Centos7搭建FTP、匿名和虚拟用户访问和各种报错

短命女 2023-10-11 11:47 29阅读 0赞

### Centos7搭建FTP，支持浏览器直接访问服务器资源文件 ###

*  安装配置
 *   *   *  安装
         *  匿名哟灵活-不能删除修改
         *   *   *  vsftpd.conf
                 *  目录权限
                 *  防火墙策略
                 *  被动模式
         *  虚拟用户-可删除修改
         *  日志
         *  试验
 *  其他
 *   *   *  用户类型
         *  被动与主动模式
         *  默认目录：/var/ftp
         *  umask、local\_umask
         *  常用命令
 *  报错
 *   *   *  1.centos7 550 create directory operation failed
         *  2.Job for vsftpd.service failed because the control process exited with error code. See "systemctl status vsftpd.service" and "journalctl -xe" for details.
         *   *   *  情况1：unrecognised variable in config file: nonymous\_enable
                 *  情况2：can only support ipv4 and ipv6 currently
         *  3.开启了匿名模式，但访问一直提示输入用户及密码
         *   *   *  情况1 原因参数不对造成，报错配置
                 *  情况2 把根目录/var/ftp权限不对
         *  文件夹登录上传 部分文件名乱码问题
         *  4.开防火墙后，客户端连接超时ERR\_CONNECTION\_TIMED\_OUT
 *  默认配置

# 安装配置 #

### 安装 ###

xshell连接服务器，下载安装vsftpd

[root@VM_5_17_centos ~]# yum -y install vsftpd

### 匿名哟灵活-不能删除修改 ###

##### vsftpd.conf #####

vim /etc/vsftpd/vsftpd.conf

anonymous_enable=YES
    # 若配置成000，则权限drwxr-xr-x -> drwxrwxrwx，匿名模式关系不大
    anon_umask=022
    anon_upload_enable=YES
    anon_mkdir_write_enable=YES
    # 修改、删除权限
    anon_other_write_enable=NO
    # 匿名、虚拟的目录 
    anon_root=/data/vsftpd/root/anon
    
    local_enable=YES
    write_enable=YES
    local_umask=022
    dirmessage_enable=YES
    xferlog_enable=YES
    connect_from_port_20=YES
    xferlog_std_format=YES
    listen=NO
    listen_ipv6=YES
    pam_service_name=vsftpd
    userlist_enable=YES
    tcp_wrappers=YES

##### 目录权限 #####

根目录755，下面的数据data目录777权限

chmod -R 755 /data/vsftpd/root/anon
    [root@VM_5_17_centos anon]# mkdir /data/vsftpd/root/anon/data
    [root@VM_5_17_centos anon]# chmod -R 777 /data/vsftpd/root/anon/data

根目录只能下载，但/data/vsftpd/root/anon/data可以上传、修改下载；

##### 防火墙策略 #####

firewall-cmd --zone=public --add-port=20/tcp --permanent
    firewall-cmd --zone=public --add-port=21/tcp --permanent

##### 被动模式 #####

> 默认的主动模式，开了防火墙后还是不行，所有尝试被动模式

# 配置文件添加
    port_enable=NO
    pasv_enable=YES
    pasv_min_port=65100
    pasv_max_port=65200

// 开放端口号，再重启防火墙、vsftpd
    [root@VM_5_17_centos anon]# firewall-cmd --zone=public --add-port=65100-65200/tcp --permanent
    [root@VM_5_17_centos anon]# firewall-cmd --reload
    [root@VM_5_17_centos anon]# firewall-cmd --list-ports
    20/tcp 21/tcp 65100-65200/tcp
    [root@VM_5_17_centos anon]# systemctl stop vsftpd
    [root@VM_5_17_centos anon]# systemctl start vsftpd

### 虚拟用户-可删除修改 ###

配置文件添加

# 虚拟用户
    chroot_local_user=YES
    ascii_upload_enable=YES
    ascii_download_enable=YES
    guest_enable=YES
    guest_username=vsftpd
    user_config_dir=/etc/vsftpd/userconf
    allow_writeable_chroot=YES
    # 虚拟用户删除、修改权限
    chmod_enable=YES
    virtual_use_local_privs=YES

