FTP服务知识

FTP理论知识

FTP的全称是File Transfer Protocol(文件传输协议),就是专门用来传输文件的协议.它工作在OSI模型的第七层,即是应用层,使用TCP传输而不是UDP.这样FTP客户端和服务器建立连接前就要经过一个"三次握手"的过程。FTP服务还有一个非常重要的特点是它可以独立于平台。
FTP服务一般运行在20和21两个端口：
端口20用于在客户端和服务端之间传输数据流。
端口21用于传输控制流，用于接收客户端发出的相关FTP命令与参数。
FTP服务器是按照FTP协议在互联网上提供文件存储和访问服务的主机，FTP客户端则是向服务器发送连接请求，以建立数据传输链路的主机。FTP协议有以下两种工作模式：
主动联机模式
被动联机模式
vsftpd作为更加安全的文件传输服务程序，允许用户以三种认证模式登陆到FTP服务器上：
匿名开放模式：最不安全的认证模式，任何人都可以无需密码验证直接登录到FTP服务器上。
本地用户模式：通过Linux系统本地的账户密码信息进行认证的模式。
虚拟用户模式：为FTP服务单独建立用户数据库文件，虚拟出用来进行口令验证的账户信息，而这些账户信息在服务器系统上实际是不存在的，仅供FTP服务程序进行验证时使用。

配置基本环境

使用centos7源，使用本地CD设备配置yum源：

挂载CD设备：
创建一个需要挂载的地方源文件，将CD挂载到该文件上，以保证后面正常使用yum源

[root@ftp ~]# mkdir /opt/centos7
[root@ftp ~]# mount /dev/cdrom /opt/centos7/

配置本地yum源，将/etc/yum.repos.d/下的文件移动到opt下，并创建local.repo文件：

[root@ftp ~]# mv /etc/yum.repos.d/* /opt
[root@ftp ~]# vi /etc/yum.repos.d/local.repo
[root@ftp ~]# cat /etc/yum.repos.d/local.repo 
[centos7]
name=centos7
baseurl=file:///opt/centos
gpgcheck=0
enabled=1

安装配置FTP服务

使用yum命令安装FTP服务：

[root@ftp ~]# yum install -y vsftpd

在配置文件里写入代码：
anon_root=/opt

[root@ftp ~]# cat /etc/vsftpd/vsftpd.conf 
anon_root=/opt
# Example config file /etc/vsftpd/vsftpd.conf
······

启动vsftp服务：

[root@ftp ~]# systemctl start vsftpd
[root@ftp ~]# netstat -tnpl
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      1456/sshd           
tcp        0      0 127.0.0.1:25            0.0.0.0:*               LISTEN      2491/master         
tcp6       0      0 :::21                   :::*                    LISTEN      1459/vsftpd         
tcp6       0      0 :::22                   :::*                    LISTEN      1456/sshd           
tcp6       0      0 ::1:25                  :::*                    LISTEN      2491/master         

