Vsftp

May 28, 2021 2 min read

配置 Ftp 服务

  • 安装软件包
yum install -y netstat nfs-utils vim httpd vsftpd pam_ldap
systemctl enable vsftpd
systemctl enable nslcd
  • 配置服务
# 新建 chroot_list 文件
touch /etc/vsftpd/chroot_list

# 新建用户配置目录
mkdir /etc/vsftpd/user_conf

# 配置 upload 用户
useradd upload
cat << EOF >/etc/vsftpd/user_conf/upload
local_root=/var/ftp/upload
EOF

# 配置 vsftpd.conf
cp /etc/vsftpd/vsftpd.conf /etc/vsftpd/vsftpd.conf.bk
cat << EOF >/etc/vsftpd/vsftpd.conf
anonymous_enable=NO
anon_upload_enable=YES
anon_mkdir_write_enable=YES
anon_other_write_enable=YES
no_anon_password=NO
anon_umask=020

local_enable=YES
write_enable=YES
local_umask=022

chroot_local_user=YES
chroot_list_enable=YES
chroot_list_file=/etc/vsftpd/chroot_list

userlist_enable=YES
userlist_file=/etc/vsftpd/user_list

dirmessage_enable=YES
xferlog_enable=YES
xferlog_std_format=YES
connect_from_port_20=YES
listen=YES
pam_service_name=vsftpd
tcp_wrappers=YES

local_root=/var/ftp

port_promiscuous=YES
pasv_promiscuous=YES
user_config_dir=/etc/vsftpd/user_conf

dual_log_enable=YES
vsftpd_log_file=/var/log/vsftpd.log
# use_localtime=YES

guest_enable=YES
guest_username=upload
chown_uploads=YES
chown_username=upload

allow_writeable_chroot=YES # 修复 500 OOPS: vsftpd: refusing to run with writable root inside chroot()
EOF

# 配置 vsftpd pam 认证
cp /etc/pam.d/vsftpd /etc/pam.d/vsftpd.bk
cat << EOF >/etc/pam.d/vsftpd
#%PAM-1.0
auth       sufficient   pam_ldap.so
password   sufficient   pam_ldap.so
account    sufficient   pam_ldap.so
session    optional     pam_keyinit.so    force revoke
auth       required     pam_listfile.so   item=user sense=deny file=/etc/vsftpd/ftpusers onerr=succeed
auth       required     pam_shells.so
auth       include      password-auth
account    include      password-auth
session    required     pam_loginuid.so
session    include      password-auth
EOF

