]][clip_p_w_picpath032_clip_p_w_picpath032]

这时bb成功登陆

[![clip\_p\_w\_picpath034][clip_p_w_picpath034]][clip_p_w_picpath034_clip_p_w_picpath034]

匿名用户成功登陆

[![clip\_p\_w\_picpath036][clip_p_w_picpath036]][clip_p_w_picpath036_clip_p_w_picpath036]

aa用户是登陆不上去的

我们说 不论在什么情况下，只要把用户名写入/etc/vsftpd/ftpusers文件的用户就永远登不上去

第三个应用 匿名用户的访问控制

对于匿名用户我们主要是控制他上传，修改，因为你不能确定他上传的东西是不是病毒等等

在修改配置文件之前匿名用户拥有的权限很小，不能建立目录，不能改名，不能上传等等

修改配置文件加入以下几行 位置随便你

\[root@localhost ~\]\# vi /etc/vsftpd/vsftpd.conf

anon\_upload\_enable=YES

anon\_mkdir\_write\_enable=YES

anon\_other\_write\_enable=YES

\[root@localhost ~\]\# service vsftpd restart

关闭 vsftpd： \[确定\]

为 vsftpd 启动 vsftpd： \[确定\]

\[root@localhost ~\]\#

重启服务

这时你要是用匿名用户访问的话还是建立不了目录的

因为默认的根目录是不能上传的

\[root@localhost ~\]\# cd /var/ftp

\[root@localhost ftp\]\# ls

pub

\[root@localhost ftp\]\# cd pub

\[root@localhost pub\]\# ls

\[root@localhost pub\]\# mkdir test

\[root@localhost pub\]\# ll

总计 8

drwxr-xr-x 2 root root 4096 05-02 15:24 test

\[root@localhost pub\]\# chown ftp test

\[root@localhost pub\]\#

我们在匿名用户的默认家目录/var/ftp/pub下建立子目录、 并修改test的属组

[![clip\_p\_w\_picpath038][clip_p_w_picpath038]][clip_p_w_picpath038_clip_p_w_picpath038]

