VSFTP settings and instances in LINUX

Configuration of etcvsftpdvimetcvsftpdvsftpdconfiptables in the VSFTP setting and yuminstallvsftpd-y configuration directory in LINUX: iptables-IINPUT-mstate -- stateESTABLISHED, RELATED-jACCEPT VSFTP settings and instances in LINUX # yum install vsftpd-y configuration directory/etc/vsftpd # vim/etc/vsftpd. conf iptables configuration: iptables-I input-m state -- state ESTABLISHED, RELATED-j ACCEPTiptables-a input-I lo-j ACCEPT example: implement anonymous access # vim/etc/vsftpd. confanonymous_enable = YES <--- Default parameter # service vsftpd restart example: you can upload files anonymously # vim/etc/vsftpd. conf anon_upload_enable = enabled = YES additional parameter anon_other_write_enable = YESanon_world_readable_only = NO <--- YES indicates that only files that can be read by anyone can be downloaded anonymously. note: network services must be writable, first, ensure that the service software allows write access. Second, ensure that the corresponding resource (directory) for write operations has write permission. by default, the root directory of the resources logged on to the anonymous ftp account is in/var/ftp. to allow the anonymous account to upload files, you must create a sub-directory under/var/ftp, and Grant this sub-directory write permission. # Chmod 777/var/ftp/pub Selinux settings: # sealert-a/var/log/audit. log <-- related prompts can be seen from here # setsebool-P allow_ftpd_anon_write = 1 # chcon-t public_content_rw_t/var/ftp/pub restart service # service vsftpd restart test ftp> put/etc /fstab/pub/fstab Example 3: change the root directory of the ftp resource accessed after anonymous logon, and grant anonymous permission to upload files. Change the root directory to/common prompt: how to change the ftp root directory pay attention to the security context of selinux in the custom directory # vim/etc/vsftpd. confanon_root =/commonanon_upload_enable = Sources = YES # mkdir/common/pub # chmod 777/common/pub # setsebool-P limit = 1 # chcon-t public_content_t/common # chcon-t public_content_rw_t/common/pub # set modprobe ip_conntrack_ftp for service vsftpd restart IPTABLES <--- very important echo "modprobe ip_conntrack_ftp">/erc/rc. d/rc. local iptables-I INPUT-m state -- state ESTABLISHED, RELATED-j ACCEPTiptables-a input-I lo-j ACCEPTiptables-A INPUT-p tcp-m multiport -- dports 20, 21-j ACCEPT iptables-P INPUT DROP combined with Tcpwrapper only allow example.com domain user access ftp # vim/etc/hosts. denyvsftpd: ALL instances T .example.com