Linux Beginner-ftp Chapter (i)

Linux Beginner-ftp Chapter (i)

FTP is a file transfer protocol that is used for two-way transmission of control files on the Internet. The user can download the file from the remote host or upload it to the remote host through the client program.

In Linux systems, if you do not understand selinux, you need to change the enforing under SELinux to Disabled, otherwise it will be affected when uploading or downloading.

1, the installation of VSFTPD service

In the case of a Yum source, enter "Yum install vsftpd.x86_64 lftp.x86_64-y" To install the VSFTPD service, "VSFTPD" is used to publish the file, "Lftp" is used to access other clients. When finished, enter "Systemctl start vsftpd" To turn on the VSFTPD service, and enter "Systemctl enable VSFTPD" To enable the boot service.

You can enter "Lftp IP" to verify availability.

After this configuration is complete, other users are unable to access the host's VSFTPD service via FTP because the firewall does not allow this service. Need to make firewall configuration, enter "Firewall-config" into the firewall graphics management interface, the above "Runtime" to "Permanent", select "Public" under "FTP", click "Options" to select the " Reload Firewalld "can. At this point other hosts can access the host's VSFTPD service.

2. Permission restrictions for native access

You can edit the configuration file "/etc/vsftpd/vsftpd.conf" of the VSFTPD service to restrict access to native users.

As shown, if you change "YES" in "Anonymous_enable=yes" to "NO", anonymous users will not be able to log in.

If you change "YES" in "Local_enable=yes" to "NO", Local users will not be able to log in.

If you change "YES" in "Write_enable=yes" to "NO", then the write permission of the local user will be canceled, that is, it cannot be uploaded or deleted.

3. Restrictions on anonymous users

As can be seen, anonymous user login By default does not have upload permissions. If an anonymous user needs to upload a file, it is necessary to open the "Anon_upload_enable=yes" in line 29th of the "/etc/vsftpd/vsftpd.conf" file and enter "Chgrp ftp/var/ftp/pub" Change the default directory of user groups, and in order to safely enter "chmod 775/var/ftp/pub", to the user group and everyone to read and write power. When you are done, enter "Systemctl restart VSFTPD" to restart the service to allow anonymous users to upload files.

The anonymous user itself does not have write access to the VSFTPD service, that is, the file cannot be renamed and deleted. If required, you can enter "Anon_other_write_enable=yes" in the configuration file, as shown in, after restarting the service, anonymous users can rename and delete files.

Anonymous users do not have the right to establish a directory by default, if you need to establish directory permissions, you need the configuration file in the 34th line of "Anon_mkdir_write_enable=yes" open, restart the service can be accessed when the directory is created.

Anonymous users do not have the right to download the file by default, if you need to download, you need to enter "Anon_world_readable_only=no" in the configuration file, restart the service, the anonymous user can download the file.

The default directory after anonymous user login under "/var/ftp", if you need to change the default login directory, you need to enter "anon_root=/directory" in the configuration file, this directory must be a directory that exists, such as "/we" in, and in which a "linux{1..5}" subdirectory is established. After restarting the service, the default directory will be logged on anonymously again.

As shown, the default permission for anonymous users to upload a file is "600", if you need to change the permissions to upload files, you need to enter "anon_umask=022" in the configuration file, the permissions can be set by themselves, where "022" is just an example, restart the service and re-upload files, the file permissions will change.

As shown, when an anonymous user uploads a file, the file's owner ID is 14, which is FTP, and if you need to change the owner of the uploaded file, you need to open the 52nd line in the config file "Chown_uploads=yes" and line 53rd "Chown_username=whoever" , and change "whoever" to the user name, for example "we". After the completion of the service restart, the file after uploading the file will become "we".

However, it is important to note that when the file upload owner changes, the previously set of "anon_umask=022" will expire, if you need to change the upload file permissions, you need to enter "chown_uploads_mode=0644" in the configuration file, The permission "0644" is entered after the file is uploaded, not the permission "Umask".

Sometimes you need to limit the download speed of anonymous users, as shown in the download speed of "68.68m/s", in the configuration file, enter "Anon_max_rate=xxxxxx" to set the maximum download speed, xxxxx to the number of bytes, such as the set of "102400" That is, the maximum download speed is "100k/s". Takes effect after restarting the service.

You can also set a maximum of x users to connect at the same time by entering "max_clients=x" in the configuration file.

4, the limit of ordinary users

Ordinary users log on when the Write permissions and download permissions and upload permissions are enabled by default, the normal user login location for their home directory, if you need to change this directory, similar to anonymous users, in the configuration file, enter the "local_root=/directory."

As can be seen, when not set, ordinary users can go directly to the root of the host access, which is undoubtedly very dangerous, so you need to lock up the normal user in their home directory. The "Chroot_local_user=yes" in line 105th of the configuration file, the normal user will only be locked in their home directory, not to enter another directory.

The above setting object is all ordinary users, if you need to set some users, you can make home directory lock white list or blacklist settings.

When the whitelist is set to "Chroot_local_user=yes", Turn on line 106th "Chroot_list_enable=yes" and line 108th "Vim/etc/vsftpd/chroot_list", "/etc/vsftpd /chroot_list "This file does not exist and needs to be established by itself, as shown in this file is not written to any user, all users are locked in the home directory, enter the user name, such as" we ", we users can access other directories, other users can not.

When the blacklist is set, the "YES" in "Chroot_local_user=yes" is changed to "No", and we users in the list will be locked in the home directory, while other users have no restrictions.

Linux Beginner-ftp Chapter (i)