【Linux】FTP file server

1. Introduction to FTP

FTP (File transfer protocol) is one of the protocols in the TCP/IP protocol suite. Its main function is to transfer files between the server and the client. FTP is to realize copying between two computers. Copy files from the remote computer to your own computer, which is called "download" file. Copying a file from your own computer to a remote computer is called "uploading" the file. This ancient protocol uses clear-code transmission and has a history of quite a few security crises in the past. In order to use the FTP protocol more safely, we mainly introduce the software vsftpd (very secure File transfer protocol), which is more secure but has fewer functions. FTP is a C/S type software. The FTP listening TCP port number is 21 and the data port is 20.

2. Application scenarios

Download server: Provides external download services
File server: Provides upload and download services

3. FTP permissions

In addition to simply transferring and managing files, the function of the FTP server can also provide several main functions according to the setting architecture of the server software. :
Different levels of user identities: user, guest, anonymous.
By default, the FTP server is divided into three different identities based on the user's login status, which are:

(1) Local user: a real user in the system
(2) Guest, guest;
(3) Anonymous login, anonymous

Users with these three identities have very different permissions on the system! For example, entity users have relatively complete permissions on the system, so they can perform more actions; as for anonymous logins, we probably only provide them with the ability to download resources, and anonymous users are not allowed to use too many host resources! Of course, the [online commands] that these three types of characters can use due to different permissions are naturally different!

4. FTP working mode

FTP supports two modes, one is called Standard (that is, PORT mode, active mode), and the other is Passive (that is, PASV, passive mode). The Standard mode FTP client sends the PORT command to the FTP server. Passive mode FTP client sends PASV command to FTP Server.

Here is an introduction to the working principles of these two methods:

Port mode FTP client first establishes a connection with the TCP 21 port of the FTP server and sends commands through this channel. When the client needs to receive data, it sends a PORT command on this channel. The PORT command contains the port used by the client to receive data. When transmitting data, the server connects to the client's designated port through its own TCP 20 port to send data. The FTP server must establish a new connection with the client to transfer data.

Passive mode is similar to Standard mode when establishing a control channel, but after establishing a connection, it does not send a Port command, but a Pasv command. After receiving the Pasv command, the FTP server randomly opens a high-end port (the port number is greater than 1024) and notifies the client of the request to transmit data on this port. The client connects to this port of the FTP server, and then the FTP server transmits data through this port. Transfer, this time the FTP server no longer needs to establish a new connection with the client.

Many firewalls are not allowed to accept externally initiated connections when they are set up, so many FTP servers located behind the firewall or on the intranet do not support PASV mode because the client cannot open the high-end port of the FTP server through the firewall; and many internal The client on the Internet cannot log in to the FTP server in PORT mode because the TCP 20 of the slave server cannot establish a new connection with the client on the internal network, causing it to fail to work.

5. FTP installation and deployment

The machine used in this experiment is centos8.0_x86_64 system with IP address 192.168.11.16/24. Turn off the firewall and SELINUX.

#vsftp安装
[root@localhost ~]# dnf -y install vsftpd ftp

#vsftp开机启动
[root@localhost ~]# systemctl enable vsftpd
Created symlink from /etc/systemd/system/multi-user.target.wants/vsftpd.service to 
/usr/lib/systemd/system/vsftpd.service.

#启动vsftp服务
[root@localhost ~]# systemctl start vsftpd

#验证启动
[root@localhost ~]# lsof -i :21
COMMAND  PID USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
vsftpd  1951 root    4u  IPv6  32837      0t0  TCP *:ftp (LISTEN)

6. FTP configuration file

6.1) Related documents

Main configuration file:/etc/vsftpd/vsftpd.conf

Download directory:/var/ftp/

FTP log:/var/log/xferlog

6.2) Detailed explanation of main configuration files

# Example config file /etc/vsftpd/vsftpd.conf
#
# The default compiled in settings are fairly paranoid. This sample file
# loosens things up a bit, to make the ftp daemon more usable.
# Please see vsftpd.conf.5 for all compiled in defaults.
#
# READ THIS: This example file is NOT an exhaustive list of vsftpd options.
# Please read the vsftpd.conf.5 manual page to get a full idea of vsftpd's
# capabilities.
#
#匿名用户访问,YES是允许,NO是拒绝
# Allow anonymous FTP? (Beware - allowed by default if you comment this out).
anonymous_enable=NO
#
# Uncomment this to allow local users to log in.
# 本地用户登录,YES是允许,NO是拒绝.默认访问的是本地用户家目录,如果你开启了selinux
# 请设置开启布尔值ftp_home_dir为ON
# When SELinux is enforcing check for SE bool ftp_home_dir
local_enable=YES
#
#允许本地用户上传
# Uncomment this to enable any form of FTP write command.
write_enable=YES
#
# Default umask for local users is 077. You may wish to change this to 022,
# 上传的权限是022,使用的是umask权限。对应的目录是755,文件是644
# if your users expect that (022 is used by most other ftpd's)
local_umask=022

