Debian系统下搭建vsftpd示例

为什么80%的码农都做不了架构师？>>>   

系统环境

# uname -a
Linux vsftp.jessie.cn 3.16.0-4-amd64 #1 SMP Debian 3.16.7-ckt9-3~deb8u1 (2015-04-24) x86_64 GNU/Linux
# vsftpd -v
vsftpd: version 3.0.2

配置文件

Env init

apt-get -y install vsftpd db5.3-util
mkdir -pv /etc/vsftpd/roles /data/log/vsftpd /mnt/ftp/higkoo
touch /etc/vsftpd/{chroot-list,user-list,issue,accounts,create.sh} /etc/pam.d/vsftpd.ftp
openssl req -newkey rsa:2048 -x509 -nodes -days 3650 -out /etc/vsftpd/vsftp-cert.pem -keyout /etc/vsftpd/vsftp-cert.pem
chown -R ftp:ftp /mnt/ftp /data/log/vsftpd
openssl req -newkey rsa:2048 -x509 -nodes -days 3650 -out /etc/vsftpd/vsftp-cert.pem -keyout /etc/vsftpd/vsftp-cert.pem

/etc/vsftpd.conf

anon_mkdir_write_enable=NO
anon_root=/dev/zero
anon_upload_enable=NO
anon_world_readable_only=YES
anonymous_enable=NO
banner_file=/etc/vsftpd/issue
chroot_local_user=YES
chroot_list_enable=YES # 安全限制
chroot_list_file=/etc/vsftpd/chroot-list
allow_writeable_chroot=YES
userlist_deny=YES # 用户黑名单功能
userlist_file=/etc/vsftpd/user-list
data_connection_timeout=120
dirmessage_enable=NO
ftpd_banner=Welcome to ops ftp.
guest_enable=YES
guest_username=ftp
hide_file={\.*}
idle_session_timeout=600
listen_ipv6=NO
connect_from_port_20=NO
ftp_data_port=50234
listen_port=21
listen=YES
local_enable=YES
local_umask=022
log_ftp_protocol=YES
syslog_enable=NO
pam_service_name=vsftpd.ftp
passwd_chroot_enable=NO
pasv_enable=YES
pasv_min_port=62222
pasv_max_port=62333
tcp_wrappers=YES
use_localtime=NO
user_config_dir=/etc/vsftpd/roles
userlist_enable=YES
virtual_use_local_privs=YES
write_enable=YES
xferlog_enable=YES
xferlog_enable=YES
xferlog_std_format=YES
xferlog_file=/data/log/vsftpd/xfer.log
vsftpd_log_file=/data/log/vsftpd/vsftpd.log
ssl_enable=YES
force_local_data_ssl=YES
force_local_logins_ssl=YES
ssl_tlsv1=YES
ssl_sslv2=YES
ssl_sslv3=YES
rsa_cert_file=/etc/vsftpd/vsftp-cert.pem
max_per_ip=30
max_clients=200
ssl_ciphers=HIGH
require_ssl_reuse=NO
log_ftp_protocol=yes
dual_log_enable=YES
lock_upload_files=NO

/etc/vsftpd/roles/higkoo

local_root=/mnt/ftp/higkoo
anon_world_readable_only=NO
write_enable=YES
anon_upload_enable=NO

/etc/vsftpd/create.sh

/bin/mv -fv /etc/vsftpd/accounts.db /tmp
/usr/bin/db_load -T -t hash -f /etc/vsftpd/accounts /etc/vsftpd/accounts.db
/bin/chmod 0600 /etc/vsftpd/accounts.db /etc/vsftpd/accounts

/etc/pam.d/vsftpd.ftp

auth       sufficient     /lib/x86_64-linux-gnu/security/pam_userdb.so db=/etc/vsftpd/accounts
account    sufficient     /lib/x86_64-linux-gnu/security/pam_userdb.so db=/etc/vsftpd/accounts

