本篇隨筆將講解FTP服務(wù)的原理以及vsfptd這個最常用的FTP服務(wù)程序的安裝與配置...

一、FTP服務(wù)原理

FTP(File Transfer Protocol)是一個非常古老并且應(yīng)用十分廣泛的文件傳輸協(xié)議，FTP協(xié)議是現(xiàn)今使用最為廣泛的網(wǎng)絡(luò)文件共享協(xié)議之一，我們現(xiàn)在也一直有在用著FTP協(xié)議來進(jìn)行各種文件的傳輸，FTP為我們提供了一種可靠的方式在網(wǎng)絡(luò)上進(jìn)行文件的共享

FTP是C/S架構(gòu)的服務(wù)，擁有一個服務(wù)器端和一個客戶端，FTP底層通過TCP協(xié)議來作為傳輸協(xié)議，所以FTP協(xié)議是一種可靠的文件傳輸方式，FTP提供了兩個端口號，20和21號端口，20號是數(shù)據(jù)接口，提供數(shù)據(jù)之間的傳輸，21號是命令接口，提供命令之間的傳輸

FTP服務(wù)端與客戶端連接一般有兩種模式：主動模式(Active Mode)和被動模式(Passive Mode)

①主動模式的原理如下圖所示：

主動模式下，客戶端首先會向服務(wù)器端的21號端口發(fā)出一個連接命令，請求與服務(wù)器端建立連接，此時服務(wù)器端響應(yīng)回去給客戶端，并要求客戶端發(fā)送一個用于傳送數(shù)據(jù)的端口，該端口號要 > 1023 ，此時服務(wù)器端的20號端口就會與該數(shù)據(jù)端口主動建立連接，客戶端與服務(wù)器端進(jìn)行數(shù)據(jù)的傳送

②被動模式的原理如下圖所示：

?

與主動模式不同的是，在被動模式下，客戶端也是首先與服務(wù)器端的21端口建立連接，此時后服務(wù)器端會開啟一個 > 1023 號的數(shù)據(jù)傳送端口，并返回給客戶端，這個時候客戶端也會開啟一個 > 1023 的端口，然后客戶端會主動的去跟服務(wù)器端的數(shù)據(jù)傳輸端口建立連接，兩者之間來進(jìn)行數(shù)據(jù)的傳送

所以說，主動模式與被動模式的區(qū)別就在于究竟是服務(wù)器端的20端口主動發(fā)起于客戶端建立連接，還是服務(wù)器端開放一個隨機(jī)端口，等待客戶端與其主動建立連接。在我們的生產(chǎn)環(huán)境中，通常還是使用的是被動連接的模式，因為我們的服務(wù)器端都有配置防火墻，而防火墻對于內(nèi)網(wǎng)連接外網(wǎng)的端口一般是放行的，而外網(wǎng)來連接內(nèi)網(wǎng)的端口則一般是有限制的，所以我們這時如果使用主動模式連接的話，端口可能被防火墻攔截，從而不能提供我們的FTP服務(wù)

二、vsfptd的安裝

在Linux下，我們應(yīng)用最廣泛的FTP服務(wù)程序是 vsftpd (Very Secure FTP Daemon),從名字我們也可以看出，其提供了非常安全的FTP服務(wù)。vsftpd 是一個 UNIX 類操作系統(tǒng)上運行的服務(wù)器的名字，它可以運行在諸如 Linux, BSD, Solaris, HP-UX 以及 IRIX 上面。它支持很多其他的 FTP 服務(wù)器不支持的特征。例如：

①非常高的安全性需求　　②帶寬限制　　③創(chuàng)建虛擬用戶的可能性　　④高速　　...

可以說 vsftpd 給我們提供了一個快速的、穩(wěn)定的且相當(dāng)安全的FTP服務(wù)

在CentOS下默認(rèn)沒有安裝 vsftpd 這個FTP程序，我們通過 yum install vsfptd 來進(jìn)行安裝

?

