/Etc/vsftpd. conf and etcvsftpd. conf

/Etc/vsftpd. conf and etcvsftpd. conf
################# Anonymous permission control ###############

Anonymous_enable = YES # Whether to enable Anonymous Users
No_anon_password = YES # No Password is asked when an anonymous user logs in
The following four statements control the upload, download, create, delete, and rename of the file and folder.
Anon_upload_enable = (yes/no); # controls the permission of anonymous users to upload files (non-Directories.
Anon_world_readable_only = (yes/no); # control the permission of anonymous users to download files
Anon_mkdir_write_enable = (yes/no); # control the permission of anonymous users to create folders
Anon_other_write_enable = (yes/no); # Anonymous Users are allowed to delete and rename files and folders.
Note: anonymous users use the nobody user for download. Therefore, the corresponding O location must have the R permission to be downloaded. To allow anonymous users to upload and delete permissions, you must set
Write_enable = YES # global settings, whether to allow writing (whether anonymous or local users, enable the upload permission)
Anon_root = (none) # anonymous user home directory
Anon_max_rate = (0) # speed limit for anonymous users
Anon_umask = (077) # There is a mask when an anonymous user uploads a file (if you want the File Uploaded by an anonymous user to be directly downloaded anonymously, set it to 073 here)
Chown_uploads = YES # the owner of all anonymously uploaded files will be changed to chown_username
Chown_username = whoever # username of the file to be uploaded anonymously

################# Local user permission control ###############

Parameters	Parameter description
Write_enable = YES	# You can delete or rename an upload task.
Local_umask	Set the umask value created for the local user. Default: 077
Userlist_enable = YES	This restricts access by users. If enabled, vsftpd will load a userlist_file from the file name given by the userlist file. If you attempt to log on using the name in the file, the password will be rejected before the request.
Local_root	Set the directory to which a local user logs on.
User_config_dir	Set a separate configuration file for the user. Name the account used for login
Download_enable	Restrict the download permission of a user. Default: YES. If NO is set, all download requests will be rejected.
Chroot_list_enable = YES	If this feature is enabled, users listed in chroot_list_file cannot change the home directory. If activated, a list of local users (chroot_list_file) may be provided, which are placed in the chroot () prison of their home directory during logon. If you set chroot_local_user to YES, the meaning is slightly different. In this case, the list is changed to a list of users not placed in the chroot () Prison. By default, the files that contain this list are/etc/vsftpd/chroot_list, but you can overwrite it with the chroot_list_file setting. Default: NO
Chroot_local_user	If YES is set, the local user will (by default) Put the chroot () prison in the home directory after logging on. Warning this option is safe, especially when the user has the upload permission or shell access. Only when you know what you are doing will you do it. Note that these security definitions are not unique to vsftpd. They apply to all FTP daemon. They can put local users in chroot () jails. Default: NO
Chroot_list_file =/etc/vsftpd/chroot_list	Restrict User Files
User_config_dir =	The directory that stores the configuration file. Different users have different permissions. # Add this sentence to the vsftpd. conf file. # create your own configuration file in the corresponding directory for different permissions.

 

You can use the following three configuration files to control user directory switching.

Chroot_list_enable = YES/NO # Sets whether to enable the user list file specified by the chroot_list_file configuration item.
# If this function is enabled, the root directory cannot be changed for all users listed in chroot_list_file. The default value is yes.
Chroot_list_file =/etc/vsftpd/chroot_list # indicates the list files of users locked in their own directories.
Chroot_list_enable = YES
It works with chroot_local_user = YES/NO to achieve the following effects:
1. When chroot_list_enable = YES, chroot_local_user = YES, in/etc/vsftpd. users listed in the chroot_list file can switch to other directories. Users not listed in the file cannot switch to other directories.
2. When chroot_list_enable = YES and chroot_local_user = NO. users listed in the chroot_list file cannot switch to other directories. Users not listed in the file can switch to other directories.
3. When chroot_list_enable = NO and chroot_local_user = YES, all users cannot switch to other directories.
4. When chroot_list_enable = NO and chroot_local_user = NO, all users can switch to other directories.

