如何用vsftpd实现用户不同权限:只能下载,可上传,管理权限等 [仅供参考未亲测]

如何用vsftpd实现用户不同权限:只能下载,可上传,管理权限等  2007-01-29 10:20:09

分类： LINUX

前提条件:

      必须安装包:vsftpd-2.0.1-5

---

      利用虚拟用户可实现不同用户拥有不同权限的要求

第一步:建立本地虚拟用户(Create the local virtual user)

      useradd -d /opt/ftp-server  virtual

      新建virtual用户,指定主目录为/opt/ftp-server(该目录实际存在)

 

第二步:建立虚拟用户数据库(Create the virtual users database)

                

      用户手工建立文本文件logins.txt  (存放/tmp)

      logins.txt文件内容

      ==================

      download

      123

      upload

      234

      admin

      345

 

      注:奇数行为用户名,偶数行为密码.

 

      db3_load -T -t hash -f /tmp/logins.txt /etc/vsftpd_login.db

 

      chmod 600 /etc/vsftpd_login.db

     

第三步:建立基于vsftpd_login的PAM授权文件(Create a PAM file which uses your new database)[ 此处也可用mysql建立用户信息]

      ftp(存放在/etc/pam.d/)内容如下

      ==================================

      auth required /lib/security/pam_userdb.so db=/etc/vsftpd_login
      account required /lib/security/pam_userdb.so db=/etc/vsftpd_login

 

第四步: 建立vsftpd.conf文件(Create your vsftpd.conf config file)

      anonymous_enable=NO
      local_enable=YES
      write_enable=NO
      anon_upload_enable=NO
      anon_mkdir_write_enable=NO
      anon_other_write_enable=NO
      chroot_local_user=YES
      guest_enable=YES
      guest_username=virtual
      user_config_dir=/etc/vsftpd/(虚拟用户库中不同用户的权限文件)
      listen=YES
      listen_port=10021
      pasv_min_port=30000
      pasv_max_port=30999

第五步: 建立针对虚拟用户库中不同用户的权限文件(第四步中已指定存放位置)

      (virtual主目录下有三个文件夹:download,upload,admin)

      download文件内容(只能下载权限)

      =====================

      local_root=/opt/ftp-server/download      

      anon_world_readable_only=NO

 

      upload文件内容(可上传权限)

      =====================

      local_root=/opt/ftp-server/upload
      anon_world_readable_only=NO
      write_enable=YES
      anon_upload_enable=YES
      anon_mkdir_write_enable=YES

      admin文件内容(管理权限)

      =====================

      local_root=/opt/ftp-server/admin
      anon_world_readable_only=NO
      write_enable=YES
      anon_upload_enable=YES
      anon_mkdir_write_enable=YES
      anno_other_writer_enable=YES

第六步: 启动vsftpd(Start up vsftpd)

      service vsftpd restart

 

第七步: 测试(Test)

 

[root@test vsftpd]# ftp 192.168.1.2 10021
Connected to 192.168.1.2.
220 (vsFTPd 2.0.1)
530 Please login with USER and PASS.
530 Please login with USER and PASS.
KERBEROS_V4 rejected as an authentication type
Name (192.168.1.2:root): admin
331 Please specify the password.
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls
227 Entering Passive Mode (192,168,1,2,119,247)
150 Here comes the directory listing.
226 Directory send OK.
ftp> pwd
257 "/"
ftp> cd /home
550 Failed to change directory.
ftp>

 

 

vsftpd.conf中的参数cmds_allowed=XXXXX

===================================================

此用户可以使用的指令
# ABOR - abort a file transfer
# CWD - change working directory
# DELE - delete a remote file
# LIST - list remote files
# MDTM - return the modification time of a file
# MKD - make a remote directory
# NLST - name list of remote directory
# PASS - send password
# PASV - enter passive mode
# PORT - open a data port
# PWD - print working directory
# QUIT - terminate the connection
# RETR - retrieve a remote file
# RMD - remove a remote directory
# RNFR - rename from
# RNTO - rename to
# SITE - site-specific commands
# SIZE - return the size of a file
# STOR - store a file on the remote host
# TYPE - set transfer type
# USER - send username
#
# less common commands:
# ACCT* - send account information
# APPE - append to a remote file
# CDUP - CWD to the parent of the current directory
# HELP - return help on using the server
# MODE - set transfer mode
# NOOP - do nothing
# REIN* - reinitialize the connection
# STAT - return server status
# STOU - store a file uniquely
# STRU - set file transfer structure
# SYST - return system type
===================================================

 

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

[ mysql建立用户信息]

配置虚拟用户（mysql） 

　　VSFTPD的本地用户本身是系统的用户，除了可以登录FTP服务器外，还可以登录系统使用其他系统资源，而 

VSFTPD的虚拟用户则是FTP服务的专用用户，虚拟用户只能访问FTP服务器资源。对于只需要通过FTP对系统有读 

写权限，而不需要其他系统资源的用户或情况来说，采用虚拟用户方式是很适合的。 

　　VSFTPD的虚拟用户采用单独的用户名/口令保存方式，与系统账号（passwd/shadow）分离，这大大增强了 

系统的安全性。VSFTPD可以采用数据库文件来保存用户/口令，如hash;也可以将用户/口令保存在数据库服务器 

中，如MySQL等。VSFTPD验证虚拟用户，则采用PAM方式。由于虚拟用户的用户名/口令被单独保存，因此在验证 

时，VSFTPD需要用一个系统用户的身份来读取数据库文件或数据库服务器以完成验证，这就是guest用户，这正 

如同匿名用户也需要有一个系统用户ftp一样。当然，guest用户也可以被认为是用于映射虚拟用户。 

　　配置虚拟用户分为几部分：guest用户的创建、用户/口令的保存、PAM认证配置、vsftpd.conf文件设置等 

。在后面的例子中，假定存在虚拟用户win和wingger. 



