{"id":3997,"date":"2021-11-25T22:58:31","date_gmt":"2021-11-26T06:58:31","guid":{"rendered":"https:\/\/www.xh86.me\/?p=3997"},"modified":"2021-11-25T23:07:21","modified_gmt":"2021-11-26T07:07:21","slug":"centos-7-x-8-x%e5%ae%89%e8%a3%85%e9%85%8d%e7%bd%aevsftp%e6%9c%8d%e5%8a%a1%e5%99%a8","status":"publish","type":"post","link":"https:\/\/www.xh86.me\/?p=3997","title":{"rendered":"CentOS 7.x 8.x\u5b89\u88c5\u914d\u7f6eVsftp\u670d\u52a1\u5668"},"content":{"rendered":"
\n

<\/div><\/p>\n
<\/section>\n

\u4e00\u3001\u914d\u7f6e\u9632\u706b\u5899\uff0c\u5f00\u542fFTP\u670d\u52a1\u5668\u9700\u8981\u7684\u7aef\u53e3<\/strong><\/span><\/p>\n

CentOS 7.x\u00a0<\/span>8.x \u9ed8\u8ba4\u4f7f\u7528\u7684\u662ffirewall\u4f5c\u4e3a\u9632\u706b\u5899\uff0c\u8fd9\u91cc\u6539\u4e3aiptables\u9632\u706b\u5899\u3002<\/span><\/p>\n

1\u3001\u5173\u95edfirewall\uff1a<\/span><\/p>\n

systemctl stop firewalld.service\u00a0#\u505c\u6b62firewall<\/span><\/p>\n

systemctl disable firewalld.service\u00a0#\u7981\u6b62firewall\u5f00\u673a\u542f\u52a8<\/span><\/p>\n

2\u3001\u5b89\u88c5iptables\u9632\u706b\u5899<\/span><\/p>\n

yum install iptables-services\u00a0#\u5b89\u88c5<\/span><\/p>\n

vi \/etc\/sysconfig\/iptables\u00a0#\u7f16\u8f91\u9632\u706b\u5899\u914d\u7f6e\u6587\u4ef6<\/span><\/p>\n

# Firewall configuration written by system-config-firewall<\/p>\n

# Manual customization of this file is not recommended.<\/p>\n

*filter<\/p>\n

:INPUT ACCEPT [0:0]<\/p>\n

:FORWARD ACCEPT [0:0]<\/p>\n

:OUTPUT ACCEPT [0:0]<\/p>\n

-A INPUT -m state –state ESTABLISHED,RELATED -j ACCEPT<\/p>\n

-A INPUT -p icmp -j ACCEPT<\/p>\n

-A INPUT -i lo -j ACCEPT<\/p>\n

-A INPUT -m state –state NEW -m tcp -p tcp –dport 22 -j ACCEPT<\/p>\n

-A INPUT -m state –state NEW -m tcp -p tcp –dport 21 -j ACCEPT<\/span><\/p>\n

-A INPUT -m state –state NEW -m tcp -p tcp –dport 10060:10090 -j ACCEPT<\/span><\/p>\n

-A INPUT -j REJECT –reject-with icmp-host-prohibited<\/p>\n

-A FORWARD -j REJECT –reject-with icmp-host-prohibited<\/p>\n

COMMIT<\/p>\n

:wq!\u00a0#\u4fdd\u5b58\u9000\u51fa<\/span><\/p>\n

systemctl restart iptables.service\u00a0#\u6700\u540e\u91cd\u542f\u9632\u706b\u5899\u4f7f\u914d\u7f6e\u751f\u6548<\/span><\/p>\n

systemctl enable iptables.service\u00a0#\u8bbe\u7f6e\u9632\u706b\u5899\u5f00\u673a\u542f\u52a8<\/span><\/p>\n

\u8bf4\u660e\uff1a21\u7aef\u53e3\u662fftp\u670d\u52a1\u7aef\u53e3\uff1b10060\u523010090\u662fVsftpd\u88ab\u52a8\u6a21\u5f0f\u9700\u8981\u7684\u7aef\u53e3\uff0c\u53ef\u81ea\u5b9a\u4e49\u4e00\u6bb5\u5927\u4e8e1024\u7684tcp\u7aef\u53e3\u3002<\/span><\/p>\n

