vsftpd指定虚拟用户登录后，本地用户就不能登陆了建立虚拟用户[root@rhel4 opt]# cat << ! >logins.txt 说明：此文本文件的格式是：单数行为用户名，偶数行为密码 > upload> 123456> download> 123456> admin> 123456> ![root@rhel4 opt]# db_load -t -t hash -f logins.txt /etc/vsftpd_login.db [root@rhel4 opt]# chmod 600 /etc/vsftpd_login.db [root@rhel4 opt]# cd /opt/vsftpd-1.2.1/example/virtual_users (进入解包的源码目录，把虚拟用户的认证文件拷贝到/etc/pam.d/下) [root@rhel4 virtual_users]# cp vsftpd.pam /etc/pam.d/ftp.vu(建立虚拟用户所要访问的ftp目录并设置仅virtual用户访问的权限和创建一个供下载实验的文件)[root@rhel4 virtual_users]# mkdir /var/ftpsite[root@rhel4 virtual_users]# useradd -d /var/ftpsite virtual;[root@rhel4 virtual_users]# chmod 700 /var/ftpsite[root@rhel4 virtual_users]# chown virtual /var/ftpsite[root@rhel4 virtual_users]# su - virtual -c "echo hello >/var/ftpsite/test.file"vi /etc/vsftpd.conf在此文件中插入下面的配置语句 guest_enable=yes（启用虚拟用户） guest_username=virtual（将虚拟用户映射为本地virtual用户） pam_service_name=ftp.vu（指定pam配置文件为ftp.vu） user_config_dir=/etc/vsftpd_user_conf（指定不同虚拟用户配置文件的存放路径） [root@rhel4 virtual_users]# mkdir /etc/vsftpd_user_conf h.开放不同用户的不同权限 echo "anon_world_readable_only=no"> /etc/vsftpd_user_conf/download（开放download用户的下载权限——只能下载；注意这个不地方不要写成yes，否则将不能列出文件和目录） cp /etc/vsftpd_user_conf/download /etc/vsftpd_user_conf/upload vi /etc/vsftpd_user_conf/upload，添加下列行 write_enable=yes （增加写权限） anon_upload_enable=yes（增加上传权限） anon_mkdir_write_enable=yes (增加创建目录的权限） cp /etc/vsftpd_user_conf/upload /etc/vsftpd_user_conf/admin 增加一行： anon_other_write_enable=yes（增加管理员用户的删除/重命名的权限） i.测试 killall -9 vsftpd;/usr/local/sbin/vsftpd /etc/vsftpd.conf & ftp 127.0.0.1 2121 以用户名download和你设置的密码登录，ls，可以看到文件，下载，成功！put一个文件，提示 permission denied。rename test.file同样权限被拒绝；delete test.file同样不成功！ 输入quit退出，以upload用户登录，ok！可以上传，下载，mkdir lsf，提示“/lsf" created；rename lsf lsf1提示permission denied,删除文件同样不成功！ 输入quit退出，以admin用户登录，可以有上述所有权限，然后rmdir lsf,提示remove directory o [eration successful;delete test.file提示delete operation successful!ok，大功告成了！参考：http://www.linuxts.com/modules/sections/index.php?op=printpage&artid=2206&phpsessid=e1a0ec323f0f75bc59cbb83afeeb59ffhttp://www.uplinux.com/www/net/02/117.shtml附 1.我的/etc/vsftpd.conf文件的内容 [root@rhel4 virtual_users]# cat /etc/vsftpd.conf # example config file /etc/vsftpd.conf## the default compiled in settings are fairly paranoid. this sample file# loosens things up a bit, to make the ftp daemon more usable.# please see vsftpd.conf.5 for all compiled in defaults.## read this: this example file is not an exhaustive list of vsftpd options.# please read the vsftpd.conf.5 manual page to get a full idea of vsftpd's# capabilities.## allow anonymous ftp? (beware - allowed by default if you comment this out).anonymous_enable=yes## uncomment this to allow local users to log in.local_enable=yes## uncomment this to enable any form of ftp write command.write_enable=yes## default umask for local users is 077. you may wish to change this to 022,# if your users expect that (022 is used by most other ftpd's)local_umask=022## uncomment this to allow the anonymous ftp user to upload files. this only# has an effect if the above global write enable is activated. also, you will# obviously need to create a directory writable by the ftp user.#anon_upload_enable=yes## uncomment this if you want the anonymous ftp user to be able to create# new directories.