其他修改

[root@VM_5_17_centos /]# useradd vsftpd -d /data/vsftpd/root/ -s /bin/false
    [root@VM_5_17_centos /]# vi /etc/vsftpd/loginusers.conf
    
    vsftpd1
    123456
    
    [root@VM_5_17_centos userconf]# db_load -T -t hash -f /etc/vsftpd/loginusers.conf /etc/vsftpd/loginusers.db
    [root@VM_5_17_centos userconf]# chmod 600 /etc/vsftpd/loginusers.db
    [root@VM_5_17_centos /]# vi /etc/pam.d/vsftpd
    
    #%PAM-1.0
    #session    optional     pam_keyinit.so    force revoke
    #auth       required    pam_listfile.so item=user sense=deny file=/etc/vsftpd/ftpusers onerr=succeed
    #auth       required    pam_shells.so
    #auth       include     password-auth
    #account    include     password-auth
    #session    required     pam_loginuid.so
    #session    include     password-auth
    
    auth       sufficient   /lib64/security/pam_userdb.so db=/etc/vsftpd/loginusers
    account    sufficient   /lib64/security/pam_userdb.so db=/etc/vsftpd/loginusers
    
    [root@VM_5_17_centos /]# mkdir /etc/vsftpd/userconf
    [root@VM_5_17_centos /]# vi /etc/vsftpd/userconf/vsftpd1
    
    local_root=/data/vsftpd/root/anon
    write_enable=YES

重启

systemctl restart vsftpd

### 日志 ###

# 日志
    use_localtime=YES
    dual_log_enable=YES
    vsftpd_log_file=/data/vsftpd/log/vsftpd.log
    ## 上传下载日志
    xferlog_enable=YES
    xferlog_std_format=YES
    xferlog_file=/data/vsftpd/log/xferlog

### 试验 ###

文件夹中分别用ftp://ip/、ftp://vsftpd1:123456@ip/登录  
最终用户名登录的可以删除、修改文件夹

# 其他 #

### 用户类型 ###

*  匿名用户。名为anonymous
 *  本地用户
 *  虚拟用户。安全，FTP服务器的专有用户，只能访问FTP服务器所提供的资源

### 被动与主动模式 ###

*  PORT主动。客户端向服务端连接后，客户端在本地打开了一个端口在等着服务器连接，数据连接通了。要开启21和20端口。
 *  PASV被动。客户端向服务端连接后，服务端在本地打开了一个端口在等着客户端连接，数据连接通了。要开启21端口和数据端口范围。

# 开启被动模式
    port_enable=NO
    pasv_enable=YES
    pasv_min_port=6000
    pasv_max_port=6100

// 防火墙策略
    firewall-cmd --zone=public --add-port=6000-6100/tcp --permanent

> 应该默认的是主动模式

### 默认目录：/var/ftp ###

### umask、local\_umask ###

*  umask=022。文件夹777-022=755,文件的话，则是用 666-022=644.
 *  umask=077。新建的目录 权限是700，文件的权限时 600
 *  默认情况下vsftp上传之后文件的权限是600，目录权限是700。本地用户local\_umask，虚拟用户anon\_umask

### 常用命令 ###

systemctl restart/start/stop vsftpd
    systemctl status vsftpd -l
    # 修改配置文件
    vim /etc/vsftpd/vsftpd.conf

local\_root=/var/www/html  
chroot\_local\_user=YES  
anon\_root=/var/www/html

注：local\_root 针对系统用户；anon\_root 针对匿名用户。

重新启动服务：

service vsftpd restart  
任何一个用户ftp登录到这个服务器上都会chroot到/var/www/html目录下。

# 报错 #

### 1.centos7 550 create directory operation failed ###

vim /etc/selinux/config
    
    # 关闭SELINUX
    SELINUX=disabled

// 给目录赋予权限
    chmod -R 777 目录

### 2.Job for vsftpd.service failed because the control process exited with error code. See “systemctl status vsftpd.service” and “journalctl -xe” for details. ###

原因比较多，systemctl status vsftpd -l查看详细

##### 情况1：unrecognised variable in config file: nonymous\_enable #####

[root@VM_5_17_centos network-scripts]# systemctl status vsftpd -l
    ● vsftpd.service - Vsftpd ftp daemon
       Loaded: loaded (/usr/lib/systemd/system/vsftpd.service; enabled; vendor preset: disabled)
       Active: failed (Result: exit-code) since Tue 2019-09-24 09:53:07 CST; 6s ago
      Process: 26014 ExecStart=/usr/sbin/vsftpd /etc/vsftpd/vsftpd.conf (code=exited, status=2)
     Main PID: 2535 (code=killed, signal=TERM)
    