[root@xiaoluo ~]# yum install -y vsftpd Loaded plugins: fastestmirror, refresh-packagekit, security Loading mirror speeds from cached hostfile * base: ftp.nsysu.edu.tw * extras: ftp.nsysu.edu.tw * updates: ftp.twaren.net Setting up Install Process Resolving Dependencies --> Running transaction check ---> Package vsftpd.x86_64 0:2.2.2-11.el6_4.1 will be installed --> Finished Dependency Resolution Dependencies Resolved ================================================================================ Package Arch Version Repository Size ================================================================================ Installing: vsftpd x86_64 2.2.2-11.el6_4.1 updates 151 k Transaction Summary ================================================================================ Install 1 Package(s) Total download size: 151 k Installed size: 331 k Downloading Packages: vsftpd-2.2.2-11.el6_4.1.x86_64.rpm | 151 kB 00:01 Running rpm_check_debug Running Transaction Test Transaction Test Succeeded Running Transaction Installing : vsftpd-2.2.2-11.el6_4.1.x86_64 1/1 Verifying : vsftpd-2.2.2-11.el6_4.1.x86_64 1/1 Installed: vsftpd.x86_64 0:2.2.2-11.el6_4.1 Complete!

?

這樣我們就安裝好了我們的 vsftpd 服務(wù)程序了，在安裝好后我們可以來看一下 vsftpd 這個程序的一些配置文件，其所有的配置文件都保存在了 /etc/vsftpd/ 這個目錄下

[root@xiaoluo ~]# cd /etc/vsftpd/ [root@xiaoluo vsftpd]# ls -l total 20 -rw-------. 1 root root 125 Mar 1 18:16 ftpusers -rw-------. 1 root root 361 Mar 1 18:16 user_list -rw-------. 1 root root 4599 Mar 1 18:16 vsftpd.conf -rwxr--r--. 1 root root 338 Mar 1 18:16 vsftpd_conf_migrate.sh

里面一共有四個配置文件，vsftpd.conf?是我們的主配置文件，ftpusers是我們的黑名單用戶配置文件，通常我們的系統(tǒng)用戶還有根用戶都是放在這個配置文件里面的，因為這些用戶的權(quán)限很大，如果使用ftp服務(wù)可能造成一些問題，user_list是我們的用戶列表文件，我們可以通過在主配置文件里設(shè)置該用戶是黑名單用戶還是白名單擁有，最后一個是我們的ftp服務(wù)遷移腳本

我們的 vsftpd 程序安裝好后，我們可以看到在 /var 目錄下有個 ftp 文件夾，這個文件夾就是我們的ftp共享文件夾

[root@xiaoluo vsftpd]# cd /var/ftp/ [root@xiaoluo ftp]# ls pub

三、FTP用戶以及如何進(jìn)行文件共享

vsftpd是通過使用用戶來作為管理單位的，想要訪問某個ftp的共享文件，必須要以某一特定的用戶身份登陸，我們可以配置一下幾種類型的用戶：

①正常用戶(系統(tǒng)用戶)

正常用戶就是我們操作系統(tǒng)的系統(tǒng)用戶，一般我們安裝的各種服務(wù)都能通過系統(tǒng)用戶登錄來使用其所提供的服務(wù)

首先我們啟動我們的 vsftpd 這個服務(wù)，這里我們先通過 CentOS提供的一個圖形界面工具來使用我們現(xiàn)在的系統(tǒng)用戶登陸我們的 ftp

?

[root@xiaoluo ftp]# service vsftpd start Starting vsftpd for vsftpd: [ OK ]

?

? ? ? ? ? ? ? ? ? ? ? ??　　　　

輸入我們的當(dāng)前系統(tǒng)用戶名及密碼就能登陸上去了，我們使用系統(tǒng)用戶登陸上去后，其默認(rèn)打開的文件夾是我們的用戶的家目錄，只要是該用戶有訪問權(quán)限的文件及文件夾，該用戶都能進(jìn)行訪問

?

②匿名用戶 (anonymous)

我們所有的FTP服務(wù)都支持的一種用戶登錄方式，我們可以不輸入任何信息就能登陸進(jìn)來

?

