FTP
FTP(File Transfer Protocol文件传输协议)，用于Internet上的控制文件的双向传输。同时，它也是一个Application。基于不同的操作系统有不同的FTP应用程序，而所有这些应用程序都遵守同一种FTP协议以传输文件。在FTP的使用当中，用户经常遇到两个概念：”下载”（Download）和”上传”（Upload）。”下载”文件就是从远程主机拷贝文件至自己的计算机上；”上传”文件就是将文件从自己的计算机中拷贝至远程主机上。用Internet语言来说，用户可通过FTPClient向(从)FTPServer上传(下载)文件。
FTP也是一个C/S架构。用户通过一个支持FTP协议的客户机程序，连接到在远程主机上的FTP服务器程序。用户通过客户机程序向服务器程序发出命令，服务器程序执行用户所发出的命令，并将执行的结果返回到客户机。比如说，用户发出一条命令，要求服务器向用户传送某一个文件的一份拷贝，服务器会响应这条命令，将指定文件送至用户的机器上。客户机程序代表用户接收到这个文件，将其存放在用户目录中。
TCP/IP协议中，FTP标准命令TCP端口号为21，Port方式数据端口为20。FTP的任务是从一台计算机将文件传送到另一台计算机，不受操作系统的限制。
FTPServer访问权限类型：匿名用户、虚拟用户、本地用户
FTP Server
FTPServer Support anonymous user，local user，Virtual user between share date.
Attention：But in the same computer, the virtual user and local user config can’t exist at the same time.
ServicePort：
a. TCP 21：Control commands transmission port.
b. TCP 20：Date transmission port.
Software：vsftpd
serviceName：vsftpd
User permission control file：
a. /etc/vsftpd/ftpuser –> deny login user,have higher priority
b. /etc/vsftpd/user_list –> only allow login user
FTP configuration
Global config
listen=YES #Use independent type to Listen into service
listen_address=ip #Assign listenIP
listen_port=21
ftp_date_port=20
write_enable=YES #whether upload
download_enable=YES #whether download
userlist_enable=YES #whether use user_list file
max_clients=0 #client connect conunt,0 measing is no limit.
pasv_enable=YES
pasv_min_port=portNumber #passivity(PASV) min float portNumber,FTPServer will proactive(PORT) use TCP20 port to connection client's PASV port(1025-65535).On the contrary, too.
pasv_max_poer=portNumber
data_connection_timeout=120 #connection timeout
- 1
- 2
- 3
- 4
- 5
- 6
- 7
- 8
- 9
- 10
- 11
- 12
- 1
- 2
- 3
- 4
- 5
- 6
- 7
- 8
- 9
- 10
- 11
- 12
Anonymous user FTP Config
vim /etc/vsftpd/vsftpd.conf
anonymous_enable=YES #open anonymous login permissions
anon_umask=022 #anonymous user upload file's umask and anonymous user use ftp account to upload the file, use other account to download file. Anonymous user default support download file.
anon_root=/var/ftp #root directory after login --> the root directory cannot own 'rwx' permission and both owners and owning group are 'root'.
anon_upload_enable=YES #allow upload file
anon_mkdir_wirte_enable=YES #allow mkdir
anon_other_write_enable=YES #allow edit,delete,move the file
- 1
- 2
- 3
- 4
- 5
- 6
- 1
- 2
- 3
- 4
- 5
- 6
Attention：要实现匿名的下载，修改，删除，创建时，不可以修改FTP根目录的权限和属主，但是可以在根目录下创建AnonymousDir，并将其属主:属组修改为ftp:root，目录权限为757(出于安全的考虑)。
Virtual user FTP
step1. Create virtual user register DB file.
touch vuser.list
- 1
- 1
vim vuser.list
userName
userPasswd
- 1
- 2
- 1
- 2
step2. Convert the format of userDB file to Berkey DB.
db_load -T -t hash -f vuser.list vuser.db
chmod 600 vuser.*
- 1
- 2
- 1
- 2
step3. Create FTP root file also virtual user mapped as system user.
useradd -d /var/ftp/soft -s /sbin/nologin virtual
-d #specify virtual's homeDirectory
-S #specify virtual's shell
virtual #All virtual user will mapped as system user when they login.
- 1
- 2
- 3
- 4
- 1
- 2
- 3
- 4
虚拟用户上传时使用virtual用户的身份来进行，其宿主目录为/var/ftp/soft
chmod 755 /var/ftp/soft #Home directory permission decided what can the virtual user do in the FTP share home directory.
- 1
- 1
step4. Create PAM authentication file to support virtual user login.(PAM Pluggable authentication modules)
vim /etc/pam.d/vsftpd.vu
auth required pam.userdb.so db=/etc/vsftpd/vuser #identity authentication specify vuser.db file
account required pam.userdb.so db=/etc/vsftpd/vuser #identity verification
- 1
- 2
- 1
- 2
step5. Edit the vsftp.conf file
guest_enable=YES
guest_username=virtual #specify virtual user mapped system user
pam_service_name=vsftpd.vu #PAM authentication file,localUser's PAM is vsftpd. So localUser and virtualUser can't exist at the same time.
- 1
- 2
- 3
- 1
- 2
- 3
step6. Set the specific permission for virtualUser.
vim /etc/vsftpd/vsftpd.conf
user_config_dir=/etc/vsftpd/vusers_dir
mkdir /etc/vsftpd/vuser_dir
- 1
- 2
- 1
- 2
vim /etc/vsftpd/vuser_dir/deradm
anon_ipload_enable=YES
anon_mkdir_write_enable=YES
anon_other_write_enable=YES
local_eoor=/var/market #specify virtual user home directory.
Attention:If virtual user want to get the rwx permission in directory, we can set permission of 757 to the directory.Because the virtual user use the O(other)identity to access the directory.And we could be change the ownUser to ftp.
- 1
- 2
- 3
- 4
- 5
- 1
- 2
- 3
- 4
- 5
Local user FTP
Edit the config file
vim /etc/vsftpd/vsftpd.conf
local_enable=YES
local_root=/var/ftp
chroot_local_user=yes #localUser's home directory limit
chroot_list_enable=yes
chroot_list_file=/etc/vsftpd/chroot_list转载：http://blog.csdn.net/jmilk/article/details/50184877
