RHEL6.1 vsftpd SELinux配置和開啟本機使用者上傳

RHEL6.1 vsftpd SELinux配置和開啟本機使用者上傳 修改/etc/vsftpd.conf，設定anonymous_enable=NO，local_enable=YES。這樣，我們就禁止了匿名
使用者的訪問並且允許了本機使用者訪問  www.2cto.com  ==========================================================================================將使用者加入ftp組，並設定linux許可權[root@www ~]# usermod -aG ftp alexscript[root@www ~]# groups alexscript[root@www ~]# chown ftp:ftp /var/ftp/pub/ -R[root@www ~]# ls -ld /var/ftp/pub/drwxr-xr-x. 6 ftp ftp 4096 6月 16 14:48 /var/ftp/pub/[root@www ~]# chmod 775 /var/ftp/pub/ -R[root@www ~]# ls -ld /var/ftp/pub/drwxrwxr-x. 6 ftp ftp 4096 6月 16 14:48 /var/ftp/pub/ ===========================================================================================SELinux設定官方說明：FTP must be allowed to write to a directory before users can upload files via FTP. SELinux allows FTP to write to directories labeled with the public_content_rw_t type.就是說如果FTP要允許上傳，類型要設定為public_content_rw_t   www.2cto.com  1.查看類型[root@localhost ~]# ls -dZ /var/ftp/drwxr-xr-x. root root system_u:object_r:public_content_t:s0 /var/ftp/目前是public_content_t，只能讀取。 -------------------------------------------------------------------------------------------2. 修改Type[root@localhost ~]# semanage fcontext -a -t public_content_rw_t "/var/ftp(/.*)?"-bash: semanage: command not found遇到問題 命令不存在。官方文檔說明policycoreutils-python : provides utilities such as semanage, audit2allow, audit2why
and chcat, for operating and managing SELinux.policycoreutils-python這個包提供了semanage命令。 3. 安裝policycoreutils-python掛載光碟機[root@localhost ~]# mkdir /cdrom[root@localhost ~]# mount -o auto /dev/cdrom /cdrommount: block device /dev/sr0 is write-protected, mounting read-only[root@localhost Packages]# rpm -ivh policycoreutils-python-2.0.83-19.8.el6_0.i686.rpm \audit-libs-python-2.1-5.el6.i686.rpm \libsemanage-python-2.0.43-4.el6.i686.rpm \setools-libs-python-3.3.7-4.el6.i686.rpm \setools-libs-3.3.7-4.el6.i686.rpm warning: policycoreutils-python-2.0.83-19.8.el6_0.i686.rpm: Header V3 RSA/SHA256 Signature,
key ID fd431d51: NOKEY  www.2cto.com  Preparing... ########################################### [100%]1:setools-libs ########################################### [ 20%]2:setools-libs-python ########################################### [ 40%]3:libsemanage-python ########################################### [ 60%]4:audit-libs-python ########################################### [ 80%]5:policycoreutils-python ########################################### [100%] 4. 接著第2步，修改並應用標籤[root@localhost Packages]# semanage fcontext -a -t public_content_rw_t "/var/ftp(/.*)?"libsemanage.dbase_llist_query: could not query record value (No such file or directory).libsemanage.get_home_dirs: alex homedir /var/ftp or its parent directory conflicts with
a file context already specified in the policy. This usually indicates an incorrectly
defined system account. If it is a system account please make sure its uid is less than
500 or its login shell is /sbin/nologin.[root@localhost Packages]# restorecon -R -v /var/ftprestorecon reset /var/ftp context system_u:object_r:public_content_t:s0->system_u:object_r:public_content_rw_t:s0restorecon reset /var/ftp/pub context system_u:object_r:public_content_t:s0->system_u:object_r:public_content_rw_t:s0 5. The allow_ftpd_anon_write Boolean must be on to allow vsftpd to write to files that
are labeled with the public_content_rw_t type. Run the following command as the root user
to turn this Boolean on:allow_ftpd_anon_write Boolean 必須設定為on才能上傳。[root@localhost Packages]# setsebool -P allow_ftpd_anon_write onlibsemanage.get_home_dirs: alex homedir /var/ftp or its parent directory conflicts with
a file context already specified in the policy. This usually indicates an incorrectly
defined system account. If it is a system account please make sure its uid is less than
500 or its login shell is /sbin/nologin. =========================================================================================防火牆iptables設定：設定了iptables的禁止所有的連接埠，只容許可能訪問了策略後大部分情況下會出現ftp不能正常訪問
的問題，因為ftp有主動和被動串連兩種模式，少添加一些策略就會出問題。
 1.首先載入模組  www.2cto.com  [root@localhost Packages]# cd /etc/sysconfig/[root@localhost sysconfig]# vi iptables-config# Space separated list of nat helpers (e.g. 'ip_nat_ftp ip_nat_irc'), which# are loaded after the firewall rules are applied. Options for the helpers are# stored in /etc/modprobe.conf.IPTABLES_MODULES=""IPTABLES_MODELES="ip_conntrack_ftp" // 這裡是新增的兩行IPTABLES_MODELES="ip_nat_ftp" 2.然後載入策略[root@localhost sysconfig]# vi iptables###### vsftpd ######-I INPUT -p tcp --dport 21 -j ACCEPT -I OUTPUT -p tcp --dport 21 -j ACCEPT 3. 重啟防火牆[root@localhost sysconfig]# service iptables restartiptables：清除防火牆規則： [確定]iptables：將鏈設定為政策 ACCEPT：filter [確定]iptables：正在卸載模組： [確定]iptables：應用防火牆規則： [確定] =========================================================================================說明：  www.2cto.com  串連時請設定為主動串連方式。[root@localhost sysconfig]# service vsftpd start為 vsftpd 啟動 vsftpd： [確定][root@localhost sysconfig]# chkconfig --level 3 vsftpd on ========================================================================================參考文檔:http://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/6/html/Managing_Confined_
Services/sect-Managing_Confined_Services-File_Transfer_Protocol-Configuration_Examples.htmlRed_Hat_Enterprise_Linux-6-Security_Guide-en-US.pdf 5.1.SELinux Packages  作者 大果粒