说明

  • ftp 是明文传输
  • 推荐使用 vsftpd.

使用的端口

  • 20: 数据传输, 主动
  • 21: 命令
  • 22: 数据传输, 被动 (具体根据配置来, 可能是随机的)

主动式

image.png

被动式

  • 如果使用被动式, 那么需要设置 vsftpd 打开的端口范围, 并且注意防火墙

image.png

vsftpd

安装

  1. $ sudo pacman -S vsftpd

配置文件

archlinux 的 vsftpd 的配置文件路径与教程中的不一样. 底下是教程中的路径.

  • /etc/vsftpd/vsftpd.conf : vsftpd 的配置文件
  • /etc/pam.d/vsftpd : vsftpd 使用 pam 模块的配置, 限制某些用户使用 vsftpd
  • /etc/vsftpd/ftpusers : pam 限制的用户列表
  • /etc/vsftpd/user_list : vsftpd 自己的限制用户功能配置
  • /etc/vsftpd/chroot_list : 需要手动创建该文件. 启用 chroot 的用户配置
  • /var/ftp/ : 匿名者登录的根目录

启动模式

  • stand alone: 直接启动, 常驻内存
  • super daemon: 由其它程序管理 vsftpd, 非常驻内存, 所以连接慢

配置参考

vsftpd:

  1. # Example config file /etc/vsftpd/vsftpd.conf
  2. #
  3. # The default compiled in settings are fairly paranoid. This sample file
  4. # loosens things up a bit, to make the ftp daemon more usable.
  5. # Please see vsftpd.conf.5 for all compiled in defaults.
  6. #
  7. # READ THIS: This example file is NOT an exhaustive list of vsftpd options.
  8. # Please read the vsftpd.conf.5 manual page to get a full idea of vsftpd's
  9. # capabilities.
  10. #
  11. # Allow anonymous FTP? (Beware - allowed by default if you comment this out).
  12. anonymous_enable=NO
  14. #
  15. # Uncomment this to allow local users to log in.
  16. # When SELinux is enforcing check for SE bool ftp_home_dir
  17. local_enable=YES
  18. #
  19. # Uncomment this to enable any form of FTP write command.
  20. write_enable=YES
  21. #
  22. # Default umask for local users is 077. You may wish to change this to 022,
  23. # if your users expect that (022 is used by most other ftpd's)
  24. local_umask=022
  25. #
  26. # Uncomment this to allow the anonymous FTP user to upload files. This only
  27. # has an effect if the above global write enable is activated. Also, you will
  28. # obviously need to create a directory writable by the FTP user.
  29. # When SELinux is enforcing check for SE bool allow_ftpd_anon_write, allow_ftpd_full_access
  30. #anon_upload_enable=YES
  31. #
  32. # Uncomment this if you want the anonymous FTP user to be able to create
  33. # new directories.
  34. #anon_mkdir_write_enable=YES
  35. #
  36. # Activate directory messages - messages given to remote users when they
  37. # go into a certain directory.
  38. dirmessage_enable=YES
  39. # .message 文件也行?
  40. banner_file=/etc/vsftpd/welcome.txt
  41. #
  42. # Activate logging of uploads/downloads.
  43. xferlog_enable=YES
  44. #
  45. # Make sure PORT transfer connections originate from port 20 (ftp-data).
  46. connect_from_port_20=NO
  47. #
  48. # If you want, you can arrange for uploaded anonymous files to be owned by
  49. # a different user. Note! Using "root" for uploaded files is not
  50. # recommended!
  51. #chown_uploads=YES
  52. #chown_username=whoever
  53. #
  54. # You may override where the log file goes if you like. The default is shown
  55. # below.
  56. #xferlog_file=/var/log/xferlog
  57. #
  58. # If you want, you can have your log file in standard ftpd xferlog format.
  59. # Note that the default log file location is /var/log/xferlog in this case.
  60. xferlog_std_format=YES
  61. #
  62. # You may change the default value for timing out an idle session.
  63. #idle_session_timeout=600
  64. #
  65. # You may change the default value for timing out a data connection.
  66. #data_connection_timeout=120
  67. #
  68. # It is recommended that you define on your system a unique user which the
  69. # ftp server can use as a totally isolated and unprivileged user.
  70. #nopriv_user=ftpsecure
  71. #
  72. # Enable this and the server will recognise asynchronous ABOR requests. Not
  73. # recommended for security (the code is non-trivial). Not enabling it,
  74. # however, may confuse older FTP clients.
  75. #async_abor_enable=YES
  76. #
  77. # By default the server will pretend to allow ASCII mode but in fact ignore
  78. # the request. Turn on the below options to have the server actually do ASCII
  79. # mangling on files when in ASCII mode. The vsftpd.conf(5) man page explains
  80. # the behaviour when these options are disabled.
  81. # Beware that on some FTP servers, ASCII support allows a denial of service
  82. # attack (DoS) via the command "SIZE /big/file" in ASCII mode. vsftpd
  83. # predicted this attack and has always been safe, reporting the size of the
  84. # raw file.
  85. # ASCII mangling is a horrible feature of the protocol.
  86. #ascii_upload_enable=YES
  87. #ascii_download_enable=YES
  88. #
  89. # You may fully customise the login banner string:
  90. #ftpd_banner=Welcome to blah FTP service.
  91. #
  92. # You may specify a file of disallowed anonymous e-mail addresses. Apparently
  93. # useful for combatting certain DoS attacks.
  94. #deny_email_enable=YES
  95. # (default follows)
  96. #banned_email_file=/etc/vsftpd/banned_emails
  97. #
  98. # You may specify an explicit list of local users to chroot() to their home
  99. # directory. If chroot_local_user is YES, then this list becomes a list of
  100. # users to NOT chroot().
  101. # (Warning! chroot'ing can be very dangerous. If using chroot, make sure that
  102. # the user does not have write access to the top level directory within the
  103. # chroot)
  104. chroot_local_user=YES
  105. chroot_list_enable=YES
  106. # (default follows)
  107. chroot_list_file=/etc/vsftpd/chroot_list
  108. #
  109. # You may activate the "-R" option to the builtin ls. This is disabled by
  110. # default to avoid remote users being able to cause excessive I/O on large
  111. # sites. However, some broken FTP clients such as "ncftp" and "mirror" assume
  112. # the presence of the "-R" option, so there is a strong case for enabling it.
  113. #ls_recurse_enable=YES
  114. #
  115. # When "listen" directive is enabled, vsftpd runs in standalone mode and
  116. # listens on IPv4 sockets. This directive cannot be used in conjunction
  117. # with the listen_ipv6 directive.
  118. # 启动 stand alone
  119. listen=YES
  120. #
  121. # This directive enables listening on IPv6 sockets. By default, listening
  122. # on the IPv6 "any" address (::) will accept connections from both IPv6
  123. # and IPv4 clients. It is not necessary to listen on *both* IPv4 and IPv6
  124. # sockets. If you want that (perhaps because you want to listen on specific
  125. # addresses) then you must run two copies of vsftpd with two configuration
  126. # files.
  127. # Make sure, that one of the listen options is commented !!
  128. listen_ipv6=NO
  130. pam_service_name=vsftpd
  132. userlist_enable=YES
  133. # 黑名单模式?
  134. userlist_deny=YES
  135. userlist_file=/etc/vsftpd/user_list
  137. tcp_wrappers=YES
  139. use_localtime=YES
  141. # 启用被动模式
  142. pasv_enable=YES
  143. pasv_min_port=65400
  144. pasv_max_port=65410
  146. # chroot 不让 home 具有写权限, 添加如下设置避免500错误
  147. allow_writeable_chroot=YES

chroot_list:

  • 该文件配置 “不 chroot” 的用户
  • 上面的配置文件启用了 chroot, chroot_list 中的用户不被 chroot
  • 这是个空文件, 必须要有

注意被动模式的端口号.