这时你在test下就可以建立目录删除 改名上传等等了

\[root@localhost pub\]\# cd test

\[root@localhost test\]\# ls

aa ad

\[root@localhost test\]\# cd aa

\[root@localhost aa\]\# ls

passwd

\[root@localhost aa\]\#

服务器上看一下

实例应用 限制匿名用户的访问数量

修改配置文件

添加如下键值

anon\_max\_rate=300

限制用户上限为300数字根据实际情况定义

现就简单的介绍到这里，ftp的服务和功能远远不止这些，相对于samba来说，ftp主要是应用于公网。

文中不到或是错误之处，还望看到的朋友多多指教

转载于:https://blog.51cto.com/wl2009/156503

[clip_p_w_picpath002]: https://s1.51cto.com/attachment/200905/2/644976_1241249907spSw.jpg
[clip_p_w_picpath002_clip_p_w_picpath002]: https://s1.51cto.com/attachment/200905/2/644976_1241249906OI5q.jpg
[clip_p_w_picpath004]: https://s1.51cto.com/attachment/200905/2/644976_1241249910QyXc.jpg
[clip_p_w_picpath004_clip_p_w_picpath004]: https://s1.51cto.com/attachment/200905/2/644976_1241249908CzW9.jpg
[clip_p_w_picpath006]: https://s1.51cto.com/attachment/200905/2/644976_1241249914xhK3.jpg
[clip_p_w_picpath006_clip_p_w_picpath006]: https://s1.51cto.com/attachment/200905/2/644976_1241249912qnR0.jpg
[clip_p_w_picpath008]: https://s1.51cto.com/attachment/200905/2/644976_12412499179n2V.jpg
[clip_p_w_picpath008_clip_p_w_picpath008]: https://s1.51cto.com/attachment/200905/2/644976_1241249916jVk5.jpg
[clip_p_w_picpath010]: https://s1.51cto.com/attachment/200905/2/644976_1241249922PZVp.jpg
[clip_p_w_picpath010_clip_p_w_picpath010]: https://s1.51cto.com/attachment/200905/2/644976_1241249920CBwe.jpg
[clip_p_w_picpath012]: https://s1.51cto.com/attachment/200905/2/644976_1241249930Bq6o.jpg
[clip_p_w_picpath012_clip_p_w_picpath012]: https://s1.51cto.com/attachment/200905/2/644976_1241249926djuY.jpg
[clip_p_w_picpath014]: https://s1.51cto.com/attachment/200905/2/644976_12412499391HFi.jpg
[clip_p_w_picpath014_clip_p_w_picpath014]: https://s1.51cto.com/attachment/200905/2/644976_1241249934pIqi.jpg
[clip_p_w_picpath016]: https://s1.51cto.com/attachment/200905/2/644976_1241249942kYud.jpg
[clip_p_w_picpath016_clip_p_w_picpath016]: https://s1.51cto.com/attachment/200905/2/644976_1241249941ifs6.jpg
[clip_p_w_picpath018]: https://s1.51cto.com/attachment/200905/2/644976_1241249949gfee.jpg
[clip_p_w_picpath018_clip_p_w_picpath018]: https://s1.51cto.com/attachment/200905/2/644976_1241249946hpkX.jpg
[clip_p_w_picpath020]: https://s1.51cto.com/attachment/200905/2/644976_1241249952JYho.jpg
[clip_p_w_picpath020_clip_p_w_picpath020]: https://s1.51cto.com/attachment/200905/2/644976_1241249950Uxr4.jpg
[clip_p_w_picpath022]: https://s1.51cto.com/attachment/200905/2/644976_1241249955YuqU.jpg
[clip_p_w_picpath022_clip_p_w_picpath022]: https://s1.51cto.com/attachment/200905/2/644976_124124995482LR.jpg
[clip_p_w_picpath024]: https://s1.51cto.com/attachment/200905/2/644976_1241249960WMeS.jpg
[clip_p_w_picpath024_clip_p_w_picpath024]: https://s1.51cto.com/attachment/200905/2/644976_12412499579PgV.jpg
[clip_p_w_picpath026]: https://s1.51cto.com/attachment/200905/2/644976_1241249966I6jR.jpg
[clip_p_w_picpath026_clip_p_w_picpath026]: https://s1.51cto.com/attachment/200905/2/644976_1241249965SgXf.jpg
[clip_p_w_picpath028]: https://s1.51cto.com/attachment/200905/2/644976_1241249970duQC.jpg
[clip_p_w_picpath028_clip_p_w_picpath028]: https://s1.51cto.com/attachment/200905/2/644976_1241249968tH6s.jpg
[clip_p_w_picpath030]: https://s1.51cto.com/attachment/200905/2/644976_1241249975uHln.jpg
[clip_p_w_picpath030_clip_p_w_picpath030]: https://s1.51cto.com/attachment/200905/2/644976_1241249974WvIC.jpg
[clip_p_w_picpath032]: https://s1.51cto.com/attachment/200905/2/644976_12412499779YO1.jpg
[clip_p_w_picpath032_clip_p_w_picpath032]: https://s1.51cto.com/attachment/200905/2/644976_12412499764Ooo.jpg
[clip_p_w_picpath034]: https://s1.51cto.com/attachment/200905/2/644976_12412499781Xeo.jpg
[clip_p_w_picpath034_clip_p_w_picpath034]: https://s1.51cto.com/attachment/200905/2/644976_1241249978urTD.jpg
[clip_p_w_picpath036]: https://s1.51cto.com/attachment/200905/2/644976_1241249980xgOi.jpg
[clip_p_w_picpath036_clip_p_w_picpath036]: https://s1.51cto.com/attachment/200905/2/644976_1241249979a1f7.jpg
[clip_p_w_picpath038]: https://s1.51cto.com/attachment/200905/2/644976_1241249987cCbS.jpg
[clip_p_w_picpath038_clip_p_w_picpath038]: https://s1.51cto.com/attachment/200905/2/644976_1241249983M44u.jpg