1、在系统中添加vsftpdvirtual用户，作为虚拟用户在系统中的代表。 

代码:

[root@Linux_win vsftpd]# useradd vsftpdvirtual

　　当虚拟用户登录后，所在的位置为vsftpdvirtual的自家目录/home/vsftpdvirtual。 

2、配置文件vsftpd.conf： 加入以下内容 
guest_enable=YES 
guest_username=vsftpdvirtual 
virtual_use_local_privs=YES|NO 

3、虚拟用户的权限配置。 
virtual_use_local_privs参数， 
当该参数激活（YES）时，虚拟用户使用与本地用户相同的权限。所有虚拟用户的权限使用local参数。 
当此参数关闭（NO）时，虚拟用户使用与匿名用户相同的权限，所有虚拟用户的权限使用anon参数。 
这两者种做法相比，后者更加严格一些，特别是在有写访问的情形下。默认情况下此参数是关闭的（NO）。 

由于本人的vsftpd为1.1.3，只好用virtual_use_local_privs=NO了： 
因此匿名用户的设置即是虚拟用户的设置，在改参数权限时，同时也要修改目录权限 
如：让用户不能浏览目录，但仍可以对文件操作且虚拟用户目录的权限改为只能由vsftpdvirtual操作： 

代码:

[root@Linux_win vsftpd]# chown vsftpdvirtual.vsftpdvirtual /home/vsftpdvirtual  [root@Linux_win vsftpd]# chmod 700 /home/vsftpdvirtual

由于这些设置对匿名用户生效。最好是禁止匿名用户登录。 


在VSFTPD-1.2.0以上版本，当virtual_use_local_privs=YES时，只需write_enable=YES，虚拟用户就可以就拥 

有写权限。应该与本地用户使用相同，有兴趣的可以去验证。 

如果不同用户使用不同的目录，须加入权限 

代码:

chown vsftpdvirtual.vsftpdvirtual /home/win  chown vsftpdvirtual.vsftpdvirtual /home/wingger

4、用MySQL保存虚拟用户 

　　1、虚拟用户的用户名/口令的保存。这部分在MySQL数据库中完成。 
首先，创建数据库vsftpdvirtual以及表users，并插入虚拟用户win、wingger。执行以下命令： 

代码:

[root@Linux_win vsftpd]# #mysql -uroot -p  mysql>create database vsftpdvirtual;  mysql>use vsftpdvirtual;  mysql>create table users(name char(16) binary,passwd char(16) binary);  mysql>insert into users (name,passwd) values ('win',password('123456'));  mysql>insert into users (name,passwd) values ('wingger',password('123456'));  mysql>quit

然后，授权vsftpdvirtual只能读vsftpdvirtual数据库的users表。执行以下命令： 

代码:

[root@Linux_win vsftpd]# mysql -u root mysql -p  mysql>grant select on vsftpdvirtual.users to vsftpdvirtual@localhost identified by '123456';  mysql>quit

验证刚才的操作是否成功可以执行下面命令： 

代码:

[root@Linux_win vsftpd]# mysql -u vsftpdvirtual -p123456 ftpdvirtual  mysql>select * from users;

如果成功，将会列出wing、wingger和加密后的密码。 
如下所示： 

引用:

mysql> select * from users;  +---------+------------------+  | name | passwd |  +---------+------------------+  | win | 23932fe477657768 |  | wingger | 23932fe477657768 |  +---------+------------------+  2 rows in set (0.00 sec)

　　2、设置PAM认证。这里我们要用到一个利用mysql进行pam验证的开源项目（http://sourceforge.net/proj 

ects/pam-mysql/）。首先从网站下载它的程序包pam_myql-0.5.tar.gz。在编译安装之前，要确保mysql-devel 

的RPM包已经安装在你的机器上，如果没有请从RHL安装光盘中安装该包。然后，执行以下命令： 

代码:

[root@Linux_win vsftpd]# tar xvzf pam_mysql-0.5.tar.gz  [root@Linux_win vsftpd]# cd pam_mysql  [root@Linux_win vsftpd]# make  [root@Linux_win vsftpd]# cp pam_mysql.so /bli/security

接下来，我们要设置vsftpd的PAM验证文件。打开/etc/pam.d/vsftpd文件，加入以下内容： 

引用:

auth required pam_mysql.so user=vsftpdvirtual passwd=123456 host=localhost db=vsftpdvirtual  table=users usercolumn=name passwdcolumn=passwd crypt=2  　　account required pam_mysql.so user=vsftpdvirtual passwd=123456 host=localhost  db=vsftpdvirtual table=users usercolumn=name passwdcolumn=passwd crypt=2

具体可查看vsftpd源包里的EXAMPLE中的例子。 



附：虚拟用户文档 
1、vsftpd.conf配置文件 

代码:

[root@Linux_win vsftpd]# cat vsftpd.conf  listen=YES  listen_address=192.168.1.2  anonymous_enable=NO  local_enable=YES  write_enable=YES  #anon_root=  anon_upload_enable=YES  anon_other_write_enable=YES  anon_mkdir_write_enable=YES  #anon_world_readable_only=YES  #anon_umask=777  #dirmessage_enable=YES  ftpd_banner=welcome to this FTP server  xferlog_enable=YES  #xferlog_file=/var/log/vsftpd.log  connect_from_port_20=YES  #pasv_mix_port=50000  #pasv_max_port=60000  #xferlog_std_format=YES  max_clients=10  max_per_ip=10  hide_ids=YES  #limit all users in it's owner dir  #chroot_local_user=YES  #or limit some  chroot_local_user=NO  chroot_list_enable=YES  chroot_list_file=/etc/vsftpd/chroot_list  #use ownwer conf file  user_config_dir=/etc/vsftpd/vsftpd_user_conf  pam_service_name=/etc/pam.d/vsftpd  guest_enable=YES  guest_username=vsftpdvirtual  #virtual_use_local_privs=NO

代码:

2、[root@Linux_win vsftpd]# cat /etc/pam.d/vsftpd  #%PAM-1.0  #auth       required    pam_listfile.so item=user sense=deny file=/etc/vsftpd.ftpusers  onerr=succeed  #auth       required    pam_stack.so service=system-auth  #auth       required    pam_shells.so  #account    required    pam_stack.so service=system-auth  #session    required    pam_stack.so service=system-auth  auth       required     /lib/security/pam_mysql.so user=vsftpdvirtual    passwd=123456   host=localhost   db=vsftpdvirtual table=users  usercolumn=name  passwdcolumn=passwd  crypt=2  account    required     /lib/security/pam_mysql.so user=vsftpdvirtual     passwd=123456     host=localhost   db=vsftpdvirtual table=users  usercolumn=name  passwdcolumn=passwd  crypt=2

代码:

3、[root@Linux_win vsftpd]# cat /etc/vsftpd/chroot_list  win  wingger

代码:

4、[root@Linux_win vsftpd]# ls -l /etc/vsftpd/vsftpd_user_conf  总用量 8  -rw-r--r--    1 root     root           21  1月  8 00:25 win  -rw-r--r--    1 root     root           25  1月  8 00:17 wingger

代码:

5、[root@Linux_win vsftpd]# cat /etc/vsftpd/vsftpd_user_conf/win  local_root=/home/win  [root@Linux_win vsftpd]# cat /etc/vsftpd/vsftpd_user_conf/wingger  local_root=/home/wingger

代码:

6、drwx------    6 vsftpdvirtual vsftpdvirtual    4096  1月  8 00:16 vsftpdvirtual  drwxrwxrwx    5 vsftpdvirtual vsftpdvirtual     4096  1月  8 01:47 win  drwxrwxrwx    3 vsftpdvirtual vsftpdvirtual     4096  1月  8 20:19 wingger

7、版本：(vsFTPd 1.1.3)、pam_mysql-0.5.tar.gz、mysql3.23.54 

8、[root@Linux_win vsftpd]# mysql -u vsftpdvirtual -pchenwy vsftpdvirtual 

mysql> select * from users; 
+---------+------------------+ 
| name | passwd | 
+---------+------------------+ 
| win | 23932fe477657768 | 
| wingger | 23932fe477657768 | 
+---------+------------------+ 
2 rows in set (0.00 sec)

 

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

 

 

官方文档

---

  http://www.vsftpdrocks.org/faq/  (常见问题解决办法)

  http://vsftpd.beasts.org

 

参考文档(各种形式的设置)

---

  http://www.itshantou.com/Servers/ftp/06/12/48714.html

 

 

[vsftpd的man手册信息]

$man 5 vsftpd.conf |col -b >vsftpd

---

VSFTPD.CONF(5)             VSFTPD.CONF(5)

 

NAME
       vsftpd.conf - config file for vsftpd

DESCRIPTION
       vsftpd.conf  may  be  used  to  control various  aspects  of vsftpd’s
       behaviour. By default, vsftpd looks for this  file  at the  location
       /etc/vsftpd/vsftpd.conf.  However, you may override this by specifying
       a command line argument to vsftpd. The command line  argument  is  the
       pathname  of the configuration file for vsftpd. This behaviour is use-
       ful because you may wish to use an advanced inetd such  as  xinetd  to
       launch vsftpd with different configuration files on a per virtual host
       basis.

FORMAT
       The format of vsftpd.conf is very simple. Each line is either  a  com-
       ment  or  a directive. Comment lines start with a # and are ignored. A
       directive line has the format:

       option=value

       It is important to note that it is an error to put any  space  between
       the option, = and value.

       Each  setting  has  a compiled in default which may be modified in the
       configuration file.

BOOLEAN OPTIONS
       Below is a list of boolean options. The value for a boolean option may
       be set to YES or NO.

       allow_anon_ssl
       Only  applies if ssl_enable is active. If set to YES, anonymous
       users will be allowed to use secured SSL connections.

       Default: NO

       anon_mkdir_write_enable
       If set to YES, anonymous users will be permitted to create  new
       directories  under  certain  conditions. For this to work, the
       option write_enable must be activated, and  the  anonymous  ftp
       user must have write permission on the parent directory.

       Default: NO

       anon_other_write_enable
       If  set  to  YES,  anonymous users will be permitted to perform
       write operations other than upload and create  directory,  such
       as deletion and renaming. This is generally not recommended but
       included for completeness.