本地 ftp

  1. # Example config file /etc/vsftpd.conf
  2. #
  3. # The default compiled in settings are fairly paranoid. This sample file
  4. # loosens things up a bit, to make the ftp daemon more usable.
  5. # Please see vsftpd.conf.5 for all compiled in defaults.
  6. #
  7. # READ THIS: This example file is NOT an exhaustive list of vsftpd options.
  8. # Please read the vsftpd.conf.5 manual page to get a full idea of vsftpd's
  9. # capabilities.
  10. #
  11. # Allow anonymous FTP? (Beware - allowed by default if you comment this out).
  12. anonymous_enable=NO
  13. #
  14. # Uncomment this to allow local users to log in.
  15. local_enable=YES
  16. #
  17. # Uncomment this to enable any form of FTP write command.
  18. write_enable=YES
  19. #
  20. # Default umask for local users is 077. You may wish to change this to 022,
  21. # if your users expect that (022 is used by most other ftpd's)
  22. local_umask=022
  23. #
  24. # Uncomment this to allow the anonymous FTP user to upload files. This only
  25. # has an effect if the above global write enable is activated. Also, you will
  26. # obviously need to create a directory writable by the FTP user.
  27. #anon_upload_enable=YES
  28. #
  29. # Uncomment this if you want the anonymous FTP user to be able to create
  30. # new directories.
  31. #anon_mkdir_write_enable=YES
  32. #
  33. # Activate directory messages - messages given to remote users when they
  34. # go into a certain directory.
  35. dirmessage_enable=YES
  36. #
  37. # Activate logging of uploads/downloads.
  38. xferlog_enable=YES
  39. #
  40. # Make sure PORT transfer connections originate from port 20 (ftp-data).
  41. connect_from_port_20=NO
  42. #
  43. # If you want, you can arrange for uploaded anonymous files to be owned by
  44. # a different user. Note! Using "root" for uploaded files is not
  45. # recommended!
  46. #chown_uploads=YES
  47. #chown_username=whoever
  48. #
  49. # You may override where the log file goes if you like. The default is shown
  50. # below.
  51. #xferlog_file=/var/log/vsftpd.log
  52. #
  53. # If you want, you can have your log file in standard ftpd xferlog format.
  54. # Note that the default log file location is /var/log/xferlog in this case.
  55. #xferlog_std_format=YES
  56. #
  57. # You may change the default value for timing out an idle session.
  58. #idle_session_timeout=600
  59. #
  60. # You may change the default value for timing out a data connection.
  61. #data_connection_timeout=120
  62. #
  63. # It is recommended that you define on your system a unique user which the
  64. # ftp server can use as a totally isolated and unprivileged user.
  65. #nopriv_user=ftpsecure
  66. #
  67. # Enable this and the server will recognise asynchronous ABOR requests. Not
  68. # recommended for security (the code is non-trivial). Not enabling it,
  69. # however, may confuse older FTP clients.
  70. #async_abor_enable=YES
  71. #
  72. # By default the server will pretend to allow ASCII mode but in fact ignore
  73. # the request. Turn on the below options to have the server actually do ASCII
  74. # mangling on files when in ASCII mode.
  75. # Beware that on some FTP servers, ASCII support allows a denial of service
  76. # attack (DoS) via the command "SIZE /big/file" in ASCII mode. vsftpd
  77. # predicted this attack and has always been safe, reporting the size of the
  78. # raw file.
  79. # ASCII mangling is a horrible feature of the protocol.
  80. #ascii_upload_enable=YES
  81. #ascii_download_enable=YES
  82. #
  83. # You may fully customise the login banner string:
  84. #ftpd_banner=Welcome to blah FTP service.
  85. #
  86. # You may specify a file of disallowed anonymous e-mail addresses. Apparently
  87. # useful for combatting certain DoS attacks.
  88. #deny_email_enable=YES
  89. # (default follows)
  90. #banned_email_file=/etc/vsftpd.banned_emails
  91. #
  92. # You may specify an explicit list of local users to chroot() to their home
  93. # directory. If chroot_local_user is YES, then this list becomes a list of
  94. # users to NOT chroot().
  95. # (Warning! chroot'ing can be very dangerous. If using chroot, make sure that
  96. # the user does not have write access to the top level directory within the
  97. # chroot)
  98. chroot_local_user=YES
  99. chroot_list_enable=YES
  100. # (default follows)
  101. chroot_list_file=/etc/vsftpd/chroot_list
  102. #
  103. # You may activate the "-R" option to the builtin ls. This is disabled by
  104. # default to avoid remote users being able to cause excessive I/O on large
  105. # sites. However, some broken FTP clients such as "ncftp" and "mirror" assume
  106. # the presence of the "-R" option, so there is a strong case for enabling it.
  107. #ls_recurse_enable=YES
  108. #
  109. # When "listen" directive is enabled, vsftpd runs in standalone mode and
  110. # listens on IPv4 sockets. This directive cannot be used in conjunction
  111. # with the listen_ipv6 directive.
  112. listen=YES
  113. #
  114. # This directive enables listening on IPv6 sockets. To listen on IPv4 and IPv6
  115. # sockets, you must run two copies of vsftpd with two configuration files.
  116. # Make sure, that one of the listen options is commented !!
  117. listen_ipv6=NO
  119. # Set own PAM service name to detect authentication settings specified
  120. # for vsftpd by the system package.
  121. pam_service_name=vsftpd
  122. allow_writeable_chroot=YES
  124. pasv_enable=YES
  125. pasv_min_port=65400
  126. pasv_max_port=65410
  128. seccomp_sandbox=NO
  129. isolate_network=NO