我們看到，我們在沒有輸入任何信息也能夠登陸上我們的ftp，這就是以匿名用戶登錄的方式。

在默認(rèn)情況下，在vsftpd安裝的時候會創(chuàng)建一個 ftp 系統(tǒng)用戶，這個用戶就是用來進(jìn)行匿名登陸的用戶，ftp匿名用戶默認(rèn)登陸到的目錄是 /var/ftp/ 目錄，沒有任何訪問限制權(quán)限的文件都能提供給匿名用戶進(jìn)行共享

[root@xiaoluo ftp]# cat /etc/passwd | grep ftp ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin

那么我們的FTP為什么可以以匿名用戶來進(jìn)行登陸呢？其主要就是因為 vsftpd.conf 這個配置文件所配置的

[root@xiaoluo ftp]# cat /etc/vsftpd/vsftpd.conf # Example config file /etc/vsftpd/vsftpd.conf # # The default compiled in settings are fairly paranoid. This sample file # loosens things up a bit, to make the ftp daemon more usable. # Please see vsftpd.conf.5 for all compiled in defaults. # # READ THIS: This example file is NOT an exhaustive list of vsftpd options. # Please read the vsftpd.conf.5 manual page to get a full idea of vsftpd's # capabilities. # # Allow anonymous FTP? (Beware - allowed by default if you comment this out). anonymous_enable=YES　　// 允許匿名用戶進(jìn)行登陸 # # Uncomment this to allow local users to log in. local_enable=YES # # Uncomment this to enable any form of FTP write command. write_enable=YES # # Default umask for local users is 077. You may wish to change this to 022, # if your users expect that (022 is used by most other ftpd's) local_umask=022 # # Uncomment this to allow the anonymous FTP user to upload files. This only # has an effect if the above global write enable is activated. Also, you will # obviously need to create a directory writable by the FTP user. #anon_upload_enable=YES # # Uncomment this if you want the anonymous FTP user to be able to create # new directories. #anon_mkdir_write_enable=YES # # Activate directory messages - messages given to remote users when they # go into a certain directory. dirmessage_enable=YES # # The target log file can be vsftpd_log_file or xferlog_file. # This depends on setting xferlog_std_format parameter xferlog_enable=YES # # Make sure PORT transfer connections originate from port 20 (ftp-data). connect_from_port_20=YES # # If you want, you can arrange for uploaded anonymous files to be owned by # a different user. Note! Using "root" for uploaded files is not # recommended! #chown_uploads=YES #chown_username=whoever # # The name of log file when xferlog_enable=YES and xferlog_std_format=YES # WARNING - changing this filename affects /etc/logrotate.d/vsftpd.log #xferlog_file=/var/log/xferlog # # Switches between logging into vsftpd_log_file and xferlog_file files. # NO writes to vsftpd_log_file, YES to xferlog_file xferlog_std_format=YES # # You may change the default value for timing out an idle session. #idle_session_timeout=600 # # You may change the default value for timing out a data connection. #data_connection_timeout=120 # # It is recommended that you define on your system a unique user which the # ftp server can use as a totally isolated and unprivileged user. #nopriv_user=ftpsecure # # Enable this and the server will recognise asynchronous ABOR requests. Not # recommended for security (the code is non-trivial). Not enabling it, # however, may confuse older FTP clients. #async_abor_enable=YES # # By default the server will pretend to allow ASCII mode but in fact ignore # the request. Turn on the below options to have the server actually do ASCII # mangling on files when in ASCII mode. # Beware that on some FTP servers, ASCII support allows a denial of service # attack (DoS) via the command "SIZE /big/file" in ASCII mode. vsftpd # predicted this attack and has always been safe, reporting the size of the # raw file. # ASCII mangling is a horrible feature of the protocol. #ascii_upload_enable=YES #ascii_download_enable=YES # # You may fully customise the login banner string: #ftpd_banner=Welcome to blah FTP service. # # You may specify a file of disallowed anonymous e-mail addresses. Apparently # useful for combatting certain DoS attacks. #deny_email_enable=YES # (default follows) #banned_email_file=/etc/vsftpd/banned_emails # # You may specify an explicit list of local users to chroot() to their home # directory. If chroot_local_user is YES, then this list becomes a list of # users to NOT chroot(). #chroot_local_user=YES #chroot_list_enable=YES # (default follows) #chroot_list_file=/etc/vsftpd/chroot_list # # You may activate the "-R" option to the builtin ls. This is disabled by # default to avoid remote users being able to cause excessive I/O on large # sites. However, some broken FTP clients such as "ncftp" and "mirror" assume # the presence of the "-R" option, so there is a strong case for enabling it. #ls_recurse_enable=YES # # When "listen" directive is enabled, vsftpd runs in standalone mode and # listens on IPv4 sockets. This directive cannot be used in conjunction # with the listen_ipv6 directive. listen=YES # # This directive enables listening on IPv6 sockets. To listen on IPv4 and IPv6 # sockets, you must run two copies of vsftpd with two configuration files. # Make sure, that one of the listen options is commented !! #listen_ipv6=YES pam_service_name=vsftpd userlist_enable=YES tcp_wrappers=YES