\n

\u4e8c\u3001\u5173\u95edSELINUX<\/span><\/strong><\/p>\n

vi \/etc\/selinux\/config<\/p>\n

#SELINUX=enforcing\u00a0#\u6ce8\u91ca\u6389<\/span><\/p>\n

#SELINUXTYPE=targeted\u00a0#\u6ce8\u91ca\u6389<\/span><\/p>\n

SELINUX=disabled\u00a0#\u589e\u52a0<\/span><\/p>\n

:wq!\u00a0#\u4fdd\u5b58\u9000\u51fa<\/span><\/p>\n

setenforce 0\u00a0#\u4f7f\u914d\u7f6e\u7acb\u5373\u751f\u6548<\/span><\/p>\n

\u4e09\u3001\u5b89\u88c5vsftpd<\/strong><\/span><\/p>\n

yum install -y vsftpd\u00a0#\u5b89\u88c5vsftpd<\/span><\/p>\n

yum install -y psmisc net-tools systemd-devel libdb-devel perl-DBI \u00a0#\u5b89\u88c5vsftpd\u865a\u62df\u7528\u6237\u914d\u7f6e\u4f9d\u8d56\u5305<\/span><\/p>\n

systemctl start vsftpd.service\u00a0#\u542f\u52a8<\/span><\/p>\n

systemctl enable vsftpd.service\u00a0#\u8bbe\u7f6evsftpd\u5f00\u673a\u542f\u52a8<\/span><\/p>\n

\u67d0\u4e9b\u60c5\u51b5\u4e0b\u542f\u52a8\u4f1a\u62a5\u9519\uff1a<\/span><\/span><\/p>\n

Job for vsftpd.service failed because the control process exited with error code. See “systemctl status vsftpd.service” and “journalctl -xe” for details.<\/p>\n

\u9700\u8981\u6ce8\u91ca\u6389\u914d\u7f6e\u6587\u4ef6\/etc\/vsftpd\/vsftpd.conf\u4e2d\u7684<\/span><\/p>\n

#listen=NO<\/span><\/p>\n

#listen_ipv6=YES<\/span><\/p>\n

\u56db\u3001\u914d\u7f6evsftp\u670d\u52a1\u5668<\/strong><\/span><\/p>\n

cp \/etc\/vsftpd\/vsftpd.conf \/etc\/vsftpd\/vsftpd.conf-bak\u00a0#\u5907\u4efd\u9ed8\u8ba4\u914d\u7f6e\u6587\u4ef6<\/span><\/p>\n

\u6267\u884c\u4ee5\u4e0b\u547d\u4ee4\u8fdb\u884c\u8bbe\u7f6e<\/span><\/p>\n

sed -i “s\/anonymous_enable=YES\/anonymous_enable=NO\/g” ‘\/etc\/vsftpd\/vsftpd.conf’<\/p>\n

sed -i “s\/#anon_upload_enable=YES\/anon_upload_enable=NO\/g” ‘\/etc\/vsftpd\/vsftpd.conf’<\/p>\n

sed -i “s\/#anon_mkdir_write_enable=YES\/anon_mkdir_write_enable=YES\/g” ‘\/etc\/vsftpd\/vsftpd.conf’<\/p>\n

sed -i “s\/#chown_uploads=YES\/chown_uploads=NO\/g” ‘\/etc\/vsftpd\/vsftpd.conf’<\/p>\n

sed -i “s\/#async_abor_enable=YES\/async_abor_enable=YES\/g” ‘\/etc\/vsftpd\/vsftpd.conf’<\/p>\n

sed -i “s\/#ascii_upload_enable=YES\/ascii_upload_enable=YES\/g” ‘\/etc\/vsftpd\/vsftpd.conf’<\/p>\n

sed -i “s\/#ascii_download_enable=YES\/ascii_download_enable=YES\/g” ‘\/etc\/vsftpd\/vsftpd.conf’<\/p>\n

sed -i “s\/#ftpd_banner=Welcome to blah FTP service.\/ftpd_banner=Welcome to FTP service.\/g” ‘\/etc\/vsftpd\/vsftpd.conf’<\/p>\n

echo -e “use_localtime=YESnlisten_port=21nchroot_local_user=YESnidle_session_timeout=300<\/p>\n

ndata_connection_timeout=1nguest_enable=YESnguest_username=vsftpd<\/span><\/p>\n

nuser_config_dir=\/etc\/vsftpd\/vconfnvirtual_use_local_privs=YES<\/span><\/p>\n

npasv_min_port=10060npasv_max_port=10090<\/span><\/p>\n

naccept_timeout=5nconnect_timeout=1npasv_promiscuous=YES<\/span>” >> \/etc\/vsftpd\/vsftpd.conf<\/span><\/p>\n