       Default: NO

       anon_upload_enable
       If set to YES, anonymous users  will  be permitted  to  upload
       files  under  certain  conditions. For this to work, the option
       write_enable must be activated, and the anonymous ftp user must
       have write permission on desired upload locations.

       Default: NO

       anon_world_readable_only
       When  enabled, anonymous users will only be allowed to download
       files which are world readable. This is  recognising  that  the
       ftp  user may own files, especially in the presence of uploads.

       Default: YES

       anonymous_enable
       Controls whether anonymous logins  are  permitted  or  not.  If
       enabled, both the usernames ftp and anonymous are recognised as
       anonymous logins.

       Default: YES

       ascii_download_enable
       When enabled, ASCII mode data transfers  will  be  honoured  on
       downloads.

       Default: NO

       ascii_upload_enable
       When  enabled,  ASCII  mode  data transfers will be honoured on
       uploads.

       Default: NO

       async_abor_enable
       When enabled, a special FTP command known as "async ABOR"  will
       be  enabled.   Only  ill advised FTP clients will use this fea-
       ture. Additionally, this feature is awkward to handle, so it is
       disabled by default. Unfortunately, some FTP clients will hang
       when cancelling a transfer unless this feature is available, so
       you may wish to enable it.

       Default: NO

       background
       When  enabled,  and  vsftpd is started in "listen" mode, vsftpd
       will background the listener process. i.e. control will immedi-
       ately be returned to the shell which launched vsftpd.

       Default: NO

       check_shell
       Note!  This  option  only  has  an effect for non-PAM builds of
       vsftpd. If disabled, vsftpd will not check  /etc/shells  for  a
       valid user shell for local logins.

       Default: YES

       chmod_enable
       When  enables, allows use of the SITE CHMOD command. NOTE! This
       only applies to local users. Anonymous users never get  to  use
       SITE CHMOD.

       Default: YES

       chown_uploads
       If enabled, all anonymously uploaded files will have the owner-
       ship changed to the user specified in the  setting  chown_user-
       name.  This is useful from an administrative, and perhaps secu-
       rity, standpoint.

       Default: NO

       chroot_list_enable
       If activated, you may provide a list of  local  users  who  are
       placed  in  a chroot() jail in their home directory upon login.
       The meaning is slightly different if chroot_local_user  is  set
       to  YES. In  this case, the list becomes a list of users which
       are NOT to be placed in a chroot() jail. By default, the  file
       containing  this list  is /etc/vsftpd.chroot_list, but you may
       override this with the chroot_list_file setting.

       Default: NO

       chroot_local_user
       If set to YES, local users will be (by  default) placed in  a
       chroot() jail  in  their home directory after login.  Warning:
       This option has security implications, especially if the users
       have  upload  permission,  or  shell access. Only enable if you
       know what you are doing. Note that these security implications
       are  not vsftpd specific. They apply to all FTP daemons which
       offer to put local users in chroot() jails.

       Default: NO

       connect_from_port_20
       This controls whether PORT style data connections use  port  20
       (ftp-data)  on  the  server machine. For security reasons, some
       clients may insist that this is the case. Conversely, disabling
       this option enables vsftpd to run with slightly less privilege.

       Default: NO (but the sample config file enables it)

       deny_email_enable
       If activated, you may provide a list of anonymous  password  e-
       mail  responses which cause login to be denied. By default, the
       file containing this list is /etc/vsftpd.banned_emails, but you
       may override this with the banned_email_file setting.

       Default: NO

       dirlist_enable
       If  set to NO, all directory list commands will give permission
       denied.

       Default: YES

       dirmessage_enable
       If enabled, users of the FTP server can be shown messages  when
       they  first  enter  a new directory. By default, a directory is
       scanned for the file .message, but that may be overridden  with
       the configuration setting message_file.

       Default: NO (but the sample config file enables it)

       download_enable
       If  set  to  NO, all  download  requests  will give permission
       denied.

       Default: YES

       dual_log_enable
       If enabled, two log files are generated in parallel,  going  by
       default  to /var/log/xferlog and /var/log/vsftpd.log.  The for-
       mer is a wu-ftpd style  transfer log,  parseable  by  standard
       tools. The latter is vsftpd’s own style log.

       Default: NO

       force_dot_files
       If  activated,  files  and  directories starting with . will be
       shown in directory listings even if the "a" flag was  not  used
       by the client. This override excludes the "." and ".." entries.

       Default: NO

       force_local_data_ssl
       Only applies if ssl_enable is activated. If activated, all non-
       anonymous  logins  are forced to use a secure SSL connection in
       order to send and receive data on data connections.

       Default: YES

       force_local_logins_ssl
       Only applies if ssl_enable is activated. If activated, all non-
       anonymous  logins  are forced to use a secure SSL connection in
       order to send the password.

       Default: YES

       guest_enable
       If enabled, all non-anonymous logins  are  classed  as  "guest"
       logins.  A guest login is remapped to the user specified in the
       guest_username setting.

       Default: NO

       hide_ids
       If enabled, all user and group information in  directory list-
       ings will be displayed as "ftp".

       Default: NO

       listen If enabled, vsftpd will run in standalone mode. This means that
       vsftpd must not be run from an inetd of some kind. Instead, the
       vsftpd executable is run once directly. vsftpd itself will then
       take care of listening for and handling incoming connections.

       Default: NO

       listen_ipv6
       Like the listen parameter, except vsftpd will listen on an IPv6
       socket  instead  of  an IPv4 one. This parameter and the listen
       parameter are mutually exclusive.