我們看到，配置文件里的?anonymous_enable=YES 就是允許我們的匿名用戶登錄，如果將其設(shè)置成NO，這樣匿名用戶就不能登陸上了

③虛擬用戶(ftp-only)

這些用戶就是專門創(chuàng)建只為使用ftp的用戶，一般用的較少

?

我們登陸FTP，不僅可以使用CentOS提供的GUI界面，還可以使用我們的命令行下的工具進(jìn)行登陸，這里我們使用的是 lftp，同樣我們也需要先對其進(jìn)行安裝

[root@xiaoluo ~]# yum install -y lftp Loaded plugins: fastestmirror, refresh-packagekit, security Loading mirror speeds from cached hostfile * base: ftp.nsysu.edu.tw * extras: ftp.nsysu.edu.tw * updates: ftp.twaren.net Setting up Install Process Resolving Dependencies --> Running transaction check ---> Package lftp.x86_64 0:4.0.9-1.el6 will be installed --> Finished Dependency Resolution Dependencies Resolved ================================================================================ Package Arch Version Repository Size ================================================================================ Installing: lftp x86_64 4.0.9-1.el6 base 753 k Transaction Summary ================================================================================ Install 1 Package(s) Total download size: 753 k Installed size: 2.5 M Downloading Packages: lftp-4.0.9-1.el6.x86_64.rpm | 753 kB 00:10 Running rpm_check_debug Running Transaction Test Transaction Test Succeeded Running Transaction Installing : lftp-4.0.9-1.el6.x86_64 1/1 Verifying : lftp-4.0.9-1.el6.x86_64 1/1 Installed: lftp.x86_64 0:4.0.9-1.el6 Complete!

這樣我們就可以使用 lftp 來登陸我們的ftp了

①直接使用 lftp 127.0.0.1 進(jìn)行登陸

[root@xiaoluo ~]# lftp 127.0.0.1 lftp 127.0.0.1:~> pwd ftp://127.0.0.1 lftp 127.0.0.1:~> ls drwxr-xr-x 2 0 0 4096 Mar 01 10:16 pub

這種登陸是以匿名用戶登錄上ftp，我們可以看到登陸進(jìn)去后的目錄是 /var/pub 這個共享目錄

②使用 lftp -u xiaoluo 127.0.0.1 進(jìn)行登陸

?

[root@xiaoluo ~]# lftp -u xiaoluo 127.0.0.1 Password: lftp xiaoluo@127.0.0.1:~> pwd ftp://xiaoluo@127.0.0.1 lftp xiaoluo@127.0.0.1:~> ls drwxr-xr-x 2 500 500 4096 May 26 05:22 Desktop drwxr-xr-x 3 500 500 4096 May 19 16:10 Documents drwxr-xr-x 2 500 500 4096 May 13 17:36 Downloads drwxr-xr-x 2 500 500 4096 May 13 17:36 Music drwxr-xr-x 2 500 500 4096 May 13 17:36 Pictures drwxr-xr-x 2 500 500 4096 May 13 17:36 Public drwxr-xr-x 2 500 500 4096 May 13 17:36 Templates drwxr-xr-x 2 500 500 4096 May 13 17:36 Videos

?