    Sep 24 09:53:07 VM_5_17_centos systemd[1]: Starting Vsftpd ftp daemon...
    Sep 24 09:53:07 VM_5_17_centos systemd[1]: vsftpd.service: control process exited, code=exited status=2
    Sep 24 09:53:07 VM_5_17_centos vsftpd[26014]: 500 OOPS: unrecognised variable in config file: nonymous_enable
    Sep 24 09:53:07 VM_5_17_centos systemd[1]: Failed to start Vsftpd ftp daemon.
    Sep 24 09:53:07 VM_5_17_centos systemd[1]: Unit vsftpd.service entered failed state.
    Sep 24 09:53:07 VM_5_17_centos systemd[1]: vsftpd.service failed.

nonymous\_enable无法识别，应该为anonymous\_enable；

##### 情况2：can only support ipv4 and ipv6 currently #####

[root@VM_5_17_centos network-scripts]# systemctl status vsftpd -l
    ...
    Sep 24 09:53:56 VM_5_17_centos vsftpd[26102]: 500 OOPS: can only support ipv4 and ipv6 currently
    ...

listen=、listen\_ipv6需要有一个参数为YES

### 3.开启了匿名模式，但访问一直提示输入用户及密码 ###

##### 情况1 原因参数不对造成，报错配置 #####

anonymous_enable=YES
    local_enable=YES
    write_enable=YES
    local_umask=022
    dirmessage_enable=YES
    xferlog_enable=YES
    connect_from_port_20=YES
    xferlog_std_format=YES
    listen=NO
    listen_ipv6=YES
    pam_service_name=vsftpd
    userlist_enable=YES
    tcp_wrappers=YES

多加了anon\_umask=022就成功了

# 多加了下面参数
    anon_umask=022
    # anon_upload_enable=YES
    # anon_mkdir_write_enable=YES
    # anon_other_write_enable=YES
    
    # 设置匿名目录后也不成功
    # anon_root=/data1/vsftpd/root/annon

##### 情况2 把根目录/var/ftp权限不对 #####

用chmod命令将数据根目录权限改为755

### 文件夹登录上传 部分文件名乱码问题 ###

用xftp上传没问题

// 下面行不通，仅做记录
    [root@VM_5_17_centos data]# yum -y groupinstall chinese-support
    [root@VM_5_17_centos data]# echo $LANG
    [root@VM_5_17_centos data]# vim /etc/locale.conf
    
    LANG=zh_CN.utf8
    # LANG=en_US.utf8
    # LANG="zh_CN.GB18030" 
    # LANGUAGE="zh_CN.GB18030:zh_CN.GB2312:zh_CN" 
    # SUPPORTED="zh_CN.UTF-8:zh_CN:zh:en_US.UTF-8:en_US:en" 
    # SYSFONT="lat0-sun16"
    
    [root@VM_5_17_centos data]# vim /etc/sysconfig/i18n
    
    LANG="zh_CN.utf8"
    LC_ALL="zh_CN.utf8"