启用加密传输的配置

  1. 检查 vsftpd 是否支持
  1. $ ldd $(which vsftpd) | grep ssl
  2.         libssl.so.10 => /lib64/libssl.so.10 (0x00007f629b7ce000)
  1. 创建证书
    1. 输入各种信息
    2. 会生成 vsftpd.pem 文件
  1. $ cd /etc/pki/tls/certs
  2. $ make vsftpd.pem
  1. 最后的配置文件
    1. ssl 配置在最底部
  1. # Example config file /etc/vsftpd/vsftpd.conf
  2. #
  3. # The default compiled in settings are fairly paranoid. This sample file
  4. # loosens things up a bit, to make the ftp daemon more usable.
  5. # Please see vsftpd.conf.5 for all compiled in defaults.
  6. #
  7. # READ THIS: This example file is NOT an exhaustive list of vsftpd options.
  8. # Please read the vsftpd.conf.5 manual page to get a full idea of vsftpd's
  9. # capabilities.
  10. #
  11. # Allow anonymous FTP? (Beware - allowed by default if you comment this out).
  12. anonymous_enable=NO
  14. #
  15. # Uncomment this to allow local users to log in.
  16. # When SELinux is enforcing check for SE bool ftp_home_dir
  17. local_enable=YES
  18. #
  19. # Uncomment this to enable any form of FTP write command.
  20. write_enable=YES
  21. #
  22. # Default umask for local users is 077. You may wish to change this to 022,
  23. # if your users expect that (022 is used by most other ftpd's)
  24. local_umask=022
  25. #
  26. # Uncomment this to allow the anonymous FTP user to upload files. This only
  27. # has an effect if the above global write enable is activated. Also, you will
  28. # obviously need to create a directory writable by the FTP user.
  29. # When SELinux is enforcing check for SE bool allow_ftpd_anon_write, allow_ftpd_full_access
  30. #anon_upload_enable=YES
  31. #
  32. # Uncomment this if you want the anonymous FTP user to be able to create
  33. # new directories.
  34. #anon_mkdir_write_enable=YES
  35. #
  36. # Activate directory messages - messages given to remote users when they
  37. # go into a certain directory.
  38. dirmessage_enable=YES
  39. # .message 文件也行?
  40. banner_file=/etc/vsftpd/welcome.txt
  41. #
  42. # Activate logging of uploads/downloads.
  43. xferlog_enable=YES
  44. #
  45. # Make sure PORT transfer connections originate from port 20 (ftp-data).
  46. connect_from_port_20=NO
  47. #
  48. # If you want, you can arrange for uploaded anonymous files to be owned by
  49. # a different user. Note! Using "root" for uploaded files is not
  50. # recommended!
  51. #chown_uploads=YES
  52. #chown_username=whoever
  53. #
  54. # You may override where the log file goes if you like. The default is shown
  55. # below.
  56. #xferlog_file=/var/log/xferlog
  57. #
  58. # If you want, you can have your log file in standard ftpd xferlog format.
  59. # Note that the default log file location is /var/log/xferlog in this case.
  60. xferlog_std_format=YES
  61. #
  62. # You may change the default value for timing out an idle session.
  63. #idle_session_timeout=600
  64. #
  65. # You may change the default value for timing out a data connection.
  66. #data_connection_timeout=120
  67. #
  68. # It is recommended that you define on your system a unique user which the
  69. # ftp server can use as a totally isolated and unprivileged user.
  70. #nopriv_user=ftpsecure
  71. #
  72. # Enable this and the server will recognise asynchronous ABOR requests. Not
  73. # recommended for security (the code is non-trivial). Not enabling it,
  74. # however, may confuse older FTP clients.
  75. #async_abor_enable=YES
  76. #
  77. # By default the server will pretend to allow ASCII mode but in fact ignore
  78. # the request. Turn on the below options to have the server actually do ASCII
