linux中部署vsftpd服务（匿名用户模式）

FTP：（File Transfer Protocal）文件传输协议

vsftp：（very secure ftp daemon） 非常安全的FTP守护进程。

FTP：是一种在互联网中进行文件传输的协议。

FTP协议： 服务器/客户端模式

20端口用于数据传输，21端口接受客户端的命令

 FTP服务器：按照FTP协议在互联网中提供文件存储和访问服务的主机。

 FTP客户端：向服务器发送连接请求，以建立数据传输链路的主机。

以下实验中PC1作为服务器，PC2作为客户端。

1、 在PC1服务器端安装vsftp服务

[root@PC1 ~]# yum install vsftpd
Loaded plugins: langpacks, product-id, subscription-manager
This system is not registered to Red Hat Subscription Management. You can use subscription-manager to register.
rhel7                                                    | 4.1 kB     00:00     
Resolving Dependencies
--> Running transaction check
---> Package vsftpd.x86_64 0:3.0.2-9.el7 will be installed
--> Finished Dependency Resolution

Dependencies Resolved

================================================================================
 Package          Arch             Version                Repository       Size
================================================================================
Installing:
 vsftpd           x86_64           3.0.2-9.el7            rhel7           166 k

Transaction Summary
================================================================================
Install  1 Package

Total download size: 166 k
Installed size: 343 k
Is this ok [y/d/N]: y
Downloading packages:
Running transaction check
Running transaction test
Transaction test succeeded
Running transaction
  Installing : vsftpd-3.0.2-9.el7.x86_64                                    1/1 
rhel7/productid                                          | 1.6 kB     00:00     
  Verifying  : vsftpd-3.0.2-9.el7.x86_64                                    1/1 

Installed:
  vsftpd.x86_64 0:3.0.2-9.el7                                                   

Complete!

2、iptables防火墙默认禁止了FTP传输协议的端口号，在服务器端PC1清空防火墙策略并保存

[root@PC1 ~]# iptables -F
[root@PC1 ~]# service iptables save
iptables: Saving firewall rules to /etc/sysconfig/iptables:[  OK  ]

3、在PC1主机中精简vsftpd服务的配置文件

[root@PC1 ~]# cd /etc/vsftpd/
[root@PC1 vsftpd]# ls
ftpusers  user_list  vsftpd.conf  vsftpd_conf_migrate.sh
[root@PC1 vsftpd]# cp vsftpd.conf vsftpd.conf.bak
[root@PC1 vsftpd]# grep -v "#" vsftpd.conf > a && mv a vsftpd.conf
mv: overwrite ‘vsftpd.conf’? y
[root@PC1 vsftpd]# cat vsftpd.conf
anonymous_enable=YES
local_enable=YES
write_enable=YES
local_umask=022
dirmessage_enable=YES
xferlog_enable=YES
connect_from_port_20=YES
xferlog_std_format=YES
listen=NO
listen_ipv6=YES
pam_service_name=vsftpd
userlist_enable=YES
tcp_wrappers=YES

4、vsftpd服务程序的三种工作模式

匿名开放模式：无需密码，最不安全

本地用户模式：需要密码，较安全

虚拟用户模式：需要虚拟账户，最安全

5、在PC2客户端安装vsftpd服务的客户端工具ftp

[root@PC2 network-scripts]# yum install ftp
Loaded plugins: langpacks, product-id, subscription-manager
This system is not registered to Red Hat Subscription Management. You can use subscription-manager to register.
Resolving Dependencies
--> Running transaction check
---> Package ftp.x86_64 0:0.17-66.el7 will be installed
--> Finished Dependency Resolution

Dependencies Resolved

================================================================================
 Package        Arch              Version                Repository        Size
================================================================================
Installing:
 ftp            x86_64            0.17-66.el7            rhel7             61 k

Transaction Summary
================================================================================
Install  1 Package

Total download size: 61 k
Installed size: 96 k
Is this ok [y/d/N]: y
Downloading packages:
Running transaction check
Running transaction test
Transaction test succeeded
Running transaction
  Installing : ftp-0.17-66.el7.x86_64                                       1/1 
rhel7/productid                                          | 1.6 kB     00:00     
  Verifying  : ftp-0.17-66.el7.x86_64                                       1/1 

Installed:
  ftp.x86_64 0:0.17-66.el7                                                      

Complete!