### 4.开防火墙后，客户端连接超时ERR\_CONNECTION\_TIMED\_OUT ###

# 默认配置 #

# Example config file /etc/vsftpd/vsftpd.conf
    #
    # The default compiled in settings are fairly paranoid. This sample file
    # loosens things up a bit, to make the ftp daemon more usable.
    # Please see vsftpd.conf.5 for all compiled in defaults.
    #
    # READ THIS: This example file is NOT an exhaustive list of vsftpd options.
    # Please read the vsftpd.conf.5 manual page to get a full idea of vsftpd's
    # capabilities.
    #
    # Allow anonymous FTP? (Beware - allowed by default if you comment this out).
    anonymous_enable=YES
    #
    # Uncomment this to allow local users to log in.
    # When SELinux is enforcing check for SE bool ftp_home_dir
    local_enable=YES
    #
    # Uncomment this to enable any form of FTP write command.
    write_enable=YES
    #
    # Default umask for local users is 077. You may wish to change this to 022,
    # if your users expect that (022 is used by most other ftpd's)
    local_umask=022
    #
    # Uncomment this to allow the anonymous FTP user to upload files. This only
    # has an effect if the above global write enable is activated. Also, you will
    # obviously need to create a directory writable by the FTP user.
    #anon_upload_enable=YES
    #
    # Uncomment this if you want the anonymous FTP user to be able to create
    # new directories.
    #anon_mkdir_write_enable=YES
    #
    # Activate directory messages - messages given to remote users when they
    # go into a certain directory.
    dirmessage_enable=YES
    #
    # Activate logging of uploads/downloads.
    xferlog_enable=YES
    #
    # Make sure PORT transfer connections originate from port 20 (ftp-data).
    connect_from_port_20=YES
    #
    # If you want, you can arrange for uploaded anonymous files to be owned by
    # a different user. Note! Using "root" for uploaded files is not
    # recommended!
    #chown_uploads=YES
    #chown_username=whoever
    #
    # You may override where the log file goes if you like. The default is shown
    # below.
    #xferlog_file=/var/log/xferlog
    #
    # If you want, you can have your log file in standard ftpd xferlog format.
    # Note that the default log file location is /var/log/xferlog in this case.
    xferlog_std_format=YES
    #
    # You may change the default value for timing out an idle session.
    #idle_session_timeout=600
    #
    # You may change the default value for timing out a data connection.
    #data_connection_timeout=120
    #
    # It is recommended that you define on your system a unique user which the
    # ftp server can use as a totally isolated and unprivileged user.
    #nopriv_user=ftpsecure
    #
    # Enable this and the server will recognise asynchronous ABOR requests. Not
    # recommended for security (the code is non-trivial). Not enabling it,
    # however, may confuse older FTP clients.
    #async_abor_enable=YES
    #
    # By default the server will pretend to allow ASCII mode but in fact ignore
    # the request. Turn on the below options to have the server actually do ASCII
    # mangling on files when in ASCII mode. The vsftpd.conf(5) man page explains
    # the behaviour when these options are disabled.
    # Beware that on some FTP servers, ASCII support allows a denial of service
    # attack (DoS) via the command "SIZE /big/file" in ASCII mode. vsftpd
    # predicted this attack and has always been safe, reporting the size of the
    # raw file.
    # ASCII mangling is a horrible feature of the protocol.
    #ascii_upload_enable=YES
    #ascii_download_enable=YES
    #
    # You may fully customise the login banner string:
    #ftpd_banner=Welcome to blah FTP service.
    #
    # You may specify a file of disallowed anonymous e-mail addresses. Apparently
    # useful for combatting certain DoS attacks.
    #deny_email_enable=YES
    # (default follows)
    #banned_email_file=/etc/vsftpd/banned_emails
    #
    # You may specify an explicit list of local users to chroot() to their home
    # directory. If chroot_local_user is YES, then this list becomes a list of
    # users to NOT chroot().
    # (Warning! chroot'ing can be very dangerous. If using chroot, make sure that
    # the user does not have write access to the top level directory within the
    # chroot)
    #chroot_local_user=YES
    #chroot_list_enable=YES
    # (default follows)
    #chroot_list_file=/etc/vsftpd/chroot_list
    #
    # You may activate the "-R" option to the builtin ls. This is disabled by
    # default to avoid remote users being able to cause excessive I/O on large
    # sites. However, some broken FTP clients such as "ncftp" and "mirror" assume
    # the presence of the "-R" option, so there is a strong case for enabling it.
    #ls_recurse_enable=YES
    #
    # When "listen" directive is enabled, vsftpd runs in standalone mode and
    # listens on IPv4 sockets. This directive cannot be used in conjunction
    # with the listen_ipv6 directive.
    listen=NO
    #
    # This directive enables listening on IPv6 sockets. By default, listening
    # on the IPv6 "any" address (::) will accept connections from both IPv6
    # and IPv4 clients. It is not necessary to listen on *both* IPv4 and IPv6
    # sockets. If you want that (perhaps because you want to listen on specific
    # addresses) then you must run two copies of vsftpd with two configuration
    # files.
    # Make sure, that one of the listen options is commented !!
    listen_ipv6=YES
    
    pam_service_name=vsftpd
    userlist_enable=YES
    tcp_wrappers=YES