FTP服务的使用

在浏览器中访问ftp服务器，在地址栏输入ftp服务器的地址：

FTP相关配置文件说明

1. 主配置文件/etc/ vsftpd/vsftpd.conf：

# Example config file /etc/vsftpd/vsftpd.conf

#
# The default compiled in settings are fairly paranoid. This sample file
# loosens things up a bit, to make the ftp daemon more usable.
# Please see vsftpd.conf.5 for all compiled in defaults.
#
# READ THIS: This example file is NOT an exhaustive list of vsftpd options.
# Please read the vsftpd.conf.5 manual page to get a full idea of vsftpd's
# capabilities.
#
# Allow anonymous FTP? (Beware - allowed by default if you comment this out).
anonymous_enable=YES		//是否允许anonymous登录FTP服务器,默认是允许的.
#
# Uncomment this to allow local users to log in.
# When SELinux is enforcing check for SE bool ftp_home_dir
local_enable=YES		//是否允许本地用户登录FTP服务器,默认是允许.
#
# Uncomment this to enable any form of FTP write command.
write_enable=YES		//是否允许用户具有在FTP服务器文件中执行写的权限,默认是允许.
#
# Default umask for local users is 077. You may wish to change this to 022,
# if your users expect that (022 is used by most other ftpd's)
local_umask=022		///设置本地用户的文件生成掩码为022,默认是077.
#
# Uncomment this to allow the anonymous FTP user to upload files. This only
# has an effect if the above global write enable is activated. Also, you will
# obviously need to create a directory writable by the FTP user.
# When SELinux is enforcing check for SE bool allow_ftpd_anon_write, allow_ftpd_full_access
#anon_upload_enable=YES		//是否允许匿名用户上传文件
#
# Uncomment this if you want the anonymous FTP user to be able to create
# new directories.
#anon_mkdir_write_enable=YES		//是否允许匿名账户在FTP服务器中创建目录.
#
# Activate directory messages - messages given to remote users when they
# go into a certain directory.
dirmessage_enable=YES		//激活目录信息,当远程用户更改目录时,将出现提示信息.
#
# Activate logging of uploads/downloads.
xferlog_enable=YES		//启用上传和下载日志功能.
#
# Make sure PORT transfer connections originate from port 20 (ftp-data).
connect_from_port_20=YES		//启用FTP数据端口的连接请求.
#
# If you want, you can arrange for uploaded anonymous files to be owned by
# a different user. Note! Using "root" for uploaded files is not
# recommended!
#chown_uploads=YES
#chown_username=whoever
#
# You may override where the log file goes if you like. The default is shown
# below.
#xferlog_file=/var/log/xferlog		//设置日志文件的文件名和存储路径,这是默认的.
#
# If you want, you can have your log file in standard ftpd xferlog format.
# Note that the default log file location is /var/log/xferlog in this case.
xferlog_std_format=YES		//是否使用标准的ftpd xferlog日志文件格式.
#
# You may change the default value for timing out an idle session.
#idle_session_timeout=600		//设置空闲的用户会话中断时间,默认是10分钟.
#
# You may change the default value for timing out a data connection.
#data_connection_timeout=120		//设置数据连接超时时间,默认是120秒.
#
# It is recommended that you define on your system a unique user which the
# ftp server can use as a totally isolated and unprivileged user.
#nopriv_user=ftpsecure
#
# Enable this and the server will recognise asynchronous ABOR requests. Not
# recommended for security (the code is non-trivial). Not enabling it,
# however, may confuse older FTP clients.
#async_abor_enable=YES
#
# By default the server will pretend to allow ASCII mode but in fact ignore
# the request. Turn on the below options to have the server actually do ASCII
# mangling on files when in ASCII mode. The vsftpd.conf(5) man page explains
# the behaviour when these options are disabled.
# Beware that on some FTP servers, ASCII support allows a denial of service
# attack (DoS) via the command "SIZE /big/file" in ASCII mode. vsftpd
# predicted this attack and has always been safe, reporting the size of the
# raw file.
# ASCII mangling is a horrible feature of the protocol.
#ascii_upload_enable=YES
#ascii_download_enable=YES		//是否允许使用ASCII格式来上传和下载文件.
#
# You may fully customise the login banner string:
#ftpd_banner=Welcome to blah FTP service.		//在FTP服务器中设置欢迎登录的信息.
#
# You may specify a file of disallowed anonymous e-mail addresses. Apparently
# useful for combatting certain DoS attacks.
#deny_email_enable=YES
# (default follows)
#banned_email_file=/etc/vsftpd/banned_emails
#
# You may specify an explicit list of local users to chroot() to their home
# directory. If chroot_local_user is YES, then this list becomes a list of
# users to NOT chroot().
# (Warning! chroot'ing can be very dangerous. If using chroot, make sure that
# the user does not have write access to the top level directory within the
# chroot)
#chroot_local_user=YES
#chroot_list_enable=YES		//如果希望用户登录后不能切换到自己目录以外的其它目录,需要设置该项,如果设置chroot_list_enable=YES,那么只允许/etc /vsftpd.chroot_list中列出的用户具有该功能.如果希望所有的本地用户都执行者chroot,可以增加一行：chroot_local_user=YES
# (default follows)
#chroot_list_file=/etc/vsftpd/chroot_list
#
# You may activate the "-R" option to the builtin ls. This is disabled by
# default to avoid remote users being able to cause excessive I/O on large
# sites. However, some broken FTP clients such as "ncftp" and "mirror" assume
# the presence of the "-R" option, so there is a strong case for enabling it.
#ls_recurse_enable=YES
#
# When "listen" directive is enabled, vsftpd runs in standalone mode and
# listens on IPv4 sockets. This directive cannot be used in conjunction
# with the listen_ipv6 directive.
listen=NO
#
# This directive enables listening on IPv6 sockets. By default, listening
# on the IPv6 "any" address (::) will accept connections from both IPv6
# and IPv4 clients. It is not necessary to listen on *both* IPv4 and IPv6
# sockets. If you want that (perhaps because you want to listen on specific
# addresses) then you must run two copies of vsftpd with two configuration
# files.
# Make sure, that one of the listen options is commented !!
listen_ipv6=YES

pam_service_name=vsftpd		//设置PAM认证服务的配置文件名称,该文件存放在/etc/pam.d/目录下.
userlist_enable=YES		//用户列表中的用户是否允许登录FTP服务器,默认是不允许
#enable for standalone mode
#listen=YES  //使vsftpd 处于独立启动模式
tcp_wrappers=YES			//使用tcp_wrqppers作为主机访问控制方式

2. /etc/vsftpd/ftpusers配置文件说明：
   该文件是用来记录不允许登录到FTP服务器的用户，通常是一些系统默认的用户。下面是该文件中默认的不允许登录的名单：

[root@ftp ~]# cat /etc/vsftpd/ftpusers 
# Users that are not allowed to login via ftp
Root		//默认情况下,root和它以下的用户是不允许登录FTP服务器的.可以将不允许登录的用户添加到这里来.但切记每个用户都要单独占用一行.
bin
daemon
adm
lp
sync
shutdown
halt
mail
news
uucp
operator
games
nobody

3. /etc/vsftpd/user_list配置文件：
   /etc/vsftpd/user_list配置文件的内容和 /etc/vsftpd/ftpusers配置文件内容相同，在系统对文件vsftpd.conf 进行检测时，会检测到"userlist_deny=YES"，因此这个文件必须存在。内容如下：

[root@ftp ~]# cat /etc/vsftpd/user_list 
# vsftpd userlist
# If userlist_deny=NO, only allow users in this file
# If userlist_deny=YES (default), never allow users in this file, and
# do not even prompt for a password.
# Note that the default vsftpd pam config also checks /etc/vsftpd/ftpusers
# for users that are denied.
root
bin
daemon
adm
lp
sync
shutdown
halt
mail
news
uucp
operator
games
nobody