#
# Uncomment this to allow the anonymous FTP user to upload files. This only
# has an effect if the above global write enable is activated. Also, you will
# obviously need to create a directory writable by the FTP user.
# When SELinux is enforcing check for SE bool allow_ftpd_anon_write, allow_ftpd_full_access
# 开启匿名用户上传功能,默认是拒绝的
#anon_upload_enable=YES
#
# Uncomment this if you want the anonymous FTP user to be able to create
# new directories.
# 开启匿名用户创建文件或文件夹权限
#anon_mkdir_write_enable=YES
#
# Activate directory messages - messages given to remote users when they
# go into a certain directory.
# 开启目录欢迎消息,一般对命令行登陆有效
dirmessage_enable=YES
#
# Activate logging of uploads/downloads.
# 开启上传和下载日志记录功能
xferlog_enable=YES
#
#使用标准模式
# Make sure PORT transfer connections originate from port 20 (ftp-data).
connect_from_port_20=YES
#
# If you want, you can arrange for uploaded anonymous files to be owned by
# a different user. Note! Using "root" for uploaded files is not
# recommended!
# 声明匿名用户上传文件的所有者
# 允许更改匿名用户上传文件的所有者
#chown_uploads=YES
#所有者为whoever
#chown_username=whoever
#
# You may override where the log file goes if you like. The default is shown
# below.
# 日志文件路径
#xferlog_file=/var/log/xferlog
#
# If you want, you can have your log file in standard ftpd xferlog format.
# Note that the default log file location is /var/log/xferlog in this case.
# 日志文件采用标准格斯
xferlog_std_format=YES
#
# You may change the default value for timing out an idle session.
# 会话超时时间
#idle_session_timeout=600
#
# You may change the default value for timing out a data connection.
# 数据传输超时时间
#data_connection_timeout=120
#
# It is recommended that you define on your system a unique user which the
# ftp server can use as a totally isolated and unprivileged user.
# FTP子进程管理用户
#nopriv_user=ftpsecure
#
# Enable this and the server will recognise asynchronous ABOR requests. Not
# recommended for security (the code is non-trivial). Not enabling it,
# however, may confuse older FTP clients.
# 是否允许客户端发起“async ABOR”请求,该操作是不安全的默认禁止。
#async_abor_enable=YES
#
# By default the server will pretend to allow ASCII mode but in fact ignore
# the request. Turn on the below options to have the server actually do ASCII
# mangling on files when in ASCII mode. The vsftpd.conf(5) man page explains
# the behaviour when these options are disabled.
# Beware that on some FTP servers, ASCII support allows a denial of service
# attack (DoS) via the command "SIZE /big/file" in ASCII mode. vsftpd
# predicted this attack and has always been safe, reporting the size of the
# raw file.
# ASCII mangling is a horrible feature of the protocol.
# 该选项用于指定是否允许上传时以ASCII模式传输数据
#ascii_upload_enable=YES
#该选项用于指定是否允许下载时以ASCII模式传输数据
#ascii_download_enable=YES
#
# You may fully customise the login banner string:
# FTP文本界面登陆欢迎词
#ftpd_banner=Welcome to blah FTP service.
#
# You may specify a file of disallowed anonymous e-mail addresses. Apparently
# useful for combatting certain DoS attacks.
# 是否开启拒绝的Email功能
#deny_email_enable=YES
# (default follows)
# 指定保存被拒接的Email地址的文件
#banned_email_file=/etc/vsftpd/banned_emails
#
# You may specify an explicit list of local users to chroot() to their home
# directory. If chroot_local_user is YES, then this list becomes a list of
# users to NOT chroot().
# (Warning! chroot'ing can be very dangerous. If using chroot, make sure that
# the user does not have write access to the top level directory within the
# chroot)
# 是否开启对本地用户chroot的限制,YES为默认所有用户都不能切出家目录,NO代表默认用户都可以切出家目录
# 设置方法类似于:YES拒绝所有,允许个别    NO  允许所有拒绝个别
#chroot_local_user=YES
#开启特例列表
#chroot_list_enable=YES
# (default follows)
# 如果chroot_local_user的值是YES则该文件中的用户是可以切出家目录,如果是NO,该文件中的用户则不能切出家目录
# 一行一个用户。
#chroot_list_file=/etc/vsftpd/chroot_list