For example:
Assume that two ftp users, ftp1 and ftp2, plan to lock the ftp1 user in the main directory. They are not allowed to switch to other directories, but are allowed to switch directories freely, it can be implemented in two ways:
Method 1:
Order:
Chroot_local_user = YES
Chroot_list_enable = YES
/Etc/vsftpd/chroot_list:
Ftp2

Explanation: Chroot_local_user = YES limits all users to the main directory. chroot_list_enable = YES indicates that chroot_list_file is enabled. Because chroot_local_user = YES, all users are "limited to the main directory ", therefore, chroot_list_file, which is always used as an "exception list", lists users who are "not restricted to the main directory.

Method 2:
Order:
Chroot_local_user = NO
Chroot_list_enable = YES
/Etc/vsftpd/chroot_list:
Ftp1

Explanation: Chroot_local_user = NO, all users are not limited to the main directory. chroot_list_enable = YES indicates that chroot_list_file is enabled. Because chroot_local_user = NO, all users are "not limited to the main directory ", therefore, chroot_list_file, which is always used as an "exception list", lists users who "will be restricted to the main directory.

Other cases:
There are two combinations of chroot_local_user and chroot_list_enable:
Chroot_local_user = YES
Chroot_list_enable = NO
And
Chroot_local_user = NO
Chroot_list_enable = NO

When chroot_list_enable = NO, chroot_list_file is NO longer enabled. In this case, all users are limited or not limited to the main directory!

################# Virtual user settings #################

The virtual user uses the PAM Authentication Method.

Pam_service_name = vsftpd	# Set the name used by PAM. The default value is/etc/pam. d/vsftpd.
Check_shell = YES	# (Note: It is only useful when no pam verification version is available. Check whether the user has a valid shell to log on)
Guest_enable = YES/NO	# Enable a virtual user. The default value is NO.
Guest_username = ftp	# This is used to map virtual users. The default value is ftp.
Virtual_use_local_privs = YES/NO	# When this parameter is activated (YES), the virtual user uses the same permissions as the local user. # When this parameter is disabled (NO), virtual users use the same permissions as anonymous users. By default, this parameter is disabled (NO ).

 

################# Access control settings #################

Two control modes: one is to control host access and the other is to control user access.
1. Control Host access:
Tcp_wrappers = YES/NO
Set whether vsftpd is combined with tcp wrapper to control access to the host. The default value is YES. If it is enabled, the vsftpd server checks the settings in/etc/hosts. allow and/etc/hosts. deny to determine whether to allow access to the FTP server. These two files can provide simple firewall functions.
For example, to allow only users with 192.168.10.1-192.168.10.254 to connect to the FTP server,
In
/Etc/hosts. allow
/Etc/hosts. deny
Add the following content to the file:

The format is as follows:
Restricted service: ip address (network segment)
Vsftpd: 192.168.1.
Vsftpd: 192.168.1.12
Vsftpd: 192.168.1.0/255.255.255.0 cannot be written as 192.168.1.0/24
2. control user access:
Vsftpd. ftpusers # used to save the local user account that is not allowed to log on to FTP. Is the blacklist of vsftp users.
Vsftpd. user_list
(1) set to Disable User Logon In the vsftpd. user_list file: Modify the following two items in the main configuration file vsftpd. conf,
Userlist_enable = yes
Userlist_deny = yes
Note: After configuration, ftp users recorded in the vsftpd. ftpusers file and vsftpd. user_list file cannot log on to the vsftp service, and other ftp users can log on.
(2) Only allow users in the vsftpd. user_list file to log on. Similarly, modify the statements in the Main configuration file vsftpd. conf as follows:
Userlist_enable = yes
Userlist_deny = no
Note: After configuration, only ftp users recorded in the vsftpd. user_list file can log on to the vsftp service. Other ftp users cannot log on.
 