6、在PC1服务器端修改vsftp服务的配置文件

[root@PC1 vsftpd]# vim /etc/vsftpd/vsftpd.conf
anonymous_enable=YES  ## 允许匿名访问模式
anon_umask=022        ## 匿名用户上传文件的umask值
anon_upload_enable=YES ## 允许匿名用户上传文件
anon_mkdir_write_enable=YES  ## 允许匿名用户创建目录
anon_other_write_enable=YES  ## 允许匿名用户修改目录名称或删除目录
local_enable=YES
write_enable=YES
local_umask=022
dirmessage_enable=YES
xferlog_enable=YES
connect_from_port_20=YES
xferlog_std_format=YES
listen=NO
listen_ipv6=YES

pam_service_name=vsftpd
userlist_enable=YES
tcp_wrappers=YES

7、在PC1服务器端主机中重启vsftpd服务、设为开启自启

[root@PC1 vsftpd]# systemctl restart vsftpd
[root@PC1 vsftpd]# systemctl enable vsftpd
ln -s '/usr/lib/systemd/system/vsftpd.service' '/etc/systemd/system/multi-user.target.wants/vsftpd.service'

8、在PC2客户端使用匿名主机模式远程连接FTP服务器

[root@PC2 network-scripts]# ftp 192.168.10.10
Connected to 192.168.10.10 (192.168.10.10).
220 (vsFTPd 3.0.2)
Name (192.168.10.10:root): anonymous  ## 统一账户anonymous
331 Please specify the password.
Password:   ## 直接回车即可  
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> cd pub
250 Directory successfully changed.
ftp> mkdir files    ## 创建目录失败
550 Create directory operation failed.

9、在PC1服务器端查看与ftp服务相关的SElinux域策略有哪些

[root@PC1 /]# getsebool -a | grep ftp
ftp_home_dir --> off
ftpd_anon_write --> off
ftpd_connect_all_unreserved --> off
ftpd_connect_db --> off
ftpd_full_access --> off
ftpd_use_cifs --> off
ftpd_use_fusefs --> off
ftpd_use_nfs --> off
ftpd_use_passive_mode --> off
httpd_can_connect_ftp --> off
httpd_enable_ftp_server --> off
sftpd_anon_write --> off
sftpd_enable_homedirs --> off
sftpd_full_access --> off
sftpd_write_ssh_home --> off
tftp_anon_write --> off
tftp_home_dir --> off

10、在PC1服务器端开启 ftpd_full_access 

[root@PC1 /]# setsebool -P ftpd_full_access=on    ## -P 表示永久生效
[root@PC1 /]# getsebool -a | grep ftp
ftp_home_dir --> off
ftpd_anon_write --> off
ftpd_connect_all_unreserved --> off
ftpd_connect_db --> off
ftpd_full_access --> on
ftpd_use_cifs --> off
ftpd_use_fusefs --> off
ftpd_use_nfs --> off
ftpd_use_passive_mode --> off
httpd_can_connect_ftp --> off
httpd_enable_ftp_server --> off
sftpd_anon_write --> off
sftpd_enable_homedirs --> off
sftpd_full_access --> off
sftpd_write_ssh_home --> off
tftp_anon_write --> off
tftp_home_dir --> off

11、 在PC2客户端测试能否创建目录

[root@PC2 network-scripts]# ftp 192.168.10.10
Connected to 192.168.10.10 (192.168.10.10).
220 (vsFTPd 3.0.2)
Name (192.168.10.10:root): anonymous
331 Please specify the password.
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> cd pub
250 Directory successfully changed.
ftp> mkdir files
550 Create directory operation failed.
ftp> 

12、在PC2服务器端修改/var/ftp/pub 目录权限

[root@PC1 /]# ll -d /var/ftp/pub/
drwxr-xr-x. 2 root root 6 Mar  7  2014 /var/ftp/pub/
[root@PC1 /]# chown -R ftp /var/ftp/pub/
[root@PC1 /]# ll -d /var/ftp/pub/
drwxr-xr-x. 2 ftp root 6 Mar  7  2014 /var/ftp/pub/

13、在PC2客户端继续测试能否创建目录

[root@PC2 network-scripts]# ftp 192.168.10.10
Connected to 192.168.10.10 (192.168.10.10).
220 (vsFTPd 3.0.2)
Name (192.168.10.10:root): anonymous
331 Please specify the password.
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> cd pub
250 Directory successfully changed.
ftp> mkdir files
257 "/pub/files" created
ftp> 

14、在PC1主机中创建测试文件 /var/ftp/pub/test.file,  在PC2客户机中传输至本地

[root@PC1 pub]# echo "helloword" > test.file   ## 在PC1服务器主机中创建测试文件
[root@PC1 pub]# ls
test.file
[root@PC1 pub]# pwd
/var/ftp/pub