\u4e94\u3001\u5efa\u7acb\u865a\u62df\u7528\u6237\u540d\u5355\u6587\u4ef6<\/strong><\/span><\/p>\n

touch \/etc\/vsftpd\/virtusers<\/p>\n

\u7f16\u8f91\u865a\u62df\u7528\u6237\u540d\u5355\u6587\u4ef6\uff1a\uff08\u7b2c\u4e00\u884c\u8d26\u53f7\uff0c\u7b2c\u4e8c\u884c\u5bc6\u7801\uff0c\u6ce8\u610f\uff1a\u4e0d\u80fd\u4f7f\u7528root\u505a\u7528\u6237\u540d\uff0c\u7cfb\u7edf\u4fdd\u7559\uff09<\/span><\/p>\n

vi \/etc\/vsftpd\/virtusers<\/p>\n

web1<\/p>\n

123456<\/p>\n

web2<\/p>\n

123456<\/p>\n

web3<\/p>\n

123456<\/p>\n

:wq!\u00a0#\u4fdd\u5b58\u9000\u51fa<\/span><\/p>\n

\n

\u516d\u3001\u751f\u6210\u865a\u62df\u7528\u6237\u6570\u636e\u6587\u4ef6<\/strong><\/span><\/p>\n

db_load -T -t hash -f \/etc\/vsftpd\/virtusers \/etc\/vsftpd\/virtusers.db<\/p>\n

chmod 600 \/etc\/vsftpd\/virtusers.db\u00a0#\u8bbe\u5b9aPAM\u9a8c\u8bc1\u6587\u4ef6\uff0c\u5e76\u6307\u5b9a\u5bf9\u865a\u62df\u7528\u6237\u6570\u636e\u5e93\u6587\u4ef6\u8fdb\u884c\u8bfb\u53d6<\/span><\/p>\n

\u4e03\u3001\u5728\/etc\/pam.d\/vsftpd\u7684\u6587\u4ef6\u5934\u90e8\u52a0\u5165\u4ee5\u4e0b\u4fe1\u606f\uff08\u5728\u540e\u9762\u52a0\u5165\u65e0\u6548\uff09<\/strong><\/span><\/p>\n

\u4fee\u6539\u524d\u5148\u5907\u4efd cp \/etc\/pam.d\/vsftpd \/etc\/pam.d\/vsftpdbak<\/p>\n

vi \/etc\/pam.d\/vsftpd<\/p>\n

auth sufficient \/lib64\/security\/pam_userdb.so db=\/etc\/vsftpd\/virtusers<\/p>\n

account sufficient \/lib64\/security\/pam_userdb.so db=\/etc\/vsftpd\/virtusers<\/p>\n

\u6ce8\u610f\uff1a\u5982\u679c\u7cfb\u7edf\u4e3a32\u4f4d\uff0c\u4e0a\u9762\u6539\u4e3alib\uff0c\u5426\u5219\u914d\u7f6e\u5931\u8d25<\/span><\/p>\n

\u516b\u3001\u65b0\u5efa\u7cfb\u7edf\u7528\u6237vsftpd\uff0c\u7528\u6237\u76ee\u5f55\u4e3a\/home\/wwwroot, \u7528\u6237\u767b\u5f55\u7ec8\u7aef\u8bbe\u4e3a\/bin\/false(\u5373\u4f7f\u4e4b\u4e0d\u80fd\u767b\u5f55\u7cfb\u7edf)<\/span><\/strong><\/p>\n

useradd vsftpd -d \/home\/wwwroot -s \/bin\/false<\/p>\n

chown vsftpd:vsftpd \/home\/wwwroot -R<\/p>\n

chown www:www \/home\/wwwroot -R\u00a0#\u5982\u679c\u865a\u62df\u7528\u6237\u7684\u5bbf\u4e3b\u7528\u6237\u4e3awww\uff0c\u9700\u8981\u8fd9\u6837\u8bbe\u7f6e\u3002<\/span><\/p>\n

\u4e5d\u3001\u5efa\u7acb\u865a\u62df\u7528\u6237\u4e2a\u4ebaVsftp\u7684\u914d\u7f6e\u6587\u4ef6<\/strong><\/span><\/p>\n

mkdir \/etc\/vsftpd\/vconf<\/p>\n

cd \/etc\/vsftpd\/vconf<\/p>\n

touch web1 web2 web3\u00a0#\u8fd9\u91cc\u521b\u5efa\u4e09\u4e2a\u865a\u62df\u7528\u6237\u914d\u7f6e\u6587\u4ef6<\/span><\/p>\n

mkdir -p\u00a0\/home\/wwwroot\/web1\/http\/<\/p>\n

vi web1\u00a0#\u7f16\u8f91\u7528\u6237web1\u914d\u7f6e\u6587\u4ef6\uff0c\u5176\u4ed6\u7684\u8ddf\u8fd9\u4e2a\u914d\u7f6e\u6587\u4ef6\u7c7b\u4f3c<\/span><\/p>\n

