vsftpd It is an FTP service program running on Linux operating system. It is not only completely open source but also free. In addition, it also has high security, transmission speed, and supports virtual user authentication and other features that other FTP service programs do not have.

As a more secure file transfer service program, vsftd allows users to log in to FTP in three authentication modes The server Up.

• Anonymous open mode: it is the most insecure authentication mode. Anyone can log in to FTP directly without password verification The server.
• Local user mode: It is authenticated through the local account password information of the Linux system, which is more secure than the anonymous open mode. But if you are ××× After cracking the account information, you can log in to FTP unimpeded The server To fully control the entire server.
• Virtual user mode: It is the safest authentication mode among the three modes. It needs to establish a user database file for the FTP service separately, and virtualize the account information used for password verification. These account information actually does not exist in the server system, and is only used for authentication by the FTP service program. Experimental environment After configuring the yum warehouse on the FTP server, install vsftpd Service procedure

Anonymous open mode

vsftpd By default, the service program opens the anonymous open mode, which requires anonymous users to upload and download permissions, as well as the permission to allow anonymous users to create, delete and rename files. This configuration is not recommended for real environments. The system user corresponding to the anonymous user of the FTP server is FTP.

anonymous_enable=YES / / allow anonymous access anon_upload_enable=YES / / allow anonymous users to upload files anon_mkdir_write_enable=YES / / allow anonymous users to create directories anon_other_write_enable=YES// allow anonymous users to modify or delete directories anon_umask=022 / / set the permission mask for anonymous users to upload data

Execute the FTP command on the client to connect to the FTP server, and access the FTP root directory /var/ftp by default. For security reasons, the permissions of the FTP root directory do not allow anonymous users or other users to have write permission (otherwise, a 500 error will be reported when accessing)

/By default, a subfolder pub is created under the var/ftp directory, which can be used for uploading files during anonymous access. It is necessary to ensure that anonymous user FTP has write permission to this directory.

Client test:

Local user mode

The anonymous open mode was used before, but now it is turned off, and then the local user mode is turned on. Create a local user zhangsan to test.

anonymous_enable=NO / / anonymous access is prohibited local_enable=YES / / allow local user mode write_enable=YES / / set writable permissions local_umask=022 / / set the umask value of the local user mode creation file

Execute the ftp command on the client to connect to the ftp server. By default, the user's home directory is accessed, and the default owner and group of the directory are the user himself.

Client test:

It should be noted that version 7 requires adding the "allow_writeable_chroot=YES" parameter to the configuration file to allow local users to log in// Allow writing to the imprisoned FTP root directory, and do not refuse the user's login request

1. Imprison Host Directory

If you also want to imprison all host directories in their host directories, you can add chroot_local_user configuration item, otherwise the user will be able to switch to any folder outside the server's /var/, /etc/, /boot/ and other host directories, which will pose a security risk.

chroot_local_user=YES / / imprison the host directory

Client test:

2. Black and white list

However, after logging in with the root administrator, the system prompts the following error message:

that is because vsftpd By default, a file named "user list" user is stored in the directory where the service program is located_ List, default userlist_deny=YES, so the names appearing on this list will not be allowed to log in to the ftp server, that is, the blacklist.

Virtual user mode

Step 1:

Create a user database file for FTP authentication, including odd line account name and even line password.

Step 2:

Create the vsftpd service program to store the root directory of files and the system local user of virtual user mapping. The root directory for storing files in FTP service refers to the default location accessed by virtual users after logging in.

Step 3:

Create a PAM file vfstpd.vu to support virtual users, where the "db=" parameter uses dB_ The path of the account password database file generated by the load command.

Step 4:

Through pam in the main configuration file of vsftpd service program_ service_ The name parameter changes the name of the pam authentication file to vsftpd Vu, add guest_enable,guest_username parameter.

anonymous_enable=NO / / anonymous access is prohibited guest_enable=YES / / enable virtual user mode guest_username=virtual / / specify the virtual user account pam_service_name=vsftpd.vu / / specify PAM file

Step 5:

Set different permissions for virtual users. First create the storage path of the configuration files of the virtual user with different permissions, and then create the files named rose and jack respectively under this path.

Step 6:

Modify the vsftpd main configuration file again by adding user_ config_ The dir parameter defines the path where the configuration files of the two virtual users with different permissions are stored, and restarts the vsftpd service.

user_config_dir=/etc/vsftpd/vu_dir / / individual user profile

Client test:

How to install VsFTPD server with TLS on Ubuntu 18.04 LTS https://www.linuxidc.com/Linux/2018-10/154930.htm