  79. # mangling on files when in ASCII mode. The vsftpd.conf(5) man page explains
  80. # the behaviour when these options are disabled.
  81. # Beware that on some FTP servers, ASCII support allows a denial of service
  82. # attack (DoS) via the command "SIZE /big/file" in ASCII mode. vsftpd
  83. # predicted this attack and has always been safe, reporting the size of the
  84. # raw file.
  85. # ASCII mangling is a horrible feature of the protocol.
  86. #ascii_upload_enable=YES
  87. #ascii_download_enable=YES
  88. #
  89. # You may fully customise the login banner string:
  90. #ftpd_banner=Welcome to blah FTP service.
  91. #
  92. # You may specify a file of disallowed anonymous e-mail addresses. Apparently
  93. # useful for combatting certain DoS attacks.
  94. #deny_email_enable=YES
  95. # (default follows)
  96. #banned_email_file=/etc/vsftpd/banned_emails
  97. #
  98. # You may specify an explicit list of local users to chroot() to their home
  99. # directory. If chroot_local_user is YES, then this list becomes a list of
  100. # users to NOT chroot().
  101. # (Warning! chroot'ing can be very dangerous. If using chroot, make sure that
  102. # the user does not have write access to the top level directory within the
  103. # chroot)
  104. chroot_local_user=YES
  105. chroot_list_enable=YES
  106. # (default follows)
  107. chroot_list_file=/etc/vsftpd/chroot_list
  108. #
  109. # You may activate the "-R" option to the builtin ls. This is disabled by
  110. # default to avoid remote users being able to cause excessive I/O on large
  111. # sites. However, some broken FTP clients such as "ncftp" and "mirror" assume
  112. # the presence of the "-R" option, so there is a strong case for enabling it.
  113. #ls_recurse_enable=YES
  114. #
  115. # When "listen" directive is enabled, vsftpd runs in standalone mode and
  116. # listens on IPv4 sockets. This directive cannot be used in conjunction
  117. # with the listen_ipv6 directive.
  118. # 启动 stand alone
  119. listen=YES
  120. #
  121. # This directive enables listening on IPv6 sockets. By default, listening
  122. # on the IPv6 "any" address (::) will accept connections from both IPv6
  123. # and IPv4 clients. It is not necessary to listen on *both* IPv4 and IPv6
  124. # sockets. If you want that (perhaps because you want to listen on specific
  125. # addresses) then you must run two copies of vsftpd with two configuration
  126. # files.
  127. # Make sure, that one of the listen options is commented !!
  128. listen_ipv6=NO
  130. pam_service_name=vsftpd
  132. userlist_enable=YES
  133. # 黑名单模式?
  134. userlist_deny=YES
  135. userlist_file=/etc/vsftpd/user_list
  137. tcp_wrappers=YES
  139. use_localtime=YES
  141. # 启用被动模式
  142. pasv_enable=YES
  143. pasv_min_port=65400
  144. pasv_max_port=65410
  146. # chroot 不让 home 具有写权限, 添加如下设置避免500错误
  147. allow_writeable_chroot=YES
  149. # ssl 支持
  150. ssl_enable=YES
  151. # 不允许匿名登录使用 ssl
  152. allow_anon_ssl=NO
  153. # 加密传输的数据
  154. force_local_data_ssl=YES
  155. # 加密登录数据
  156. force_local_logins_ssl=YES
  157. # 支持 tls
  158. ssl_tlsv1=YES
  159. ssl_sslv2=NO
  160. ssl_sslv3=NO
  161. # 证书位置
  162. rsa_cert_file=/etc/vsftpd/vsftpd.pem
  163. require_ssl_reuse=no

使用 docker 部署 vsftpd

  1. $ docker run -d -p 20:20 -p 21:21 -p 21100-21110:21100-21110 -e FTP_USER=myftp -e FTP_PASS=mypass -e PASV_ADDRESS=127.0.0.1 -e PASV_MIN_PORT=21100 -e PASV_MAX_PORT=21110 --name vsftpd --restart=always fauria/vsftpd

参考

其它错误

  1. 500 OOPS: priv_sock_get_cmd
  3. seccomp_sandbox=NO
  4. isolate_network=NO