Linux Study Notes-file service Vsftp

Linux Study Notes-file service Vsftp-Linux Enterprise Application-Linux server application information. For details, see the following. Knowledge point:
1. FTP uses TCP connection and TCP port
2. During communication, FTP needs to establish two TCP connections:
One for control information. The default TCP port number is 21.
One for data transmission. The default TCP port number is 20.
3. Vsftp is a GPL-based FTP server on Unix-like systems.
4. The VS in the name indicates "Verysecure", which indicates high security.
Configuration:
1. Check whether Vsftp is installed.
# Rpm? Qa vsftpd
2. Installation
Put the third Disc
# Mount/mnt/cdrom
# Cd/mnt/cdrom/RedHat/RPMS
# Rpm? Ivh vsftpd-1.1.3-8.i386.rpm
# Cd; eject
3. Start and Stop the Vsftp Service
# Service vsftpd start
# Service vsftpd stop
# Service vsftpd restart
Permanent start: # setup
# Ps? Ax | grep vsftpd to check whether the process is started.
# Chkconfig? Level 2345 vsftpd on is set to automatically start the process when the system starts.
4. Access Vsftp
Go to ftp 192.168.0.1
Enter the password and enter: ls to view put upload get download
Leave bye
5. Configuration File
Main configuration file/etc/vsftpd. conf
User Control file/etc/vsftpd. ftpusers: specifies which users cannot access FTP, which is equivalent to a blacklist
Main configuration file:
Option = value
It should be noted that the equal sign cannot be blank on both sides, otherwise it is incorrect.
=== Ascii settings ==============================
Ascii_download_enable
Controls whether ASCII download is available. The default value is NO.
Ascii_upload_enable
Controls whether ASCII upload is available. The default value is NO.
=== Individual user settings ===========================
Chroot_list_enable
If this function is enabled, all local users can log on to the data folder outside the root directory, except those listed in/etc/vsftpd. chroot_list. The default value is NO.
Userlist_enable
Usage: YES/NO
If this function is enabled, the user name in/etc/vsftpd. user_list is read. This function can display a failure message before asking for the password, without the need to check the password program. The default value is disabled.
Userlist_deny
Usage: YES/NO
This option is verified only when userlist_enable is started.
If this option is set to YES, users in/etc/vsftpd. user_list cannot log on,
If it is set to NO, only users in/etc/vsftpd. user_list can log on.
In addition, this function can display an error message before asking for the password, without the need to check the password program.
User_config_dir
Defines the directory where individual users set files,
For example, if user_config_dir =/etc/vsftpd/userconf is defined and the host has users test1 and test2, we can add the names test1 and test2 in the user_config_dir directory. If you log on to test1, the settings in the file test1 under user_config_dir will be read.
The default value is none.
=== Welcome language ===============================
Dirmessage_enable
If this option is enabled, the first time the user enters a directory, the user will check whether there is a directory. message file, if any, the content of this file will appear. Generally, this file will be placed with welcome words or descriptions of this directory. The default value is enable.
Banner_file
When a user logs in, the file content of this setting is displayed, which is usually a welcome word or description. The default value is none.
Ftpd_banner
Here, we can define a string of welcome words. Compared with banner_file, it is in the file format, while ftpd_banner is in the string format. The default value is none.
=== Special Security Settings ===========================
Chroot_local_user
If YES, all users on the local machine can switch to a folder other than the root directory. The default value is NO.
Hide_ids
If this function is enabled, the owner and group of all archives are ftp, that is, the user logs on to commands such as ls-al, and the owner and group of all archives are ftp. The default value is disabled.
Ls_recurse_enable
If this function is enabled, the user can use the ls-R command. The default value is NO.
Write_enable
Usage: YES/NO
This option controls whether FTP commands allow changes to the file system, such as STOR, DELE, RNFR, RNTO, MKD, RMD, APPE, and SITE. The default value is disabled.
Setproctitle_enable
Usage: YES/NO
When this function is enabled, vsftpd will display all processes that are online in different ways. In other words, you can use commands such as ps-ef to view the online status. The default value is disabled.
Tcp_wrappers
Usage: YES/NO
If it is started, vsftpd is combined with tcp_wrapper, that is, the allowed or denied source address can be defined in/etc/hosts. allow and/etc/hosts. deny.
Pam_service_name
The name used by PAM is defined here. The default value is vsftpd.
Secure_chroot_dir
This option must specify an empty folder and no logon user can write data. When vsftpd does not require file system permission, users are restricted to this folder. The default value is/usr/share/empty.
=== Record File Settings ===========================
Xferlog_enable
Usage: YES/NO
If the file is started, the upload and download information will be recorded in the file defined by xferlog_file. The default value is enable.
Xferlog_file
This option sets the location of the record file. The default value is/var/log/vsftpd. log.
Xferlog_std_format
If it is started, the record file will be written into the standard format of xferlog, as in wu-ftpd. The default value is disabled.
====== =
Accept_timeout
This parameter is set when online connections are established. The unit is seconds. The default value is 60.
Connect_timeout
Set the timeout time for data online in the Response PORT mode, in seconds. The default value is 60.
Data_connection_timeout
This parameter is set when you create an online data volume. Default Value: 300 seconds.
Idle_session_timeout
The Unit is seconds. Default Value: 300 seconds.
======================================
Anon_max_rate
The maximum transmission speed that anonymous logon can use. The unit is the number of bytes per second. 0 indicates unlimited speed. The default value is 0.