我們也可以通過 -u 指定我們以系統(tǒng)用戶的方式登陸ftp，系統(tǒng)用戶登錄上以后，默認(rèn)登陸的文件夾就是我們用戶的根目錄

四、用戶通過ftp進(jìn)行文件上傳、下載操作

①正常用戶的上傳、下載操作

我們通過lftp命令還可以進(jìn)行文件的上傳、下載操作，分別使用 put 和 get 命令

例如我現(xiàn)在在 xiaoluo 這個用戶的家目錄下創(chuàng)建一個 xiaoluo.txt 文件，然后我們通過 get 命令將其從ftp上下載下來

[xiaoluo@xiaoluo ~]$ touch xiaoluo.txt [xiaoluo@xiaoluo ~]$ ls Desktop Downloads Pictures Templates xiaoluo.txt Documents Music Public Videos [xiaoluo@xiaoluo ~]$ su - Password: [root@xiaoluo ~]# lftp -u xiaoluo 127.0.0.1 Password: lftp xiaoluo@127.0.0.1:~> ls drwxr-xr-x 2 500 500 4096 May 26 05:22 Desktop drwxr-xr-x 3 500 500 4096 May 19 16:10 Documents drwxr-xr-x 2 500 500 4096 May 13 17:36 Downloads drwxr-xr-x 2 500 500 4096 May 13 17:36 Music drwxr-xr-x 2 500 500 4096 May 13 17:36 Pictures drwxr-xr-x 2 500 500 4096 May 13 17:36 Public drwxr-xr-x 2 500 500 4096 May 13 17:36 Templates drwxr-xr-x 2 500 500 4096 May 13 17:36 Videos -rw-rw-r-- 1 500 500 0 Jun 08 16:20 xiaoluo.txt lftp xiaoluo@127.0.0.1:~> get xiaoluo.txt lftp xiaoluo@127.0.0.1:~> exit [root@xiaoluo ~]# ls anaconda-ks.cfg Desktop install.log install.log.syslog xiaoluo.txt

我們看到，剛才我們通過登陸xiaoluo這個用戶，然后在其家目錄下創(chuàng)建了一個 xiaoluo.txt 的文件，然后我們切換到了 root 目錄下，首先登陸我們的 lftp ，然后通過 get 命令將該文件下載下來，這時我們就可以發(fā)現(xiàn)root用戶的家目錄下就有了剛才下載下來的 xiaoluo.txt 文件的

【注意：】我當(dāng)前root用戶是在哪個目錄下通過 lftp 登陸的，在下載文件時就會下載到該目錄下

同時我們也可以使用 put 命令來上傳文件到ftp上

[root@xiaoluo ~]# touch root.txt [root@xiaoluo ~]# ls anaconda-ks.cfg install.log root.txt Desktop install.log.syslog xiaoluo.txt [root@xiaoluo ~]# lftp -u xiaoluo 127.0.0.1 Password: lftp xiaoluo@127.0.0.1:~> put root.txt lftp xiaoluo@127.0.0.1:~> ls drwxr-xr-x 2 500 500 4096 May 26 05:22 Desktop drwxr-xr-x 3 500 500 4096 May 19 16:10 Documents drwxr-xr-x 2 500 500 4096 May 13 17:36 Downloads drwxr-xr-x 2 500 500 4096 May 13 17:36 Music drwxr-xr-x 2 500 500 4096 May 13 17:36 Pictures drwxr-xr-x 2 500 500 4096 May 13 17:36 Public drwxr-xr-x 2 500 500 4096 May 13 17:36 Templates drwxr-xr-x 2 500 500 4096 May 13 17:36 Videos -rw-r--r-- 1 500 500 0 Jun 08 16:26 root.txt -rw-rw-r-- 1 500 500 0 Jun 08 16:20 xiaoluo.txt lftp xiaoluo@127.0.0.1:~> exit [root@xiaoluo ~]# cd /home/xiaoluo/ [root@xiaoluo xiaoluo]# ls Desktop Downloads Pictures root.txt Videos Documents Music Public Templates xiaoluo.txt

我在root家目錄下創(chuàng)建了 root.txt 這個文件，然后通過 xiaoluo 這個用戶上傳到了 ftp 上，這時我們切換到xiaoluo的家目錄下，發(fā)現(xiàn)該文件已經(jīng)上傳上去了

