实验拓扑：
Linux Client
-----RHEL5.9（vmnet1）----------（vmnet1）
Win7 Client
实验一：测试默认安装vsftpd的结果
匿名用户与本地用户都可以登录
匿名用户登录到/var/ftp，只能下载不能上传
本地用户登录到本地用户的家目录，可以上传和下载
[[email protected] ~]# rpm -q vsftpd //检查软件包是否安装
package vsftpd is not installed
[[email protected] ~]# cd /misc/cd/Server
[[email protected] Server]# ls *vsftpd*
vsftpd-2.0.5-28.el5.x86_64.rpm
[[email protected] Server]# rpm -ivh vsftpd-2.0.5-28.el5.x86_64.rpm
[[email protected] Server]# service vsftpd restart //启动服务
[[email protected] Server]# chkconfig vsftpd on //开机启动
[[email protected] Server]# ls -lh /etc > /var/ftp/pub/etc.txt
[[email protected] ~]# useradd user1
[[email protected] ~]# echo "123qwe" | passwd --stdin user1
Changing password for user user1.
passwd: all authentication tokens updated successfully.
验证：（客户端测试）
[[email protected] ~]# ftp 192.168.10.253
Connected to 192.168.10.253.
220 (vsFTPd 2.0.5)
530 Please login with USER and PASS.
530 Please login with USER and PASS.
KERBEROS_V4 rejected as an authentication type
Name (192.168.10.253:root): ftp
331 Please specify the password.
Password:
230 Login successful. //登录成功
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> cd pub
250 Directory successfully changed.
ftp> ls
227 Entering Passive Mode (192,168,10,253,75,98)
150 Here comes the directory listing.
-rw-r--r-- 1 0 0 11627 Jun 13 02:04 etc.txt
226 Directory send OK.
ftp> get etc.txt //下载一个文件
local: etc.txt remote: etc.txt
227 Entering Passive Mode (192,168,10,253,136,141)
150 Opening BINARY mode data connection for etc.txt (11627 bytes).
226 File send OK.
11627 bytes received in 0.00082 seconds (1.4e+04 Kbytes/s)
ftp> !ls //加!表示在本地操作命令,不加表示在ftp服务器操作
anaconda-ks.cfg etc.txt install.log.syslog
Desktop install.log
ftp> put install.log
local: install.log remote: install.log
227 Entering Passive Mode (192,168,10,253,46,17)
550 Permission denied. //匿名用户无上传权限
ftp> quit
[[email protected] ~]# lftp 192.168.10.253
lftp 192.168.10.253:~> user user1
口令:
lftp [email protected]:~> put install.log
...
实验二：
禁止匿名用户登录
修改FTP默认端口为2121
禁锢本地用户在自己家目录
实验步骤：
[[email protected] ~]# cd /etc/vsftpd/
[[email protected] vsftpd]# cp vsftpd.conf vsftpd.conf.bak
[[email protected] vsftpd]# vim vsftpd.conf
...
12 anonymous_enable=NO //关闭匿名用户登录
...
119 listen_port=2121 //端口修改为2121
120 chroot_local_user=YES //禁锢本地用户在家目录
[[email protected] vsftpd]# service vsftpd restart
[[email protected] vsftpd]# netstat -tulnp | grep vsftpd //查看监听端口是否生
效
tcp 0 0 0.0.0.0:2121 0.0.0.0:* LISTEN 4705/vsftpd
测试：
ftp 192.168.10.253 2121
实验三：验证黑/白名单
/etc/vsftpd/ftpusers 黑名单
/etc/vsftpd/user_list //黑白名单
[[email protected] ~]# useradd jerry //添加测试用户
[[email protected] ~]# useradd mike
[[email protected] ~]# echo "123qwe" | passwd --stdin jerry
Changing password for user jerry.
passwd: all authentication tokens updated successfully.
[[email protected] ~]# echo "123qwe" | passwd --stdin mike
Changing password for user mike.
passwd: all authentication tokens updated successfully.
[[email protected] ~]# grep user1 /etc/vsftpd/ftpusers
user1
//请问user1能否登录FTP???
[[email protected] ~]# grep jerry /etc/vsftpd/user_list
jerry
//请问jerry能否登录FTP???
[[email protected] ~]# vim /etc/vsftpd/vsftpd.conf
...
121 userlist_deny=NO //启用白名单
[[email protected] ~]# service vsftpd restart
//请问user1、jerry、mike谁可以登录？？？
实验完毕，请将主配置文件121 userlist_deny=NO注释，将user_list和 ftpusers
里面添加的账户去掉
实验四：
本地用户登录到/data/ftproot目录
up上传/下载，down仅下载。拒绝所有用户登录包括匿名用户
最多20个并发，每IP地址最多2个并发
限制下载速度限制为100KB/s
[[email protected] ~]# mkdir -p /data/ftproot
[[email protected] ~]# useradd up
[[email protected] ~]# useradd down
[[email protected] ~]# echo "123qwe" | passwd --stdin up
[[email protected] ~]# echo "123qwe" | passwd --stdin down
[[email protected] ~]# vim /etc/vsftpd/vsftpd.conf
...
12 anonymous_enable=NO
...
18 write_enable=YES //允许写入
...
117 userlist_enable=YES //启用user_list
...
121 userlist_deny=NO //设置user_list为白名单
122 local_root=/data/ftproot //本地用户登录的跟路径
123 max_clients=20 //最多允许20个客户端同时访问
124 max_per_ip=2 //同一个IP只允许两个链接
125 local_max_rate=100000 //本地用户上传速度单位为字节/秒
[[email protected] ~]# service vsftpd restart
[[email protected] ~]# setfacl -m u:up:rwx /data/ftproot/
[[email protected] ~]# tail -n 2 /etc/vsftpd/user_list
up
down
[[email protected] ~]# dd if=/dev/zero of=/data/ftproot/local.tgz bs=1M
count=1000
测试：
[[email protected] ~]# wget ftp://up:[email protected]:2121/local.tgz
补充：
匿名用户登录对共享根目录禁止有写入权限，否则禁止匿名账户登录！
思考题：
系统有lily、mike、user1用户，请问以下情况，谁可以登录FTP。(拒绝优先)
[[email protected] ~]# grep lily /etc/vsftpd/ftpusers
lily
[[email protected] ~]# grep mike /etc/vsftpd/ftpusers
mike
[[email protected] ~]# grep mike /etc/vsftpd/user_list
mike
[[email protected] ~]# grep userlist_deny /etc/vsftpd/vsftpd.conf
userlist_deny=NO
linux下vsftp服务搭建,布布扣,bubuko.com