Simple case of anonymous uploading of SeLinux and vsftpd on the RHEL6 Platform

SeLinux is rarely enabled for FTP applications on most production lines on the RHEL6 platform, because it is too troublesome. Here is a small case, based on the RHEL6.3 platform. System status: RedHadEnterprisesLinux6.332bitSeLinux-Enforcingiptables-disabled-

SeLinux is rarely enabled for FTP applications on most production lines on the RHEL6 platform, because it is too troublesome. Here is a small case, based on the RHEL 6.3 platform.

System status:

RedHad ipvises Linux 6.3 32bit

SeLinux-Enforcing

Iptables-disabled)

1. Installation omitted (yum-y install vsftpd)

2. Start and test by default

After the installation, vsftpd is directly started without modifying any parameters. Common users can log on and upload and download the vsftp, which is the default situation of vsftp, however, SeLinux is not so default. Enable:

[Root @ localhost cto.luxiaok.com] # setsebool-P ftp_home_dir = on

Otherwise, the error 500 indicating that the directory cannot be switched will be reported. In fact, by default, vsftp allows local users to log on and upload/download is dangerous, because it can be switched to another directory, of course, by default. This can also be controlled through vsftpd. conf.

3. Enable upload/download for anonymous users

This is the topic of this article. Let's talk about the default situation. By default, vsftpd. conf can be modified only when anonymous users are allowed to log on and download, but not upload.

Allow Anonymous upload settings:

Cancel the comments from the above two lines and restart vsftpd. You can also comment out local_enable to disable local user login.

However, you still cannot upload the file.

First

Root@luxiaok.com ~ # Chmod-R 777/var/ftp/pub

It is very important that the permissions of/var/ftp cannot be changed here. Otherwise, the 500 error will occur directly when anonymous users log on. This is the default mechanism of vsftp. The upload here takes the pub directory as an example.

Then

[Root @ localhost cto.luxiaok.com] # setsebool-P allow_ftpd_anon_write = on

Then perform the test.

Here is a very simple case, but I will explain more about SeLinux.

For more information about RedHat, see RedHat topic page http://www.linuxidc.com/topicnews.aspx? Tid = 10