       Default: NO

       local_enable
       Controls whether local logins are permitted or not. If enabled,
       normal user accounts in /etc/passwd may be used to log in.

       Default: NO

       log_ftp_protocol
       When  enabled,  all FTP requests and responses are logged, pro-
       viding the option xferlog_std_format is not enabled. Useful for
       debugging.

       Default: NO

       ls_recurse_enable
       When  enabled, this setting will allow the use of "ls -R". This
       is a minor security risk, because a ls -R at the top level of a
       large site may consume a lot of resources.

       Default: NO

       no_anon_password
       When enabled, this prevents vsftpd from asking for an anonymous
       password - the anonymous user will log straight in.

       Default: NO

       no_log_lock
       When enabled, this prevents vsftpd from taking a file lock when
       writing  to  log files. This  option  should generally not be
       enabled. It exists to workaround operating system bugs such  as
       the  Solaris  /  Veritas filesystem combination which has been
       observed to sometimes exhibit hangs trying to lock log files.

       Default: NO

       one_process_model
       If you have a Linux 2.4 kernel, it is possible to use a differ-
       ent  security model which only uses one process per connection.
       It is a less pure security model, but  gains  you  performance.
       You  really  don’t want to enable this unless you know what you
       are doing, and your site supports huge  numbers  of  simultane-
       ously connected users.

       Default: NO

       passwd_chroot_enable
       If enabled, along with chroot_local_user , then a chroot() jail
       location may be specified on a per-user basis. Each user’s jail
       is derived from their home directory string in /etc/passwd. The
       occurrence of /./ in the home directory string denotes that the
       jail is at that particular location in the path.

       Default: NO

       pasv_enable
       Set  to NO if you want to disallow the PASV method of obtaining
       a data connection.

       Default: YES

       pasv_promiscuous
       Set to YES if you want to disable the PASV security check  that
       ensures the data connection originates from the same IP address
       as the control connection.  Only enable if you  know  what  you
       are  doing! The only legitimate use for this is in some form of
       secure tunnelling scheme, or perhaps to facilitate FXP support.

       Default: NO

       port_enable
       Set  to NO if you want to disallow the PORT method of obtaining
       a data connection.

       Default: YES

       port_promiscuous
       Set to YES if you want to disable the PORT security check  that
       ensures  that outgoing data connections can only connect to the
       client. Only enable if you know what you are doing!

       Default: NO

       run_as_launching_user
       Set to YES if you want vsftpd to run as the user which launched
       vsftpd.  This  is  useful  where root access is not available.
       MASSIVE WARNING! Do NOT enable this option unless  you  totally
       know what you are doing, as naive use of this option can create
       massive security problems. Specifically, vsftpd does not / can-
       not  use chroot technology  to restrict file access when this
       option is set (even if launched by  root).  A  poor  substitute
       could  be to use a deny_file setting such as {/*,*..*}, but the
       reliability of this cannot compare to chroot, and should not be
       relied  on.   If using this option, many restrictions on other
       options apply. For example, options requiring privilege such as
       non-anonymous  logins,  upload  ownership  changing, connecting
       from port 20 and listen ports less than 1024 are not  expected
       to work. Other options may be impacted.

       Default: NO

       secure_email_list_enable
       Set  to  YES  if you want only a specified list of e-mail pass-
       words for anonymous logins to be accepted. This is useful as  a
       low-hassle  way  of  restricting access to low-security content
       without needing virtual users. When enabled,  anonymous  logins
       are  prevented  unless  the  password provided is listed in the
       file specified by the  email_password_file  setting.  The  file
       format  is  one  password  per  line,  no extra whitespace. The
       default filename is /etc/vsftpd.email_passwords.

       Default: NO

       session_support
       This controls whether vsftpd attempts to maintain sessions  for
       logins.  If  vsftpd  is  maintaining  sessions, it will try and
       update utmp and wtmp. It will also open a pam_session if using
       PAM  to  authenticate, and only close this upon logout. You may
       wish to disable this if you do not need  session logging,  and
       you  wish to give vsftpd more opportunity to run with less pro-
       cesses and / or less privilege. NOTE - utmp and wtmp support is
       only provided with PAM enabled builds.

       Default: NO

       setproctitle_enable
       If enabled, vsftpd will try and show session status information
       in the system process listing. In  other words, the  reported
       name  of the process will change to reflect what a vsftpd ses-
       sion is doing (idle, downloading etc).  You  probably  want  to
       leave this off for security purposes.

       Default: NO

       ssl_enable
       If  enabled,  and  vsftpd  was compiled against OpenSSL, vsftpd
       will support secure connections via SSL. This  applies  to  the
       control connection (including login) and also data connections.
       You’ll need a client  with  SSL  support too.  NOTE!!   Beware
       enabling this option. Only enable it if you need it. vsftpd can
       make no guarantees about the security of the OpenSSL libraries.
       By  enabling  this option, you are declaring that you trust the
       security of your installed OpenSSL library.

       Default: NO

       ssl_sslv2
       Only applies if  ssl_enable  is  activated.  If  enabled,  this
       option will permit SSL v2 protocol connections.  TLS v1 connec-
       tions are preferred.

       Default: NO

       ssl_sslv3
       Only applies if  ssl_enable  is  activated.  If  enabled,  this
       option will permit SSL v3 protocol connections.  TLS v1 connec-
       tions are preferred.

       Default: NO

       ssl_tlsv1
       Only applies if  ssl_enable  is  activated.  If  enabled,  this
       option will permit TLS v1 protocol connections.  TLS v1 connec-
       tions are preferred.