# 配置 ldap
cp /etc/nslcd.conf /etc/nslcd.conf.bk
cat << EOF >/etc/nslcd.conf
uid nslcd
gid ldap

uri ldap://ldap.x
base dc=ldap,dc=x
binddn cn=cqrd-omt,ou=app,dc=ldap,dc=x
bindpw secret
EOF
  • 启动服务
systemctl start vsftpd
systemctl start nslcd
  • 更改防火墙策略
firewall-cmd --add-service --permanent ftp
  • 配置 WEB 服务
# 配置 httpd.conf
cat << EOF >
ServerRoot "/etc/httpd"
Timeout 60
KeepAlive Off
MaxKeepAliveRequests 100
KeepAliveTimeout 15
Listen 80
Include conf.modules.d/*.conf
User apache
Group apache
ServerAdmin root@localhost
<Directory />
     Options  FollowSymLinks
     AllowOverride None
</Directory>
DocumentRoot "/var/ftp"
<Directory "/var/ftp">
     Options Indexes FollowSymLinks
     AllowOverride None
     Order allow,deny
     Allow from all
</Directory>
DirectoryIndex index.html index.html.var
AccessFileName .htaccess
<Files ".ht*">
    Require all denied
</Files>
ErrorLog "logs/error_log"
LogLevel warn
<IfModule log_config_module>
    LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
    LogFormat "%h %l %u %t \"%r\" %>s %b" common
    <IfModule logio_module>
      LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %I %O" combinedio
    </IfModule>
    CustomLog "logs/access_log" combined
</IfModule>
<IfModule alias_module>
    ScriptAlias /cgi-bin/ "/var/www/cgi-bin/"
</IfModule>
<Directory "/var/www/cgi-bin">
    AllowOverride None
    Options None
    Require all granted
</Directory>
<IfModule mime_module>
    TypesConfig /etc/mime.types
    AddType application/x-compress .Z
    AddType application/x-gzip .gz .tgz
    AddType text/html .shtml
    AddOutputFilter INCLUDES .shtml
</IfModule>
AddDefaultCharset UTF-8
<IfModule mime_magic_module>
    MIMEMagicFile conf/magic
</IfModule>
EnableSendfile on
IndexOptions FancyIndexing VersionSort NameWidth=* HTMLTable Charset=UTF-8
AddIconByEncoding (CMP,/icons/compressed.gif) x-compress x-gzip
AddIconByType (TXT,/icons/text.gif) text/*
AddIconByType (IMG,/icons/image2.gif) image/*
AddIconByType (SND,/icons/sound2.gif) audio/*
AddIconByType (VID,/icons/movie.gif) video/*
AddIcon /icons/binary.gif .bin .exe
AddIcon /icons/binhex.gif .hqx
AddIcon /icons/tar.gif .tar
AddIcon /icons/world2.gif .wrl .wrl.gz .vrml .vrm .iv
AddIcon /icons/compressed.gif .Z .z .tgz .gz .zip
AddIcon /icons/a.gif .ps .ai .eps
AddIcon /icons/layout.gif .html .shtml .htm .pdf
AddIcon /icons/text.gif .txt
AddIcon /icons/c.gif .c
AddIcon /icons/p.gif .pl .py
AddIcon /icons/f.gif .for
AddIcon /icons/dvi.gif .dvi
AddIcon /icons/uuencoded.gif .uu
AddIcon /icons/script.gif .conf .sh .shar .csh .ksh .tcl
AddIcon /icons/tex.gif .tex
AddIcon /icons/bomb.gif core
AddIcon /icons/back.gif ..
AddIcon /icons/hand.right.gif README
AddIcon /icons/folder.gif ^^DIRECTORY^^
AddIcon /icons/blank.gif ^^BLANKICON^^
DefaultIcon /icons/unknown.gif
HeaderName HEADER.html
IndexIgnore .??* *~ *# HEADER* RCS CVS *,v *,t
AddLanguage ca .ca
AddLanguage cs .cz .cs
AddLanguage da .dk
AddLanguage de .de
AddLanguage el .el
AddLanguage en .en
AddLanguage eo .eo
AddLanguage es .es
AddLanguage et .et
AddLanguage fr .fr
AddLanguage he .he
AddLanguage hr .hr
AddLanguage it .it
AddLanguage ja .ja
AddLanguage ko .ko
AddLanguage ltz .ltz
AddLanguage nl .nl
AddLanguage nn .nn
AddLanguage no .no
AddLanguage pl .po
AddLanguage pt .pt
AddLanguage pt-BR .pt-br
AddLanguage ru .ru
AddLanguage sv .sv
AddLanguage zh-CN .zh-cn
AddLanguage zh-TW .zh-tw
LanguagePriority en ca cs da de el eo es et fr he hr it ja ko ltz nl nn no pl pt pt-BR ru sv zh-CN zh-TW
ForceLanguagePriority Prefer Fallback
AddDefaultCharset UTF-8
AddType application/x-compress .Z
AddType application/x-gzip .gz .tgz
AddType application/x-x509-ca-cert .crt
AddType application/x-pkcs7-crl    .crl
AddHandler type-map var
AddType text/html .shtml
AddOutputFilter INCLUDES .shtml
BrowserMatch "Mozilla/2" nokeepalive
BrowserMatch "MSIE 4\.0b2;" nokeepalive downgrade-1.0 force-response-1.0
BrowserMatch "RealPlayer 4\.0" force-response-1.0
BrowserMatch "Java/1\.0" force-response-1.0
BrowserMatch "JDK/1\.0" force-response-1.0
BrowserMatch "Microsoft Data Access Internet Publishing Provider" redirect-carefully
BrowserMatch "MS FrontPage" redirect-carefully
BrowserMatch "^WebDrive" redirect-carefully
BrowserMatch "^WebDAVFS/1.[0123]" redirect-carefully
BrowserMatch "^gnome-vfs/1.0" redirect-carefully
BrowserMatch "^XML Spy" redirect-carefully
BrowserMatch "^Dreamweaver-WebDAV-SCM1" redirect-carefully
IncludeOptional conf.d/*.conf
EOF

mv /etc/httpd/conf.d/welcome.conf /etc/httpd/conf.d/welcome.conf.bk

# 重启 httpd
systemctl restart httpd

firewall-cmd --add-service=http  --permanent
firewall-cmd --reload
Infee Fang
Infee Fang
互联网二手搬砖工