local_root=\/home\/wwwroot\/web1\/http\/<\/span><\/p>\n

write_enable=YES<\/p>\n

anon_world_readable_only=NO<\/p>\n

anon_upload_enable=YES<\/p>\n

anon_mkdir_write_enable=YES<\/p>\n

anon_other_write_enable=YES<\/p>\n

allow_writeable_chroot=YES<\/p>\n

\u5341\u3001\u6700\u540e\u91cd\u542fvsftpd\u670d\u52a1\u5668<\/span><\/strong><\/p>\n

systemctl restart vsftpd.service<\/p>\n

\u5907\u6ce8\uff1a<\/p>\n

guest_username=vsftpd\u00a0#\u6307\u5b9a\u865a\u62df\u7528\u6237\u7684\u5bbf\u4e3b\u7528\u6237\uff08\u5c31\u662f\u6211\u4eec\u524d\u9762\u65b0\u5efa\u7684\u7528\u6237\uff09<\/span><\/p>\n

guest_username=www\u00a0#\u5982\u679cftp\u76ee\u5f55\u662f\u6307\u5411\u7f51\u7ad9\u6839\u76ee\u5f55\uff0c\u7528\u6765\u4e0a\u4f20\u7f51\u7ad9\u7a0b\u5e8f\uff0c\u53ef\u4ee5\u6307\u5b9a\u865a\u62df\u7528\u6237\u7684\u5bbf\u4e3b\u7528\u6237\u4e3anginx\u8fd0\u884c\u8d26\u6237www\uff0c\u53ef\u4ee5\u907f\u514d\u5f88\u591a\u6743\u9650\u8bbe\u7f6e\u95ee\u9898<\/span><\/p>\n

pasv_promiscuous=YES\u00a0\u00a0#\u9ed8\u8ba4\u503c\u4e3aNo\uff0c\u8868\u793a\u542f\u7528PASV\u6a21\u5f0f\u7684\u5b89\u5168\u68c0\u67e5\u3002\u786e\u4fdd\u6570\u636e\u8fde\u63a5\u548c\u63a7\u5236\u8fde\u63a5\u662f\u6765\u81ea\u540c\u4e00\u4e2aIP\u5730\u5740\u3002\u5c0f\u5fc3\u6253\u5f00\u6b64\u9009\u9879\u3002\u6b64\u9009\u9879\u552f\u4e00\u5408\u7406\u7684\u7528\u6cd5\u662f\u5b58\u5728\u4e8e\u7531\u5b89\u5168\u96a7\u9053\u65b9\u6848\u6784\u6210\u7684\u7ec4\u7ec7\u4e2d\uff08\u6bd4\u5982\u963f\u91cc\u4e91\u4e13\u6709\u7f51\u7edcECS\u670d\u52a1\u5668\uff0c\u670d\u52a1\u5668\u672c\u8eab\u53ea\u6709\u4e00\u4e2a\u5185\u7f51IP\uff0c\u901a\u8fc7\u516c\u7f51IP\u6620\u5c04\u6765\u8bbf\u95ee\uff09<\/span><\/span><\/p>\n

\u81f3\u6b64\uff0cCentOS 7.x 8.x \u5b89\u88c5\u914d\u7f6eVsftp\u670d\u52a1\u5668\u914d\u7f6e\u5b8c\u6210\u3002<\/strong><\/span><\/p>\n

 <\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

\u4e00\u3001\u914d\u7f6e\u9632\u706b\u5899\uff0c\u5f00\u542fFTP\u670d\u52a1\u5668\u9700\u8981\u7684\u7aef\u53e3 CentOS 7.x\u00a08.x \u9ed8\u8ba4\u4f7f\u7528\u7684\u662ffirewall\u4f5c\u4e3a\u9632\u706b […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[12],"tags":[],"class_list":["post-3997","post","type-post","status-publish","format-standard","hentry","category-linux"],"_links":{"self":[{"href":"https:\/\/www.xh86.me\/index.php?rest_route=\/wp\/v2\/posts\/3997","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.xh86.me\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.xh86.me\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.xh86.me\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.xh86.me\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=3997"}],"version-history":[{"count":1,"href":"https:\/\/www.xh86.me\/index.php?rest_route=\/wp\/v2\/posts\/3997\/revisions"}],"predecessor-version":[{"id":4092,"href":"https:\/\/www.xh86.me\/index.php?rest_route=\/wp\/v2\/posts\/3997\/revisions\/4092"}],"wp:attachment":[{"href":"https:\/\/www.xh86.me\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3997"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.xh86.me\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3997"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.xh86.me\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3997"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}