Set up vsftpd + PAM Authentication under CentOS6.6

Set up vsftpd + PAM Authentication under CentOS6.6
I. Introduction

Vsftpd is the name of a server running on a UNIX operating system that can run on systems such as Linux, BSD, Solaris, HP-UNIX, etc, it is a completely free ftp server software developed with source code. It supports features not supported by many other FTP servers. For example, high security requirements, bandwidth restrictions, good scalability, virtual User Creation, IPv6 support, and high speed. [2]

Vsftpd is the most popular ftp server program in the Linux release. Features: small, light, secure, and easy to use.

There are many FTP services in LINUX, including vsftpd, Wu-ftpd, and Proftp. In Red Hat Enterprise Linux, vsftpd is installed by default.

Ii. How vsftpd works

2.1 vsftp Working Mode

Vsftp is divided into active and passive modes:

Active Mode: Server 20 Port> Client

Passive Mode: Server ** port ----- Cilent

W2.2, vsftp User Type

Anonymous user:

Ftp or anonymous

Local User:

Log on with a real user name and password, provided that you have your own account on the FTP server. after you log on with a real account, the user's directory is used to log on. This directory is automatically created when the system creates an account.

Virtual User:

Account information is stored in an independent database file or database;

2.3. vsftp Service

Very secure FTP Daemon

Http://vsftpd.beasts.org/

Service programs and scripts:

Service Program:/usr/sbin/vsftpd

Startup Script:/etc. init. d/vsftpd

Main configuration file:/etc/vsftpd. conf

2.4 vsftp master configuration file parameter description

[Root @ woon ~] # Vim/etc/vsftpd. conf

# Attack (DoS) via the command "SIZE/big/file" in ASCII mode. vsftpd

# Predicted this attack and has always been safe, reporting the size of

# Raw file.

# ASCII mangling is a horrible feature of the protocol.

# Ascii_upload_enable = YES

# Ascii_download_enable = YES

Whether to enable ASCII file transfer. This format is generally not required.

#

# You may fully customise the login banner string:

# Ftpd_banner = Welcome to blah FTP service.

; Log on to the FTP server, and the prompted welcome information

#

# You may specify a file of disallowed anonymous e-mail addresses. Apparently

# Useful for combatting certain DoS attacks.

# Deny_email_enable = YES

# (Default follows)

# Banned_email_file =/etc/vsftpd/banned_emails

If the above two options are enabled, you can create a blacklist in/etc/vsftpd/banned_emails.

#

# You may specify an explicit list of local users to chroot () to their home

# Directory. If chroot_local_user is YES, then this list becomes a list

# Users to NOT chroot ().

# Chroot_local_user = YES

When set to yes, the user cannot log on to the unexpected directory in the root directory

# Chroot_list_enable = YES

# (Default follows)

# Chroot_list_file =/etc/vsftpd/chroot_list

When logging on to the FTP server, users listed in the chroot_list file cannot access directories other than the FTP root directory.

#

# You may activate the "-R" option to the builtin ls. This is disabled

# Default to avoid remote users being able to cause excessive I/O on large

# Sites. However, some broken FTP clients such as "ncftp" and "mirror" assume

# The presence of the "-R" option, so there is a strong case for enabling it.

# Ls_recurse_enable = YES

; Can I use the ls R command?

#

# When "listen" directive is enabled, vsftpd runs in standalone mode and

# Listens on IPv4 sockets. This directive cannot be used in conjunction

# With the listen_ipv6 directive.

Listen = YES

; If this parameter is set to YES, vsftpd runs in stand-alone mode.

#

# This directive enables listening on IPv6 sockets. To listen on IPv4 and IPv6

# Sockets, you must run two copies of vsftpd with two configuration files.

# Make sure, that one of the listen options is commented !!

# Listen_ipv6 = YES

; Ipv6 listener

Pam_service_name = vsftpd

Set the name of the configuration file for the PAM Authentication Service, which is stored in the/etc/pam. d/directory.

Userlist_enable = YES

Whether the user in the user list can log on to the ftp server

Tcp_wrappers = YES

; Tcp_wrqppers as host access control

In addition, many parameters are not displayed, listing common parameters

Idle_session_timeout = 300 if the client does not perform any operation within 300 seconds, the server is automatically disconnected.

Max_clinet = 0

Maximum number of connections (in stand-alone mode)

Max_per_ip = 0

Maximum number of connections to the ftp server on each client

Local_max_rate = 0