【注意：】我們在使用ftp進(jìn)行文件上傳、下載操作時，要確保該用戶對目錄具有讀寫的權(quán)限！！！

②匿名用戶上傳、下載操作

我們匿名用戶登陸ftp以后默認(rèn)對共享文件夾只有讀的權(quán)限，即只能從共享目錄里進(jìn)行文件的下載操作

[root@xiaoluo ~]# cd /var/ftp/pub/ [root@xiaoluo pub]# touch xiaoluo.txt [root@xiaoluo pub]# ls xiaoluo.txt [root@xiaoluo pub]# cd [root@xiaoluo ~]# lftp 127.0.0.1 lftp 127.0.0.1:~> cd pub/ lftp 127.0.0.1:/pub> ls -rw-r--r-- 1 0 0 0 Jun 08 16:39 xiaoluo.txt lftp 127.0.0.1:/pub> get xiaoluo.txt lftp 127.0.0.1:/pub> exit [root@xiaoluo ~]# ls anaconda-ks.cfg Desktop install.log install.log.syslog xiaoluo.txt

那么我們要如何通過設(shè)置來實現(xiàn)文件的上傳操作呢？

(1) 修改vsftpd主配置文件開啟匿名用戶上傳的功能：

anonymous_enable=YES　　--開啟匿名用戶訪問(默認(rèn))

anon_upload_enable=YES　　--打開匿名用戶文件上傳功能

anon_mkdir_write_enable=YES　　--打開匿名用戶創(chuàng)建文件夾功能

[root@xiaoluo ~]# vim /etc/vsftpd/vsftpd.conf # Example config file /etc/vsftpd/vsftpd.conf # # The default compiled in settings are fairly paranoid. This sample file # loosens things up a bit, to make the ftp daemon more usable. # Please see vsftpd.conf.5 for all compiled in defaults. # # READ THIS: This example file is NOT an exhaustive list of vsftpd options. # Please read the vsftpd.conf.5 manual page to get a full idea of vsftpd's # capabilities. # # Allow anonymous FTP? (Beware - allowed by default if you comment this out). anonymous_enable=YES # # Uncomment this to allow local users to log in. local_enable=YES # # Uncomment this to enable any form of FTP write command. write_enable=YES # # Default umask for local users is 077. You may wish to change this to 022, # if your users expect that (022 is used by most other ftpd's) local_umask=022 # # Uncomment this to allow the anonymous FTP user to upload files. This only # has an effect if the above global write enable is activated. Also, you will # obviously need to create a directory writable by the FTP user. anon_upload_enable=YES # # Uncomment this if you want the anonymous FTP user to be able to create # new directories. anon_mkdir_write_enable=YES # # Activate directory messages - messages given to remote users when they # go into a certain directory. dirmessage_enable=YES # # The target log file can be vsftpd_log_file or xferlog_file. # This depends on setting xferlog_std_format parameter xferlog_enable=YES # # Make sure PORT transfer connections originate from port 20 (ftp-data). connect_from_port_20=YES # # If you want, you can arrange for uploaded anonymous files to be owned by # a different user. Note! Using "root" for uploaded files is not # recommended! #chown_uploads=YES #chown_username=whoever # # The name of log file when xferlog_enable=YES and xferlog_std_format=YES # WARNING - changing this filename affects /etc/logrotate.d/vsftpd.log #xferlog_file=/var/log/xferlog # # Switches between logging into vsftpd_log_file and xferlog_file files. # NO writes to vsftpd_log_file, YES to xferlog_file xferlog_std_format=YES # # You may change the default value for timing out an idle session. #idle_session_timeout=600 # # You may change the default value for timing out a data connection. #data_connection_timeout=120 # # It is recommended that you define on your system a unique user which the # ftp server can use as a totally isolated and unprivileged user. #nopriv_user=ftpsecure # # Enable this and the server will recognise asynchronous ABOR requests. Not # recommended for security (the code is non-trivial). Not enabling it, # however, may confuse older FTP clients. #async_abor_enable=YES # # By default the server will pretend to allow ASCII mode but in fact ignore # the request. Turn on the below options to have the server actually do ASCII # mangling on files when in ASCII mode. # Beware that on some FTP servers, ASCII support allows a denial of service # attack (DoS) via the command "SIZE /big/file" in ASCII mode. vsftpd # predicted this attack and has always been safe, reporting the size of the # raw file. # ASCII mangling is a horrible feature of the protocol. #ascii_upload_enable=YES #ascii_download_enable=YES # # You may fully customise the login banner string: #ftpd_banner=Welcome to blah FTP service. # # You may specify a file of disallowed anonymous e-mail addresses. Apparently # useful for combatting certain DoS attacks. #deny_email_enable=YES # (default follows) #banned_email_file=/etc/vsftpd/banned_emails # # You may specify an explicit list of local users to chroot() to their home # directory. If chroot_local_user is YES, then this list becomes a list of # users to NOT chroot(). #chroot_local_user=YES #chroot_list_enable=YES # (default follows) #chroot_list_file=/etc/vsftpd/chroot_list # # You may activate the "-R" option to the builtin ls. This is disabled by # default to avoid remote users being able to cause excessive I/O on large # sites. However, some broken FTP clients such as "ncftp" and "mirror" assume # the presence of the "-R" option, so there is a strong case for enabling it. #ls_recurse_enable=YES # # When "listen" directive is enabled, vsftpd runs in standalone mode and # listens on IPv4 sockets. This directive cannot be used in conjunction # with the listen_ipv6 directive. listen=YES # # This directive enables listening on IPv6 sockets. To listen on IPv4 and IPv6 # sockets, you must run two copies of vsftpd with two configuration files. # Make sure, that one of the listen options is commented !! #listen_ipv6=YES pam_service_name=vsftpd userlist_enable=YES tcp_wrappers=YES