#anon_mkdir_write_enable=yes## activate directory messages - messages given to remote users when they# go into a certain directory.dirmessage_enable=yes## activate logging of uploads/downloads.xferlog_enable=yes## make sure port transfer connections originate from port 20 (ftp-data).connect_from_port_20=yes## if you want, you can arrange for uploaded anonymous files to be owned by# a different user. note! using "root" for uploaded files is not# recommended!#chown_uploads=yes#chown_username=whoever## you may override where the log file goes if you like. the default is shown# below.#xferlog_file=/var/log/vsftpd.log## if you want, you can have your log file in standard ftpd xferlog format#xferlog_std_format=yes## you may change the default value for timing out an idle session.#idle_session_timeout=600## you may change the default value for timing out a data connection.#data_connection_timeout=120## it is recommended that you define on your system a unique user which the# ftp server can use as a totally isolated and unprivileged user.#nopriv_user=ftpsecure## enable this and the server will recognise asynchronous abor requests. not# recommended for security (the code is non-trivial). not enabling it,# however, may confuse older ftp clients.#async_abor_enable=yes## by default the server will pretend to allow ascii mode but in fact ignore# the request. turn on the below options to have the server actually do ascii# mangling on files when in ascii mode.# beware that turning on ascii_download_enable enables malicious remote parties# to consume your i/o resources, by issuing the command "size /big/file" in# ascii mode.# these ascii options are split into upload and download because you may wish# to enable ascii uploads (to prevent uploaded scripts etc. from breaking),# without the dos risk of size and ascii downloads. ascii mangling should be# on the client anyway..#ascii_upload_enable=yes#ascii_download_enable=yes## you may fully customise the login banner string:#ftpd_banner=welcome to blah ftp service.## you may specify a file of disallowed anonymous e-mail addresses. apparently# useful for combatting certain dos attacks.#deny_email_enable=yes# (default follows)#banned_email_file=/etc/vsftpd.banned_emails## you may specify an explicit list of local users to chroot() to their home# directory. if chroot_local_user is yes, then this list becomes a list of# users to not chroot().#chroot_list_enable=yes# (default follows)#chroot_list_file=/etc/vsftpd.chroot_list## you may activate the "-r" option to the builtin ls. this is disabled by# default to avoid remote users being able to cause excessive i/o on large# sites. however, some broken ftp clients such as "ncftp" and "mirror" assume# the presence of the "-r" option, so there is a strong case for enabling it.#ls_recurse_enable=yesguest_enable=yesguest_username=virtualpam_service_name=ftp.vuuser_config_dir=/etc/vsftpd_user_confmax_clients=500max_per_ip=50local_max_rate=100000anon_max_rate=10000pasv_enable=yespasv_min_port=50000pasv_max_port=60000idle_session_timeout=600data_connection_timeout=120accept_timeout=60connect_timeout=60listen=yes2.我的/etc/vsftpd_user_conf/download的内容[root@rhel4 virtual_users]# cat /etc/vsftpd_user_conf/downloadanon_world_readable_only=no3.我的/etc/vsftpd_user_conf/upload的内容[root@rhel4 virtual_users]# cat /etc/vsftpd_user_conf/upload anon_world_readable_only=nowrite_enable=yesanon_upload_enable=yesanon_mkdir_write_enable=yes4.我的/etc/vsftpd_user_conf/admin的内容 [root@rhel4 virtual_users]# cat /etc/vsftpd_user_conf/admin anon_world_readable_only=nowrite_enable=yesanon_upload_enable=yesanon_mkdir_write_enable=yesanon_other_write_enable=yes
|