       Default: YES

       syslog_enable
       If enabled, then any  log  output  which would  have  gone  to
       /var/log/vsftpd.log  goes to the system log instead. Logging is
       done under the FTPD facility.

       Default: NO

       tcp_wrappers
       If enabled, and vsftpd was compiled with tcp_wrappers  support,
       incoming connections  will  be fed through tcp_wrappers access
       control. Furthermore, there is a mechanism  for per-IP based
       configuration.  If tcp_wrappers sets the VSFTPD_LOAD_CONF envi-
       ronment variable, then the vsftpd session will try and load the
       vsftpd configuration file specified in this variable.

       Default: NO

       text_userdb_names
       By  default, numeric IDs are shown in the user and group fields
       of directory listings. You can get textual  names  by  enabling
       this parameter. It is off by default for performance reasons.

       Default: NO

       tilde_user_enable
       If  enabled,  vsftpd  will  try  and  resolve pathnames such as
       ~chris/pics, i.e. a tilde followed by  a username.  Note  that
       vsftpd  will always resolve the pathnames ~ and ~/something (in
       this case the ~ resolves to the initial login directory).  Note
       that  ~user paths will only resolve if the file /etc/passwd may
       be found within the _current_ chroot() jail.

       Default: NO

       use_localtime
       If enabled, vsftpd will display  directory  listings  with  the
       time  in your  local time zone. The default is to display GMT.
       The times returned by the MDTM FTP command are also affected by
       this option.

       Default: NO

       use_sendfile
       An  internal  setting  used for testing the relative benefit of
       using the sendfile() system call on your platform.

       Default: YES

       userlist_deny
       This option is examined if userlist_enable is activated. If you
       set  this setting to NO, then users will be denied login unless
       they  are  explicitly  listed  in   the file   specified   by
       userlist_file.   When  login  is denied,  the denial is issued
       before the user is asked for a password.

       Default: YES

       userlist_enable
       If enabled, vsftpd will load a  list  of usernames,  from  the
       filename given  by  userlist_file.   If a user tries to log in
       using a name in this file, they will be denied before they  are
       asked  for a password. This may be useful in preventing cleart-
       ext passwords being transmitted. See also userlist_deny.

       Default: NO

       virtual_use_local_privs
       If enabled, virtual users will use the same privileges as local
       users.  By  default, virtual users will use the same privileges
       as anonymous users, which tends to be more  restrictive  (espe-
       cially in terms of write access).

       Default: NO

       write_enable
       This  controls  whether  any  FTP  commands  which  change  the
       filesystem are allowed or not. These commands are: STOR, DELE,
       RNFR, RNTO, MKD, RMD, APPE and SITE.

       Default: NO

       xferlog_enable
       If  enabled,  a  log file will be maintained detailling uploads
       and downloads.   By  default,  this  file  will  be  placed  at
       /var/log/vsftpd.log,  but this location may be overridden using
       the configuration setting vsftpd_log_file.

       Default: NO (but the sample config file enables it)

       xferlog_std_format
       If enabled, the transfer log file will be written  in  standard
       xferlog  format, as used by wu-ftpd. This is useful because you
       can reuse existing transfer statistics generators. The  default
       format is more readable, however. The default location for this
       style of log file is /var/log/xferlog, but you  may  change  it
       with the setting xferlog_file.

       Default: NO

NUMERIC OPTIONS
       Below  is a list of numeric options. A numeric option must be set to a
       non negative integer. Octal numbers are supported, for convenience  of
       the  umask  options.  To  specify  an octal number, use 0 as the first
       digit of the number.

       accept_timeout
       The timeout, in seconds, for a remote client to establish  con-
       nection with a PASV style data connection.

       Default: 60

       anon_max_rate
       The  maximum data transfer rate permitted, in bytes per second,
       for anonymous clients.

       Default: 0 (unlimited)

       anon_umask
       The value that the umask for file creation is set to for anony-
       mous users. NOTE! If you want to specify octal values, remember
       the "0" prefix otherwise the value will be treated as a base 10
       integer!

       Default: 077

       connect_timeout
       The  timeout, in seconds, for a remote client to respond to our
       PORT style data connection.

       Default: 60

       data_connection_timeout
       The timeout, in seconds, which is roughly the maximum  time  we
       permit  data  transfers  to  stall for with no progress. If the
       timeout triggers, the remote client is kicked off.

       Default: 300

       file_open_mode
       The permissions with which uploaded files are  created.  Umasks
       are  applied  on top  of this value. You may wish to change to
       0777 if you want uploaded files to be executable.

       Default: 0666

       ftp_data_port
       The port from which PORT style connections originate  (as  long
       as the poorly named connect_from_port_20 is enabled).

       Default: 20

       idle_session_timeout
       The  timeout,  in  seconds,  which is the maximum time a remote
       client may spend between FTP commands. If the timeout triggers,
       the remote client is kicked off.

       Default: 300

       listen_port
       If  vsftpd is in standalone mode, this is the port it will lis-
       ten on for incoming FTP connections.

       Default: 21

       local_max_rate
       The maximum data transfer rate permitted, in bytes per  second,
       for local authenticated users.

       Default: 0 (unlimited)

       local_umask
       The  value that the umask for file creation is set to for local
       users. NOTE! If you want to specify octal values, remember  the
       "0"  prefix  otherwise  the  value will be treated as a base 10
       integer!

