vsftpd
Differences
This shows you the differences between two versions of the page.
|
vsftpd [2009/06/23 22:13] k2patel |
vsftpd [2020/08/10 02:35] |
||
|---|---|---|---|
| Line 1: | Line 1: | ||
| - | ====== VsFTPD ====== | ||
| - | Very secure, but hard to configure for virtual users and chroot.\\ | ||
| - | Here i have crack it down one day for my client. | ||
| - | |||
| - | <code bash | /etc/vsftpd/vsftpd.conf> | ||
| - | # Disable Anonymous login | ||
| - | |||
| - | anonymous_enable=NO | ||
| - | |||
| - | # Controls whether local logins are permitted or not. If enabled, normal user accounts in /etc/passwd | ||
| - | # (or wherever your PAM config references) may be used to log in. | ||
| - | # This must be enable for any non-anonymous login to work, including virtual users. | ||
| - | |||
| - | local_enable=YES | ||
| - | |||
| - | # This controls whether any FTP commands which change the filesystem are allowed or not. (we override later) | ||
| - | |||
| - | write_enable=NO | ||
| - | |||
| - | # by default, virtual users are treated with anonymous (i.e. maximally restricted) privilege. (we override later) | ||
| - | |||
| - | anon_upload_enable=NO | ||
| - | |||
| - | # When enabled, anonymous users will only be allowed to download files which are world readable | ||
| - | |||
| - | anon_world_readable_only=NO | ||
| - | |||
| - | # If set to YES, anonymous users will be permitted to create new directories (we override later) | ||
| - | |||
| - | anon_mkdir_write_enable=NO | ||
| - | |||
| - | # operation other than upload, creation consider as other_write e.g.. overwrite ( we override later) | ||
| - | anon_other_write_enable=NO | ||
| - | |||
| - | # define custom pam service for our purpose. | ||
| - | |||
| - | pam_service_name=ftp | ||
| - | |||
| - | # chroot users !! yeah we need this | ||
| - | |||
| - | chroot_local_user=YES | ||
| - | |||
| - | # Guest enable will separate login from passwd - so you do not need system account to exists. | ||
| - | # need this for standalone authentication. | ||
| - | |||
| - | guest_enable=YES | ||
| - | |||
| - | # where you want to guest user to - generally apache user OR directory owner | ||
| - | |||
| - | guest_username=www | ||
| - | |||
| - | # This needed as listen has to be enable for ftp to work | ||
| - | |||
| - | listen=YES | ||
| - | |||
| - | # Passive port range specification | ||
| - | |||
| - | pasv_min_port=30000 | ||
| - | pasv_max_port=30999 | ||
| - | |||
| - | # Location where we override all above options where we need overriding. | ||
| - | |||
| - | user_config_dir=/etc/vsftpd/vsftpd_user_conf | ||
| - | |||
| - | # Need this to disable some users from system | ||
| - | |||
| - | userlist_enable=YES | ||
| - | |||
| - | # List of the users which is disabled | ||
| - | |||
| - | userlist_file=/etc/vsftpd/denied_users | ||
| - | |||
| - | # Maximum ftp client at any given moment of time | ||
| - | |||
| - | max_clients=100 | ||
| - | |||
| - | # How many connection from single ip | ||
| - | |||
| - | max_per_ip=10 | ||
| - | </code> | ||
| - | |||
| - | Additional Log options, you would like to add to above config i have added | ||
| - | |||
| - | <code bash> | ||
| - | xferlog_enable=YES | ||
| - | xferlog_std_format=YES | ||
| - | dual_log_enable=YES | ||
| - | log_ftp_protocol=YES | ||
| - | </code> | ||
| - | |||
| - | * create directory "/etc/vsftpd/vsftpd_user_conf" | ||
| - | * create file "/etc/vsftpd/vsftpd_user_conf/www" | ||
| - | |||
| - | NOTE : now we are overriding all disabled options for each user. (if not you will be denied for anything LOL) | ||
| - | |||
| - | <code bash | /etc/vsftpd/vsftpd_user_conf/www> | ||
| - | write_enable=YES | ||
| - | dirlist_enable=YES | ||
| - | download_enable=YES | ||
| - | anon_upload_enable=YES | ||
| - | anon_other_write_enable=YES | ||
| - | anon_mkdir_write_enable=YES | ||
| - | local_root=/var/www/html | ||
| - | </code> | ||
| - | |||
| - | * create pam auth rule for db4 based database | ||
| - | |||
| - | <code bash | /etc/pam.d/ftp> | ||
| - | auth required /lib/security/pam_userdb.so db=/etc/vsftpd/vsftpd_login | ||
| - | account required /lib/security/pam_userdb.so db=/etc/vsftpd/vsftpd_login | ||
| - | </code> | ||
| - | |||
| - | * crate text file with username / password. users.txt | ||
| - | |||
| - | <code bash | /etc/vsftpd/users.txt> | ||
| - | www | ||
| - | wwwpassword | ||
| - | username2 | ||
| - | password2 | ||
| - | </code> | ||
| - | |||
| - | * generate database based on users.txt file | ||
| - | |||
| - | <code bash> | ||
| - | db_load -T -t hash -f logins.txt /etc/vsftpd/vsftpd_login.db | ||
| - | </code> | ||
| - | |||
| - | * generate virtual user restriction for second user | ||
| - | |||
| - | <code bash | /etc/vsftpd/vsftpd_user_conf/username2> | ||
| - | local_root=/var/www/html/xyz.com | ||
| - | dirlist_enable=YES | ||
| - | download_enable=YES | ||
| - | write_enable=YES | ||
| - | anon_upload_enable=YES | ||
| - | anon_other_write_enable=YES | ||
| - | anon_mkdir_write_enable=YES | ||
| - | </code> | ||
| - | |||
| - | * If you see permission 600 and you have issue with that permission. try following additional lines. | ||
| - | |||
| - | <code bash | /etc/vsftpd/vsftpd_user_conf/username2> | ||
| - | chmod_enable=YES | ||
| - | virtual_use_local_privs=YES | ||
| - | </code> | ||
| - | |||
| - | NOTE : any change to user setting does not require restart - but new ftp connection needed. | ||
| - | |||
| - | DONE | ||
vsftpd.txt ยท Last modified: 2020/08/10 02:35 (external edit)
Page Tools
Except where otherwise noted, content on this wiki is licensed under the following license: CC Attribution-Share Alike 4.0 International
