centos7FTP部署及问题集锦

linux服务器ftp部署一般用vsftpd，分三种身份登录模式：匿名用户、本地用户、虚拟用户；匿名用户模式一般用于个人使用，安全系数最低，本地用户安全系数稍高，但用户管理不便，匿名用户一般用以生产环境，安全系数高最高，易于管理

匿名用户登录

#安装
[root@k8s-slave1 ~]# yum install -y vsftpd ftp
#匿名配置
cat /etc/vsftpd/vsftpd.conf
anonymous_enable=YES
local_enable=YES
write_enable=YES
local_umask=022
anon_upload_enable=YES
anon_mkdir_write_enable=YES
anon_other_write_enable=YES
dirmessage_enable=YES
xferlog_enable=YES
connect_from_port_20=YES
xferlog_std_format=YES
ftpd_banner=Welcome to blah FTP service.
listen=YES
listen_ipv6=NO
pam_service_name=vsftpd
userlist_enable=YES
tcp_wrappers=YES

#授权ftp工作目录，切记授权目标是/var/ftp/pub，不要/var/ftp也给了否则报错
“500 OOPS: vsftpd: refusing to run with writable root inside chroot()”
#网上针对以上错误有chown  a-w /var/ftp的解决方案，但要确保ftp用户对pub子目录有可写权限，否则无法创建目录（550 Create directory operation failed.）
[root@k8s-master ~]# chown -R ftp.ftp /var/ftp/pub
[root@k8s-master ~]# ls -l /var/|grep ftp
drwxr-xr-x   3 root root   17 Feb 17 23:41 ftp
[root@k8s-master ~]# ls -l /var/ftp/
total 0
drwxr-xr-x 5 ftp ftp 44 Feb 18 00:42 pub
[root@k8s-master ~]# systemctl start vsftpd && systemctl enable vsftpd

#登录测试
[root@k8s-master ~]# ftp 127.0.0.1
Connected to 127.0.0.1 (127.0.0.1).
220 Welcome to blah FTP service.
Name (127.0.0.1:root): anonymous
331 Please specify the password.
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls
227 Entering Passive Mode (127,0,0,1,187,70).
150 Here comes the directory listing.
drwxr-xr-x    5 14       50             44 Feb 17 16:42 pub
226 Directory send OK.
ftp> cd pub
250 Directory successfully changed.
ftp> ls
227 Entering Passive Mode (127,0,0,1,242,58).
150 Here comes the directory listing.
dr-x------    2 14       50              6 Feb 17 16:30 test
dr-x------    2 14       50              6 Feb 17 16:30 test1
drwx------    2 14       50              6 Feb 17 16:42 test3
226 Directory send OK.
ftp> mkdir test2
257 "/pub/test2" created
ftp> ls
227 Entering Passive Mode (127,0,0,1,186,25).
150 Here comes the directory listing.
dr-x------    2 14       50              6 Feb 17 16:30 test
dr-x------    2 14       50              6 Feb 17 16:30 test1
drwx------    2 14       50              6 Feb 17 16:53 test2
drwx------    2 14       50              6 Feb 17 16:42 test3
226 Directory send OK.
ftp> 

本地用户登录配置

#修改配置如下
[ryan@k8s-master root]$ cat /etc/vsftpd/vsftpd.conf
anonymous_enable=NO
local_enable=YES
write_enable=YES
local_umask=022
dirmessage_enable=YES
xferlog_enable=YES
connect_from_port_20=YES
xferlog_std_format=YES
ftpd_banner=Welcome to blah FTP service.
listen=YES
listen_ipv6=NO
pam_service_name=vsftpd
userlist_enable=YES
userlist_deny=YES
tcp_wrappers=YES

#重启服务，并登录测试，本地用户模式，默认ftp目录在本地用户家目录下
[root@k8s-master ~]# systemctl restart vsftpd
[root@k8s-master ~]# ftp 127.0.0.1
Connected to 127.0.0.1 (127.0.0.1).
220 Welcome to blah FTP service.
Name (127.0.0.1:root): ryan
331 Please specify the password.
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> pwd
257 "/home/ryan"
ftp> mkdir test2
257 "/home/ryan/test2" created
ftp> ls
227 Entering Passive Mode (127,0,0,1,166,6).
150 Here comes the directory listing.
drwxr-xr-x    2 1001     1001            6 Feb 17 17:21 test2
226 Directory send OK.
ftp> 

虚拟用户登录模式

1.先安装ftp数软件

yum install db4 db4-utils -y

2.创建虚拟账号与系统账号(不可登录)

[root@k8s-node1 vsftpd]# cd /etc/vsftpd/
[root@k8s-node1 vsftpd]# cat ftp_user.txt 
test_write
6c83261afb
test_read
6c83261afb
[root@k8s-node1 vsftpd]# db_load -T -t hash -f ftp_user.txt ftp_user.db
[root@k8s-node1 vsftpd]# chmod 600 ftp_user.db 
#创建系统账号
[root@k8s-node1 vsftpd]# useradd -d /data/ftpdata -s /sbin/nologin virtual_user
[root@k8s-node1 vsftpd]# chmod -R 755 /data/ftpdata/
[root@k8s-node1 vsftpd]# echomkdir /etc/vsftpd/virtual_user_dir "virtual_user" >> ftpusers
[root@k8s-node1 vsftpd]# cat /etc/pam.d/vsftpd 
auth required pam_userdb.so db=/etc/vsftpd/ftp_user
account required pam_userdb.so db=/etc/vsftpd/ftp_user
#创建虚拟账号目录，并配置账号权限
[root@k8s-node1 virtual_user_dir]# cd /etc/vsftpd/virtual_user_dir/
[root@k8s-node1 virtual_user_dir]# pwd
/etc/vsftpd/virtual_user_dir
[root@k8s-node1 virtual_user_dir]# ls
test_read  test_write
[root@k8s-node1 virtual_user_dir]# cat test_read 
anon_upload_enable=NO
anon_mkdir_write_enable=NO
anon_other_write_enable=NO
[root@k8s-node1 virtual_user_dir]# cat test_write
anon_upload_enable=YES
anon_mkdir_write_enable=YES
anon_other_write_enable=YES
#修改配置文件如下
anonymous_enable=NO
local_enable=YES
write_enable=YES
local_umask=022
anon_upload_enable=YES
anon_mkdir_write_enable=YES
anon_other_write_enable=YES
dirmessage_enable=YES
xferlog_enable=YES
connect_from_port_20=YES
xferlog_std_format=YES
ftpd_banner=Welcome to blah FTP service.
listen=YES
listen_ipv6=NO
pam_service_name=vsftpd
userlist_enable=YES
userlist_deny=YES
tcp_wrappers=YES
guest_enable=YES
guest_username=virtual_user
allow_writeable_chroot=YES
user_config_dir=/etc/vsftpd/virtual_user_dir
重启服务后，即可测试两个账号的可用性