[root@PC2 test]# pwd
/home/test
[root@PC2 test]# ls  ## 当前为空目录
[root@PC2 test]# ftp 192.168.10.10   ## 利用ftp远程登录 PC1服务器
Connected to 192.168.10.10 (192.168.10.10).
220 (vsFTPd 3.0.2)
Name (192.168.10.10:root): anonymous
331 Please specify the password.
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> cd pub
250 Directory successfully changed.
ftp> ls
227 Entering Passive Mode (192,168,10,10,251,78).
150 Here comes the directory listing.
-rw-r--r--    1 0        0              10 Dec 13 17:12 test.file
226 Directory send OK.
ftp> pwd
257 "/pub"
ftp> get test.file xx.file   ## 从PC1服务器端传输文件到本地（或者mget）
local: xx.file remote: test.file
227 Entering Passive Mode (192,168,10,10,218,59).
150 Opening BINARY mode data connection for test.file (10 bytes).
226 Transfer complete.
10 bytes received in 2e-05 secs (500.00 Kbytes/sec)
ftp> exit
221 Goodbye.
[root@PC2 test]# ls
xx.file
[root@PC2 test]# cat xx.file 
helloword

15、在PC2客户机端创建测试文件，传输至PC2服务器端

[root@PC1 pub]# ls   ## 空目录
[root@PC1 pub]# pwd
/var/ftp/pub

[root@PC2 test]# seq 5 > aaa.txt  ## 创建测试文件
[root@PC2 test]# ls
aaa.txt
[root@PC2 test]# ftp 192.168.10.10
Connected to 192.168.10.10 (192.168.10.10).
220 (vsFTPd 3.0.2)
Name (192.168.10.10:root): anonymous
331 Please specify the password.
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> cd pub
250 Directory successfully changed.
ftp> ls
227 Entering Passive Mode (192,168,10,10,183,167).
150 Here comes the directory listing.
226 Directory send OK.
ftp> pwd
257 "/pub"
ftp> put aaa.txt bbb.txt   ## 从PC2客户端传输至PC1服务器端  （或者mput）
local: aaa.txt remote: bbb.txt
227 Entering Passive Mode (192,168,10,10,108,109).
150 Ok to send data.
226 Transfer complete.
10 bytes sent in 3.8e-05 secs (263.16 Kbytes/sec)
ftp> ls
227 Entering Passive Mode (192,168,10,10,217,46).
150 Here comes the directory listing.
-rw-r--r--    1 14       50             10 Dec 13 17:25 bbb.txt
226 Directory send OK.
ftp> 

[root@PC1 pub]# ls   ## 在PC1服务器端进行验证
bbb.txt
[root@PC1 pub]# cat bbb.txt 
1
2
3
4
5
[root@PC1 pub]# pwd
/var/ftp/pub

以上实验部署了匿名用户模式的vsftpd服务，实现了客户机PC2向服务器PC1传输文件、实现了从PC1服务器端向PC2客户机端传输文件的功能。

16、在服务器端修改vsftpd服务的配置文件，观察还能否匿名登录

[root@PC1 vsftpd]# pwd
/etc/vsftpd
[root@PC1 vsftpd]# vim vsftpd.conf
anonymous_enable=NO   ## 此处改为NO
anon_umask=022
anon_upload_enable=YES
anon_mkdir_write_enable=YES
anon_other_write_enable=YES
local_enable=YES
write_enable=YES
local_umask=022
dirmessage_enable=YES
xferlog_enable=YES
connect_from_port_20=YES
xferlog_std_format=YES
listen=NO
listen_ipv6=YES

pam_service_name=vsftpd
userlist_enable=YES
tcp_wrappers=YES
[root@PC1 vsftpd]# systemctl restart vsftpd  ## 重启服务
[root@PC1 vsftpd]# systemctl status vsftpd | head -n 5
vsftpd.service - Vsftpd ftp daemon
   Loaded: loaded (/usr/lib/systemd/system/vsftpd.service; enabled)
   Active: active (running) since Mon 2020-12-14 01:39:06 CST; 8s ago
  Process: 34040 ExecStart=/usr/sbin/vsftpd /etc/vsftpd/vsftpd.conf (code=exited, status=0/SUCCESS)
 Main PID: 34041 (vsftpd)

[root@PC2 test]# ftp 192.168.10.10  
Connected to 192.168.10.10 (192.168.10.10).
220 (vsFTPd 3.0.2)
Name (192.168.10.10:root): anonymous
331 Please specify the password.
Password:
530 Login incorrect.
Login failed.
ftp> 
##  以上说明客户端已经不能匿名登录了