Vsftpd settings in centos5

In centos5, set vsftpd-Linux Enterprise Application-Linux server application. For more information, see the following section. Recently, a company's business machine needs to configure Vsftpd for the customer in CentOS5.1, so it starts.

The procedure is simple:

Requirement: (Virtual users can download, upload, but cannot delete users/management users)

I. Installation
Yum-y install vsftpd *
Yum-y install pam *
Yum-y install db4 *

Ii. System Account

1. Host user of the vsftpd service
Useradd vsftpd-s/sbin/nologin
2. vsftpd virtual host user
Useradd ftpuser-s/sbin/nologin
* Logon by related users is not allowed.
Iii. vsftpd. conf settings
1. Backup
Cp/etc/vsftpd. conf/etc/vsftpd. conf. ysbk
2. Settings
--
Anonymous_enable = NO
Disable Anonymous Access
Local_enable = YES
Set local user access. Note: It is mainly a virtual host user. If this project is set to NO, all virtual users will not be able to access it.
Write_enable = YES
Set to allow write operations.
Local_umask = 022
Sets the permission mask for uploaded files.
Anon_upload_enable = NO
Upload by anonymous users is prohibited.
Anon_mkdir_write_enable = NO
Prohibit anonymous users from creating directories.
Dirmessage_enable = YES
Set to enable the directory flag function.
Xferlog_enable = YES
Enable logging.
Connect_from_port_20 = YES
Set Port 20 for data connection.
Chown_uploads = NO
Sets the upload prohibition file to change the host.
Xferlog_file =/var/log/vsftpd. log
Set the path for saving Vsftpd service logs. Note: This file does not exist by default. You must manually touch it out, and because the service host user with Vsftpd changed here is the manually created Vsftpd. The user must be given the write permission on the log, otherwise the service will fail to start.
Xferlog_std_format = YES
Set the standard log format.
Nopriv_user = vsftpd
Set the host user supporting the Vsftpd service to a manually created Vsftpd user. Note: Once you change the host user, you must pay attention to the read/write permissions of the read/write files related to the service. For example, a log file must grant the write permission to the user.
Async_abor_enable = YES
Sets support for asynchronous transmission.
Ascii_upload_enable = YES
Ascii_download_enable = YES
Allows you to upload and download files in ASCII mode.
Ftpd_banner = Welcome to Awei FTP servers
Set Vsftpd login slogans.
Chroot_local_user = YES
Disable local users from logging out of their FTP home directories.
Pam_service_name = vsftpd
Set the verification configuration file name For Vsftpd In the PAM service. Therefore, the PAM Authentication will refer to the vsftpd file configuration under/etc/pam. d.
The following are important configuration items for Vsftpd virtual user support. By default, Vsftpd. conf does not contain these configuration items. You need to manually add the configuration.
Guest_enable = YES
Enable the virtual user function.
Guest_username = ftpuser
Specifies the host user of the virtual user.
Virtual_use_local_privs = YES
Set virtual user permissions to match their host user.
User_config_dir =/etc/vsftpd/vconf
Set the path for storing the configuration file of the virtual user's personal Vsftp. That is to say, the specified directory will store the configuration file of each Vsftp virtual user personality.
The configuration file name must be the same as the virtual user name.
--
3. Create a Vsftpd log file and change the owner to the service host user of Vsftpd:
[Root @ KcentOS5 ~] # Touch/var/log/vsftpd. log
[Root @ KcentOS5 ~] # Chown vsftpd. vsftpd/var/log/vsftpd. log
4. Create a path for storing the virtual user configuration file:
[Root @ KcentOS5 ~] # Mkdir/etc/vsftpd/vconf/
4. Create a virtual user database file
1. Create a virtual user name single file first:
[Root @ KcentOS5 ~] # Touch/etc/vsftpd/virtusers
A single virtual user name file is created. This file is a data file that records the user name and password of A vsftpd virtual user. Here I name it virtusers. To avoid file confusion, I put this list file under/etc/vsftpd.
2. Edit the virtual user name single file:
[Root @ KcentOS5 ~] # Vi/etc/vsftpd/virtusers
----------
Download
1234
Upload
5678
Admin
9012
----------
Edit the virtual user name file and add the user name and password to the file. The format is simple: "One user name, one password ".
3. Generate a virtual user data file:
[Root @ KcentOS5 ~] # Db_load-T-t hash-f/etc/vsftpd/virtusers. db
5. Set the PAM Authentication file and specify the virtual user database file for reading
Add the following information to the file header of/etc/pam. d/vsftpd (the following information is invalid)
--
Auth sufficient/lib/security/pam_userdb.so db =/etc/vsftpd/virtusers
Account sufficient/lib/security/pam_userdb.so db =/etc/vsftpd/virtusers
--
Vi. Virtual User Configuration
1. download users. They can only download files, but cannot upload or delete files.
?
Write_enable = NO
?
2. upload can be downloaded, uploaded, but not deleted
?
Write_enable = YES
Cmds_allowed = ABOR, CWD, LIST, MDTM, MKD, NLST, PASS, PASV, PORT, PWD, QUIT, RETR, RNFR, RNTO, SIZE, STOR, TYPE, USER, REST, CDUP, HELP, MODE, NOOP, REIN, STAT, STOU, STRU, SYST, FEAT
File_open_mode = 0444
?
3. admin manages ftp
?
The default vsftpd. conf file is enough. Do not make any changes.
?
4. Supplement:
If you want to restrict the upload directory (main directory), you must add
?
Local_root =/home/ftp/upload
?
Grant the corresponding permissions to/home/ftp/upload.

Welcome to reprint this article, please indicate from: http://www.linuxsense.org