Proftp最简匿名访问配置


ftpfile

前言

每一次做ftp的配置都要弄半天,找文档,各种权限控制的坑,折腾半天,这次还是准备记录下来,以备不时之需,这里不配置什么高级的功能,就去实现一个最简单的配置

匿名用户的上传和下载

配置proftp过程

1、配置过程尽量少的动原配置文件,需要共享的为/share/a目录,首先修改默认的目录

DefaultRoot                     ~ !adm

修改为:

DefaultRoot                     /share

让默认的根目录为 /share,默认的为用户的根目录,匿名用户对应的ftp用户的根目录

2、修改匿名用户的目录

<Anonymous ~ftp>

修改为

<Anonymous /share>

修改原匿名用户ftp的用户目录为/share

3、修改默认屏蔽权限WRITE

<Limit WRITE SITE_CHMOD>
DenyAll
</Limit>

改成

<Limit  SITE_CHMOD>
DenyAll
</Limit>

默认会屏蔽掉写的操作,就没法上传了

5、配置访问的目录
默认启用了vroot,所以写路径的时候写相对路径即可,添加如下:

<Directory "/*">
AllowOverwrite no
<Limit ALL>
DenyAll
</Limit>
<Limit DIRS>
AllowAll
</Limit>
</Directory>
<Directory "/a">
AllowOverwrite no
<Limit ALL>
AllowAll
</Limit>
</Directory>

/a就代表的是/share/a

6、开启匿名
修改配置vim /etc/sysconfig/proftpd

PROFTPD_OPTIONS=""

改成:

PROFTPD_OPTIONS="-DANONYMOUS_FTP"

7、给目录访问权限

chown ftp:ftp /share/a
chmod 755 /share/a

8、启动proftp服务

systemctl restart proftpd

完整配置文件

ServerName			"ProFTPD server"
ServerIdent on "FTP Server ready."
ServerAdmin root@localhost
DefaultServer on
DefaultRoot ~ !adm
AuthPAMConfig proftpd
AuthOrder mod_auth_pam.c* mod_auth_unix.c
UseReverseDNS off
User nobody
Group nobody
MaxInstances 20
UseSendfile off
LogFormat default "%h %l %u %t \"%r\" %s %b"
LogFormat auth "%v [%P] %h %t \"%r\" %s"
LoadModule mod_ctrls_admin.c
LoadModule mod_vroot.c
ModuleControlsACLs insmod,rmmod allow user root
ModuleControlsACLs lsmod allow user *
ControlsEngine on
ControlsACLs all allow user root
ControlsSocketACL allow user *
ControlsLog /var/log/proftpd/controls.log
<IfModule mod_ctrls_admin.c>
AdminControlsEngine on
AdminControlsACLs all allow user root
</IfModule>
<IfModule mod_vroot.c>
VRootEngine on
</IfModule>
<IfDefine TLS>
TLSEngine on
TLSRequired on
TLSRSACertificateFile /etc/pki/tls/certs/proftpd.pem
TLSRSACertificateKeyFile /etc/pki/tls/certs/proftpd.pem
TLSCipherSuite ALL:!ADH:!DES
TLSOptions NoCertRequest
TLSVerifyClient off
TLSLog /var/log/proftpd/tls.log
<IfModule mod_tls_shmcache.c>
TLSSessionCache shm:/file=/var/run/proftpd/sesscache
</IfModule>
</IfDefine>
<IfDefine DYNAMIC_BAN_LISTS>
LoadModule mod_ban.c
BanEngine on
BanLog /var/log/proftpd/ban.log
BanTable /var/run/proftpd/ban.tab
BanOnEvent MaxLoginAttempts 2/00:10:00 01:00:00
BanMessage "Host %a has been banned"
BanControlsACLs all allow user ftpadm
</IfDefine>
<IfDefine QOS>
LoadModule mod_qos.c
QoSOptions dataqos throughput ctrlqos lowdelay
</IfDefine>
<Global>
Umask 022
AllowOverwrite yes
<Limit ALL SITE_CHMOD>
AllowAll
</Limit>
</Global>
<IfDefine ANONYMOUS_FTP>
<Anonymous /share/>
User ftp
Group ftp
AccessGrantMsg "Anonymous login ok, restrictions apply."
UserAlias anonymous ftp
MaxClients 10 "Sorry, max %m users -- try again later"
DisplayLogin /welcome.msg
DisplayChdir .message
DisplayReadme README*
DirFakeUser on ftp
DirFakeGroup on ftp
<Limit SITE_CHMOD>
DenyAll
</Limit>
<IfModule mod_vroot.c>
<Directory "/*">
AllowOverwrite no
<Limit ALL>
DenyAll
</Limit>
<Limit DIRS>
AllowAll
</Limit>
</Directory>
<Directory "/a">
AllowOverwrite no
<Limit ALL>
AllowAll
</Limit>
</Directory>
</IfModule>
WtmpLog off
ExtendedLog /var/log/proftpd/access.log WRITE,READ default
ExtendedLog /var/log/proftpd/auth.log AUTH auth
</Anonymous>
</IfDefine>

总结

最简配置就完成了,也可以根据需要再去做更复杂的配置,这里就不做过多的介绍,比较容易错误的点就是容易出现权限问题无法访问,或者是上下的设置关联错误,可以开启调试模式进行调试

proftpd   -n -d 10 -c /etc/proftpd.conf -DANONYMOUS_FTP

变更记录

Why Who When
创建 武汉-运维-磨渣 2016-09-01

For me

愿意打赏欢迎联系,另有私人ceph小群,可以联系我