       Default: 077

       max_clients
       If vsftpd is in standalone mode, this is the maximum number  of
       clients which may be connected. Any additional clients connect-
       ing will get an error message.

       Default: 0 (unlimited)

       max_per_ip
       If vsftpd is in standalone mode, this is the maximum number  of
       clients  which  may  be connected from the same source internet
       address. A client will get an error message  if  they  go  over
       this limit.

       Default: 0 (unlimited)

       pasv_max_port
       The  maximum  port to allocate for PASV style data connections.
       Can be used to specify a narrow  port  range  to assist fire-
       walling.

       Default: 0 (use any port)

       pasv_min_port
       The  minimum  port to allocate for PASV style data connections.
       Can be used to specify a narrow  port  range  to assist fire-
       walling.

       Default: 0 (use any port)

       trans_chunk_size
       You  probably  don’t want to change this, but try setting it to
       something like 8192 for a much smoother bandwidth limiter.

       Default: 0 (let vsftpd pick a sensible setting)

STRING OPTIONS
       Below is a list of string options.

       anon_root
       This option represents a directory which vsftpd will  try  to
       change  into  after  an  anonymous  login.  Failure is silently
       ignored.

       Default: (none)

       banned_email_file
       This option is the name of a file containing a list  of  anony-
       mous  e-mail  passwords  which  are not permitted. This file is
       consulted if the option deny_email_enable is enabled.

       Default: /etc/vsftpd.banned_emails

       banner_file
       This option is the name of a file containing  text  to  display
       when  someone  connects to the server. If set, it overrides the
       banner string provided by the ftpd_banner option.

       Default: (none)

       chown_username
       This is the name of the user who is given ownership  of  anony-
       mously  uploaded files. This option is only relevant if another
       option, chown_uploads, is set.

       Default: root

       chroot_list_file
       The option is the name of a file containing  a  list  of local
       users  which  will  be  placed in a chroot() jail in their home
       directory.  This option is  only  relevant  if  the   option
       chroot_list_enable  is enabled. If the option chroot_local_user
       is enabled, then the list file becomes a list of users  to  NOT
       place in a chroot() jail.

       Default: /etc/vsftpd.chroot_list

       cmds_allowed
       This  options  specifies a comma separated list of allowed FTP
       commands (post login. USER, PASS and QUIT  are  always  allowed
       pre-login).  Other  commands  are  rejected. This is a powerful
       method  of  really  locking  down  an  FTP   server.   Example:
       cmds_allowed=PASV,RETR,QUIT

       Default: (none)

       deny_file
       This  option  can  be  used to set a pattern for filenames (and
       directory names etc.) which should not  be  accessible  in  any
       way.  The  affected items are not hidden, but any attempt to do
       anything to them (download, change into directory, affect some-
       thing  within  directory etc.)  will be denied. This option is
       very simple, and should not be used for serious access  control
       -  the  filesystem’s  permissions should be used in preference.
       However, this option may be  useful  in  certain virtual  user
       setups. In particular aware that if a filename is accessible by
       a variety of names (perhaps  due to  symbolic  links  or  hard
       links),  then  care  must  be  taken  to deny access to all the
       names.  Access will be denied to items if their  name  contains
       the  string  given  by  hide_file, or if they match the regular
       expression specified by hide_file.  Note that vsftpd’s  regular
       expression  matching code is a simple implementation which is a
       subset of full regular  expression  functionality.  Because  of
       this,  you  will need  to  carefully and exhaustively test any
       application of this option. And  you  are  recommended  to  use
       filesystem  permissions for any important security policies due
       to       their    greater  reliability.      Example:
       deny_file={*.mp3,*.mov,.private}

       Default: (none)

       dsa_cert_file
       This  option  specifies  the location of the DSA certificate to
       use for SSL encrypted connections.

       Default: (none - an RSA certificate suffices)

       email_password_file
       This option can be used to provide an alternate file for usage
       by the secure_email_list_enable setting.

       Default: /etc/vsftpd.email_passwords

       ftp_username
       This is the name of the user we use for handling anonymous FTP.
       The home directory of this user is the root  of  the  anonymous
       FTP area.

       Default: ftp

       ftpd_banner
       This  string  option allows you to override the greeting banner
       displayed by vsftpd when a connection first comes in.

       Default: (none - default vsftpd banner is displayed)

       guest_username
       See the boolean setting guest_enable for a description of  what
       constitutes  a  guest  login. This setting is the real username
       which guest users are mapped to.

       Default: ftp

       hide_file
       This option can be used to set a pattern  for  filenames  (and
       directory  names etc.)  which  should be hidden from directory
       listings. Despite being hidden, the files  /  directories  etc.
       are fully accessible to clients who know what names to actually
       use. Items will be hidden if their  names  contain  the  string
       given  by  hide_file,  or  if they match the regular expression
       specified by hide_file. Note that vsftpd’s  regular  expression
       matching code  is a simple implementation which is a subset of
       full    regular   expression  functionality.      Example:
       hide_file={*.mp3,.hidden,hide*,h?}

       Default: (none)

       listen_address
       If vsftpd is in standalone mode, the default listen address (of
       all local interfaces) may be overridden by this  setting.  Pro-
       vide a numeric IP address.

       Default: (none)

       listen_address6
       Like listen_address, but specifies a default listen address for
       the IPv6 listener (which is used if listen_ipv6 is set). Format
       is standard IPv6 address format.