(2) 賦予匿名用戶上傳使用的文件夾以寫的權(quán)限

[root@xiaoluo ~]# chmod 2777 /var/ftp/pub/ [root@xiaoluo ~]# ls -ld /var/ftp/pub/ drwxrwsrwx. 2 root root 4096 Jun 9 00:42 /var/ftp/pub/

此時我們重新啟動我們 vsftpd 服務(wù)，就可以使用匿名用戶來進(jìn)行文件上傳的操作了

[root@xiaoluo ~]# service vsftpd restart Shutting down vsftpd: [ OK ] Starting vsftpd for vsftpd: [ OK ] [root@xiaoluo ~]# ls anaconda-ks.cfg Desktop install.log install.log.syslog [root@xiaoluo ~]# touch xiaoluo.txt [root@xiaoluo ~]# ls anaconda-ks.cfg Desktop install.log install.log.syslog xiaoluo.txt [root@xiaoluo ~]# lftp 127.0.0.1 lftp 127.0.0.1:~> cd pub/ lftp 127.0.0.1:/pub> ls lftp 127.0.0.1:/pub> put xiaoluo.txt lftp 127.0.0.1:/pub> exit [root@xiaoluo ~]# cd /var/ftp/pub/ [root@xiaoluo pub]# ls xiaoluo.txt

我們看到，我們在 root 家目錄下創(chuàng)建的 xiaoluo.txt 文件已經(jīng)通過 匿名用戶登錄上傳上去了

【注意：】我們不能將匿名用戶的家目錄的權(quán)限設(shè)置為777權(quán)限，也就是 /var/ftp 這個目錄，而只能設(shè)置其子目錄的權(quán)限為 777，因為vsftp認(rèn)為這樣是很不安全的，如果這樣設(shè)置了，vsftpd將禁止訪問匿名用戶的家目錄

?

至此，本篇隨筆的編寫就告一段落了，本篇隨筆主要講解了FTP服務(wù)的原理以及vsftpd這個FTP服務(wù)程序的安裝、配置使用，有關(guān) vsftpd.conf 這個主配置文件的更多高級配置將在以后的隨筆中進(jìn)行詳細(xì)講解。。。。。。好了，收筆睡覺！！！！

轉(zhuǎn)載于:https://www.cnblogs.com/songcm/p/9316730.html

《新程序員》：云原生和全面數(shù)字化實踐50位技術(shù)專家共同創(chuàng)作，文字、視頻、音頻交互閱讀

總結(jié)

以上是生活随笔為你收集整理的Linux学习之CentOS(三十六)--FTP服务原理及vsfptd的安装、配置的全部內(nèi)容，希望文章能夠幫你解決所遇到的問題。

如果覺得生活随笔網(wǎng)站內(nèi)容還不錯，歡迎將生活随笔推薦給好友。