################### Timeout settings ##################

Idle_session_timeout = 600	# Idle connection timeout
Data _ connection_timeout = 120	# Data transmission timeout
ACCEPT_TIMEOUT = 60	# PAVS request timeout
Connect_timeout = 60	# PROT mode connection timeout

 

 

 

############### Server function options ###############

Xferlog_enable = YES	# Enable the diary Function
Xferlog_std_format = YES	# Use Standard Format
Log_ftp_protocol = NO	# When xferlog_std_format is disabled and this option is enabled, all ftp requests and replies are recorded. This option is useful for debugging.
Pasv_enable = YES	# Pasv Mode
Pasv_promiscuous = NO	# Disable the security check. Be careful.
Port_enable = YES	# Allow port Mode
Tcp_wrappers = YES	# Enable tcp_wrappers support
Pam_service_name = vsftpd	# Define the name used by PAM. The default value is vsftpd.
Nopriv_user = nobody	# Username used when the server runs at the bottom layer
Pasv_address = (none)	# Redirect vsftpd to the specified IP address when the pasv command is returned (server connection jump)

　　

Ls_recurse_enable = YES	# Can I use the ls-R command to avoid wasting a large amount of server resources?
One_process_model	# Whether to use the single-process mode
Listen = YES	It is bound to the port specified by listen_port. Since all ports are bound, that is, all ports are open at a time, which is the standalone mode?
Text_userdb_names = NO	# When a user logs in and uses commands such as ls-al to query the management right of the file, the owner's UID is displayed by default, instead of the owner's name. If you want the owner name to appear, enable this function.
Use_localtime = NO	# The local time or GMT time is used to display the directory list. The same effect can be achieved through the mdtm command.
Use_sendfile = YES	# Test Platform Optimization

 

################ Information Class settings ################

Ftpd_banner = welcome to FTP	# The welcome information is displayed in login. If banner_file is set, this setting is invalid.
Dirmessage_enable = YES	# Allows the display of directory configuration information to display the content of the message_file file under each directory
Setproctitle_enable = YES	# Display session status information, off!

 

############# File definition ##################

Chroot_list_file =/etc/vsftpd. chroot_list	# Define a file that cannot change the user's main directory
Userlist_file =/etc/vsftpd. user_list	# Defining restrictions/files that allow users to log on
Banner_file =/etc/vsftpd/banner	# Define the location of the logon information file
Banned_email_file =/etc/vsftpd. banned_emails	# The email address used as the password when an anonymous user is not allowed to log on
Xferlog_file =/var/log/vsftpd. log	# Log File Location
Message_file =. message	# Directory information file

 

############# Directory definition #################

User_config_dir =/etc/vsftpd/userconf	# Define the directory of the user configuration file
Local_root = webdisk	# This option sets the root directory of each user to/home/username/webdisk after login. # define the root directory for local user login. Note that the root directory can be relative or absolute. the relative path is for the user's home directory.
Anon_root =/var/ftp	# Root directory after anonymous login

############ User connection options #################

Max_clients = 100	# Maximum number of acceptable clients
Max_per_ip = 5	# Maximum number of clients for each ip Address
Connect_from_port_20 = YES	# Use Standard Port 20 to connect to ftp
Listen_address = 192.168.0.2	# Bound to an IP address, which cannot be accessed by other IP addresses
Listen_port= 2121	# Bind to a port
Ftp_data_port = 2020	# Data transmission Port
Pasv_max_port = 0	# The upper bound of the port range can be used in pasv connection mode. 0 indicates any port range. The default value is 0.
Pasv_min_port = 0	# When Using pasv connection mode, you can use the lower bound of the port range. 0 indicates any value. The default value is 0.

 

############ Data transmission options #################

Anon_max_rate = 51200	# Transfer ratio of anonymous users (B/s)
Local_max_rate = 5120000	# Local user transmission rate (B/s)

 

 

############ Security Options ####################

 

Idle_session_timeout = 600	#(10 minutes after the user's session is idle)
Data _ connection_timeout = 120	# (Idle data connection for 2 minutes)
Accept_timeout = 60	# (Disconnect the client after idle for 1 minute)
Connect_timeout = 60	# (Disconnect again after 1 minute)
Local_max_rate = 50000	# (Local User transmission rate: 50 K)
Anon_max_rate = 30000	# (Anonymous user transfer rate: 30 K)
Pasv_min_port = 50000	# Minimum Client Data Connection port 50000
Pasvanderbilt max_port = 60000	# Minimum data connection port of the client to 60000
Max_clients = 200	# (Maximum number of FTP connections)
Max_per_ip = 4	# (Maximum number of connections per IP address)
Listen_port= 5555	# (Data connection from port 5555)

 

 

 

 

 

 

 

 

 

Please point out any errors. Thank you !!