Local_max_rate
The maximum transmission speed that the local user can use. The unit is the number of bytes per second. 0 indicates unlimited speed. The default value is 0.
=== New File Permission settings ==========================
Anon_umask
Umask value when an anonymous user adds a file. The default value is 077.
File_open_mode
The permission to upload files, which is the same as the value used by chmod. The default value is 0666.
Local_umask
Umask value when the local login adds a file. The default value is 077.
=== Port settings ===============================
Connect_from_port_20
Usage: YES/NO
If set to YES, the ftp-data is forced to use port 20 for data transmission. The default value is YES.
Ftp_data_port
Set the port used for ftp data connection. The default value is 20.
Listen_port
The port used by the FTP server. The default value is 21.
Pasv_max_port
To establish online data, you can use the upper limit of the port range. 0 indicates any. The default value is 0.
Pasv_min_port
The lower bound of the port range can be used to establish online data. 0 indicates any. The default value is 0.
======================================
Anon_root
The directory used for anonymous logon. The default value is none.
Local_enable
Usage: YES/NO
Enable this function to allow local users to log on. The default value is YES.
Local_root
The local user will be replaced with the defined directory when logging on. The default value is none.
Text_userdb_names
Usage: YES/NO
When a user logs in and uses commands such as ls-al to query the management right of the file, the owner's UID appears by default, instead of the owner's name. If you want the owner name to appear, enable this function. The default value is NO.
Pasv_enable
If it is set to NO, PASV mode is not allowed to establish data online. The default value is enable.
=====================================
Chown_uploads
Usage: YES/NO
If it is enabled, all anonymous data upload owners will be replaced with the users set in chown_username. This option is useful for security and management. The default value is NO.
Chown_username
It can be defined here that when an anonymous login uploads a file, the owner of the file will be replaced by the user name. The default value is root.
=== Guest settings =============================
Guest_enable
Usage: YES/NO
If this function is enabled, all non-Anonymous logins are considered as guest. The default value is disabled.
Guest_username
The User Name of guest is defined here. The default value is ftp.
=== Anonymous settings ===========================
Anonymous_enable
Usage: YES/NO
Control: Allow Anonymous logon. YES indicates Allow Anonymous logon. NO indicates Allow Anonymous logon. The default value is YES.
No_anon_password
If this function is enabled, no password is asked when anonymous logon is used. The default value is NO.
Anon_mkdir_write_enable
Usage: YES/NO
If it is set to YES, Anonymous logons are allowed to add directories. Of course, anonymous users must have write permission to the upper-level directories. The default value is NO.
Anon_other_write_enable
Usage: YES/NO
If it is set to YES, anonymous logon users are allowed more permissions than those outside the upload and creation directories, such as deleting or renaming. The default value is NO.
Anon_upload_enable
Usage: YES/NO
If it is set to YES, anonymous logon users are allowed to upload directories. Of course, anonymous users must have the write permission to the upper-level directories. The default value is NO.
Anon_world_readable_only
Usage: YES/NO
If set to YES, anonymous logon users are allowed to download readable files. The default value is YES.
Ftp_username
Defines the name of the anonymous login user. The default value is ftp.
Deny_email_enable
If this function is enabled, a file/etc/vsftpd. banner_emails must be provided with the email address. If anonymous login is used, you are required to enter the email address. If the entered email address is in this file, online access is not allowed. The default value is NO.
=== Standalone options ==============================
Listen
Usage: YES/NO
If it is started, vsftpd will be executed in an independent way. If vsftpd is executed independently, such as the default value of RedHat Linux 9, it must be started. If vsftpd is included in xinetd, you must disable this function, for example, RedHat Linux 8. In RedHat Linux 9, the default value is YES.
Listen_address
If vsftpd uses standalone mode, you can use this parameter to define which IP address is used to provide this service. If only one IP address is defined on the host, this option is not required, if multiple IP addresses exist, you can define which IP address provides the ftp service. If this parameter is not set, all IP addresses provide this service. The default value is none.
Max_clients
If vsftpd uses standalone mode, you can use this parameter to define the maximum total number of connections. If this number is exceeded, the connection will be rejected. 0 indicates no limitation. The default value is 0.
Max_per_ip
If vsftpd uses standalone mode, you can use this parameter to define the number of online ip addresses. If this number is exceeded, the connection will be rejected. 0 indicates no limitation. The default value is 0.
Experiment 1. Set Chroot. Users cannot switch directories.
By default, the directory can be switched, so it is not safe ..
1. restrict all users from switching Directories
Chroot_local_user = YES
2. The specified user cannot switch directories.
Chroot_local_user = NO
Chroot_list_enable = YES
Chroot_list_file =/etc/vsftpd. chroot_list
Experiment 2: Use Vsftp. user_list for access control
Use/etc/vsftpd. user_list
A. You cannot access the/etc/vsftpd. user_list file. Other users can access it.
Userlist_enable = YES
Userlist_deny = YES
Userlist_file =/etc/vsftpd. user_list
B. Set the users in the/etc/vsftpd. user_list file to access the country. Other users cannot access the country.
Userlist_enable = YES
Userlist_deny = NO
Userlist_file =/etc/vsftpd. user_list
Experiment 3: Simple Virtual users
So that abc users cannot log on to the system, but can only log on to FTP
# Adduser? G ftp? S/sbin/nologin abc
# Passwd abc