       Default: (none)

       local_root
       This  option  represents a  directory which vsftpd will try to
       change into after a local (i.e. non-anonymous)  login.  Failure
       is silently ignored.

       Default: (none)

       message_file
       This  option  is the  name  of the file we look for when a new
       directory is entered. The contents are displayed to the  remote
       user.  This  option  is  only  relevant  if  the option dirmes-
       sage_enable is enabled.

       Default: .message

       nopriv_user
       This is the name of the user that is used  by  vsftpd  when  it
       wants  to  be  totally unprivileged. Note that this should be a
       dedicated user, rather than nobody. The user nobody tends to be
       used for rather a lot of important things on most machines.

       Default: nobody

       pam_service_name
       This string is the name of the PAM service vsftpd will use.

       Default: ftp

       pasv_address
       Use  this  option  to  override the IP address that vsftpd will
       advertise in response to the PASV command. Provide a numeric IP
       address.

       Default: (none  -  the address is taken from the incoming con-
       nected socket)

       rsa_cert_file
       This option specifies the location of the  RSA  certificate  to
       use for SSL encrypted connections.

       Default: /usr/share/ssl/certs/vsftpd.pem

       secure_chroot_dir
       This  option  should be the name of a directory which is empty.
       Also, the directory should not be writable  by  the  ftp user.
       This  directory  is  used  as  a secure chroot() jail at times
       vsftpd does not require filesystem access.

       Default: /usr/share/empty

       ssl_ciphers
       This option can be used to select which SSL ciphers vsftpd will
       allow  for  encrpyted SSL connections. See the ciphers man page
       for further details. Note that restricting  ciphers  can be  a
       useful security precaution as it prevents malicious remote par-
       ties forcing a cipher which they have found problems with.

       Default: DES-CBC3-SHA

       user_config_dir
       This powerful option allows the override of any  config  option
       specified  in  the  manual  page, on a per-user basis. Usage is
       simple, and is best illustrated with an  example.  If  you  set
       user_config_dir  to be /etc/vsftpd_user_conf and then log on as
       the user "chris", then vsftpd will apply the  settings  in  the
       file  /etc/vsftpd_user_conf/chris  for the duration of the ses-
       sion. The format of this file is as  detailed  in  this  manual
       page! PLEASE NOTE that not all settings are effective on a per-
       user basis. For example, many settings only prior to the user’s
       session  being  started. Examples  of  settings which will not
       affect any behviour on a per-user basis include listen_address,
       banner_file, max_per_ip, max_clients, xferlog_file, etc.

       Default: (none)

       user_sub_token
       This  option is useful is conjunction with virtual users. It is
       used to automatically generate a home directory for  each  vir-
       tual user, based on a template. For example, if the home direc-
       tory  of the  real  user  specified  via   guest_username   is
       /home/virtual/$USER,  and  user_sub_token is set to $USER, then
       when virtual user  fred  logs  in,  he  will  end  up  (usually
       chroot()’ed)  in the directory /home/virtual/fred.  This option
       also takes affect if local_root contains user_sub_token.

       Default: (none)

       userlist_file
       This  option  is the  name  of  the  file  loaded   when   the
       userlist_enable option is active.

       Default: /etc/vsftpd.user_list

       vsftpd_log_file
       This  option  is the  name  of  the file to which we write the
       vsftpd style log file. This log is only written if  the  option
       xferlog_enable  is  set, and  xferlog_std_format  is  NOT set.
       Alternatively, it  is  written  if  you  have  set  the  option
       dual_log_enable.  One  further  complication - if you have set
       syslog_enable, then this file is not written and output is sent
       to the system log instead.

       Default: /var/log/vsftpd.log

       xferlog_file
       This  option  is the name of the file to which we write the wu-
       ftpd style transfer log. The transfer log is  only  written  if
       the  option  xferlog_enable is set, along with xferlog_std_for-
       mat.  Alternatively, it is written if you have set  the  option
       dual_log_enable.

       Default: /var/log/xferlog

AUTHOR
        chris@scary.beasts.org

 

              VSFTPD.CONF(5)

 

===========================================

vsFTPd常用功能之读写权限

2011-02-22 09:08 佚名 网络转载  字号： T |  T

vsftpd是一款在Linux发行版中最受推崇的FTP服务器程序。特点是小巧轻快，安全易用。vsftpd 的名字代表"very secure FTP daemon",并且vsFTPd服务器有许多非常好用的功能，本文为大家介绍的是如何打开读写功能！

vsftpd我用了比较长的一段时间，感觉非常稳定，安全性高，就推荐给大家，本文给大家讲下他的又一个功能读写权限。

FTP用户一般是不能登录系统的，这也是为了安全。在系统中，没有权限登录系统的用户一般也被称之为虚拟用户;虚拟用户也是要写进 /etc/passwd中;这只是一种虚拟用户的方法，但说实在的并不是真正的虚拟用户，只是把他登录SHELL的权限去掉了，所以他没有能力登录系统;

如果我们想把beinan这个用户目录定位在/opt/beinan这个目录中，并且不能登录系统;我们应该如下操作

[root@localhost ~]# adduser -d /opt/beinan -g ftp -s /sbin/nologin beinan

[root@localhost ~]# passwd beinan

Changing password for user beinan.

New password:

Retype new password:

passwd: all authentication tokens updated successfully.

[root@localhost ~]#

其实这还是不够的，还要改一下配置文件vsftpd.conf ，以确保本地虚拟用户能有读写权限;

local_enable=YES

write_enable=YES

local_umask=022