/etc/vsftpd/accounts

higkoo
MyPassWords

IP限制

==> /etc/hosts.allow <==
vsftpd:123.223.233.8:allow
vsftpd:192.186.233.:allow

==> /etc/hosts.deny <==
vsftpd:all:deny

登录日志

==> /data/log/vsftpd/vsftpd.log <==
CONNECT: Client "180.157.70.197"
FTP response: Client "123.223.233.8", "220 - biliops"
FTP response: Client "123.223.233.8", "220 "
FTP command: Client "123.223.233.8", "AUTH TLS"
FTP response: Client "123.223.233.8", "234 Proceed with negotiation."
FTP command: Client "123.223.233.8", "USER higkoo"
[ops] FTP response: Client "123.223.233.8", "331 Please specify the password."
[ops] FTP command: Client "123.223.233.8", "PASS <password>"
[ops] OK LOGIN: Client "123.223.233.8"
[ops] FTP response: Client "123.223.233.8", "230 Login successful."
[ops] FTP command: Client "123.223.233.8", "SYST"
[ops] FTP response: Client "123.223.233.8", "215 UNIX Type: L8"
[ops] FTP command: Client "123.223.233.8", "FEAT"
[ops] FTP response: Client "123.223.233.8", "211-Features:"
[ops] FTP response: Client "123.223.233.8", " AUTH SSL"
[ops] FTP response: Client "123.223.233.8", " AUTH TLS"
[ops] FTP response: Client "123.223.233.8", " EPRT"
[ops] FTP response: Client "123.223.233.8", " EPSV"
[ops] FTP response: Client "123.223.233.8", " MDTM"
[ops] FTP response: Client "123.223.233.8", " PASV"
[ops] FTP response: Client "123.223.233.8", " PBSZ"
[ops] FTP response: Client "123.223.233.8", " PROT"
[ops] FTP response: Client "123.223.233.8", " REST STREAM"
[ops] FTP response: Client "123.223.233.8", " SIZE"
[ops] FTP response: Client "123.223.233.8", " TVFS"
[ops] FTP response: Client "123.223.233.8", "211 End"
[ops] FTP command: Client "123.223.233.8", "PBSZ 0"
[ops] FTP response: Client "123.223.233.8", "200 PBSZ set to 0."
[ops] FTP command: Client "123.223.233.8", "PROT P"
[ops] FTP response: Client "123.223.233.8", "200 PROT now Private."
[ops] FTP command: Client "123.223.233.8", "PWD"
[ops] FTP response: Client "123.223.233.8", "257 "/""
[ops] FTP command: Client "123.223.233.8", "TYPE I"
[ops] FTP response: Client "123.223.233.8", "200 Switching to Binary mode."
[ops] FTP command: Client "123.223.233.8", "PASV"
[ops] FTP response: Client "123.223.233.8", "227 Entering Passive Mode (88,123,66,22,223,233)."
[ops] FTP command: Client "123.223.233.8", "LIST"
[ops] FTP response: Client "123.223.233.8", "150 Here comes the directory listing."
[ops] FTP response: Client "123.223.233.8", "226 Directory send OK."
[ops] FTP command: Client "123.223.233.8", "MDTM tengine_2.1.1-2_amd64.deb"
[ops] FTP response: Client "123.223.233.8", "213 20151229123456"

中文显示

文件名支持中文

1. 修改环境变量 /etc/profile.d/chinese.sh

LC_ALL="zh_CN.UTF-8"
LANG="zh_CN.UTF-8"
LANGUAGE="zh_CN.UTF-8:zh:en_US:en"
export LC_ALL LANG LANGUAGE

1. 安装依赖

sudo locale-gen en_US en_US.UTF-8
sudo dpkg-reconfigure locales
. /etc/profile
locale

ftp日志支持中文

1. 据说vsftpd的日志要支持中文，必须改源码或使用syslog。机智的我选择后者、修改 /etc/vsftpd.conf ：

syslog_enable=YES

1. 在syslog添加vsftpd的配置 /etc/rsyslog.d/vsftpd.conf：

ftp.* /data/log/vsftpd/sys.log

1. 如果不希望ftp日志在/var/log/messages显示，需要追加 ftp.none 到 /etc/rsyslog.conf：

*.=info;*.=notice;*.=warn;\
        auth,authpriv.none;\
        cron,daemon.none;\
        mail,news.none,ftp.none         -/var/log/messages

1. 重启服务，验证成功：
   

转载于:https://my.oschina.net/anglix/blog/591495