# You may activate the "-R" option to the builtin ls. This is disabled by
# default to avoid remote users being able to cause excessive I/O on large
# sites. However, some broken FTP clients such as "ncftp" and "mirror" assume
# the presence of the "-R" option, so there is a strong case for enabling it.
# 是否开启ls 递归查询功能 ls -R
#ls_recurse_enable=YES
#
# When "listen" directive is enabled, vsftpd runs in standalone mode and
# listens on IPv4 sockets. This directive cannot be used in conjunction
# with the listen_ipv6 directive.
# 是否开启ftp独立模式在IPV4
listen=NO
#
# This directive enables listening on IPv6 sockets. By default, listening
# on the IPv6 "any" address (::) will accept connections from both IPv6
# and IPv4 clients. It is not necessary to listen on *both* IPv4 and IPv6
# sockets. If you want that (perhaps because you want to listen on specific
# addresses) then you must run two copies of vsftpd with two configuration
# files.
# Make sure, that one of the listen options is commented !!
# 是否开启ftp独立模式在ipv6
listen_ipv6=YES


#启用pam模块验证
pam_service_name=vsftpd
#是否开启userlist功能.

#是否启用用户列表功能
userlist_enable=YES

Through the analysis of the configuration file, VSFTP does not allow anonymous access, and local users can download and upload. If you allow anonymous users to log in, you need to set anonymous_enable=YES and then restart the service.

We can configure the related login status of FTP by modifying the contents of the configuration file.

7. FTP client access

FTP is a C/S type software. An FTP client is required to connect to the server. Common FTP clients include the following:

Browser: You can access FTP by entering ftp://ip or ftp:// domain name in the browser.
Built-in client: You can use the ftp command on the command line to connect to
third-party clients: FileZilla 8uftp graphical software or text interface lftp, etc.
Among the three methods, the text interface is more troublesome and cannot be flowed by the mouse. So I will focus on explaining it to you.

7.1) Text interface login

文本界面匿名登陆
[root@localhost ~]# ftp 192.168.11.16
Connected to 192.168.11.16 (192.168.11.16).
220 (vsFTPd 3.0.3)
Name (192.168.11.16:root): ftp	#用户名可以是ftp也可以是anonymous
331 Please specify the password.
Password:							#密码为空
230 Login successful. #显示登陆成功
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls
227 Entering Passive Mode (192,168,11,16,90,35).
150 Here comes the directory listing.
drwxr-xr-x    2 0        0               6 May 14  2019 pub
226 Directory send OK.
通过ls可以列出当前目录下有哪些内容 看到有一个目录叫pub
ftp> pwd
257 "/"   
通过pwd命令查看当前路径  注意这里显示的是FTP的根目录

ftp> bye
221 Goodbye.
退出使用bye命令

文本界面本地用户登录
[root@localhost ~]# ftp 192.168.11.16
Connected to 192.168.11.16 (192.168.11.16).
220 (vsFTPd 3.0.3)
Name (192.168.11.16:root): hello
331 Please specify the password.
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls
227 Entering Passive Mode (192,168,11,16,130,240).
150 Here comes the directory listing.
drwxr-xr-x    2 1001     1001            6 Jan 15 08:56 下载
drwxr-xr-x    2 1001     1001            6 Jan 15 08:56 公共
drwxr-xr-x    2 1001     1001            6 Jan 15 08:56 图片
drwxr-xr-x    2 1001     1001            6 Jan 15 08:56 文档
drwxr-xr-x    2 1001     1001            6 Jan 15 08:56 桌面
drwxr-xr-x    2 1001     1001            6 Jan 15 08:56 模板
drwxr-xr-x    2 1001     1001            6 Jan 15 08:56 视频
drwxr-xr-x    2 1001     1001            6 Jan 15 08:56 音乐
226 Directory send OK.
ftp> pwd
257 "/home/hello" is the current directory

7.2) Common commands of FTP client

The most commonly used commands are:

  • ls lists the current directory of the remote machine
  • cd changes the working directory on the remote machine
  • lcd changes the working directory on the local machine
  • ascii sets the file transfer mode to ASCII mode
  • binary sets the file transfer mode to binary mode
  • open connect to remote ftp site
  • close terminates the current ftp session
  • Hash displays a # sign each time the data in the data buffer is transmitted.
  • get (mget) transfers the specified file from the remote machine to the local machine (the prefix +m is a batch operation)
  • put (mput) transfers the specified file from the local machine to the remote machine
  • delete(mdelete) delete file

Type the help command to view all available commands

ftp> help
Commands may be abbreviated.  Commands are:

!                debug         mdir           sendport     site
$                dir           mget           put          size
account          disconnect    mkdir          pwd          status
append           exit          mls            quit         struct
ascii            form          mode           quote        system
bell             get           modtime        recv         sunique
binary           glob          mput           reget        tenex
bye              hash          newer          rstatus      tick
case             help          nmap           rhelp        trace
cd               idle          nlist          rename       type
cdup             image         ntrans         reset        user
chmod            lcd           open           restart      umask
close            ls            prompt         rmdir        verbose
cr               macdef        passive        runique        ?
delete           mdelete       proxy          send

!+linux command executes system commands

#!ls /opt  显示linux系统中/opt目录下的内容
ftp> !ls /opt
dhcp  dns  rh

lcd current directory in linux system

#lcd /root  将linux系统中的当前目录切换到/root下
ftp> lcd /root
Local directory now /root

put upload command, mput batch upload command

#上传initial-setup-ks.cfg文件到hello家目录下
ftp> put initial-setup-ks.cfg 
local: initial-setup-ks.cfg remote: initial-setup-ks.cfg
227 Entering Passive Mode (192,168,11,16,96,132).
150 Ok to send data.
226 Transfer complete.
1803 bytes sent in 0.00135 secs (1333.58 Kbytes/sec)
#可以看到上传成功了
#验证一下上传结果
ftp> ls
227 Entering Passive Mode (192,168,11,16,173,142).
150 Here comes the directory listing.
-rw-r--r--    1 1000     1000         1803 Feb 26 07:01 initial-setup-ks.cfg
drwxr-xr-x    2 1000     1000            6 Jan 11 01:37 下载
drwxr-xr-x    2 1000     1000            6 Jan 11 01:37 公共
drwxr-xr-x    2 1000     1000            6 Jan 11 01:37 图片
drwxr-xr-x    2 1000     1000            6 Jan 11 01:37 文档
drwxr-xr-x    2 1000     1000            6 Jan 11 01:37 桌面
drwxr-xr-x    2 1000     1000            6 Jan 11 01:37 模板
drwxr-xr-x    2 1000     1000            6 Jan 11 01:37 视频
drwxr-xr-x    2 1000     1000            6 Jan 11 01:37 音乐
226 Directory send OK.

#切换linux当前目录到/tmp
ftp> lcd /tmp
Local directory now /tmp

get download command, mget batch download

下载initial-setup-ks.cfg到linux系统当前目录/tmp
ftp> get initial-setup-ks.cfg
local: initial-setup-ks.cfg remote: initial-setup-ks.cfg
227 Entering Passive Mode (192,168,11,16,229,134).
150 Opening BINARY mode data connection for initial-setup-ks.cfg (1803 bytes).
226 Transfer complete.
1803 bytes received in 2.9e-05 secs (62172.41 Kbytes/sec)

#列出linux目录/tmp的内容,看到了下载的文件initial-setup-ks.cfg
ftp> !ls /tmp/
dhcp                                          tracker-extract-files.0
initial-setup-ks.cfg                                  VMwareDnD
systemd-private-8e7a99ea89c14ab396d66116970fe04d-chronyd.service-sghHHs       vmware-root
systemd-private-8e7a99ea89c14ab396d66116970fe04d-colord.service-wK7h08      yum_save_tx.2019-02-20.16-10.Z6uXqR.yumtx
systemd-private-8e7a99ea89c14ab396d66116970fe04d-cups.service-cokBro          yum_save_tx.2019-02-21.09-03.08zIbU.yumtx
systemd-private-8e7a99ea89c14ab396d66116970fe04d-rtkit-daemon.service-6wt1S0  yum_save_tx.2019-02-22.11-10.prawAT.yumtx

You can use close to disconnect. When the connection is disconnected and you want to connect again, just use the open command.

ftp> close
221 Goodbye.
ftp> ls
Not connected.

ftp> open 192.168.11.16
Connected to 192.168.11.16 (192.168.11.16).
220 (vsFTPd 3.0.2)
Name (192.168.11.16:root): hello
331 Please specify the password.
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls
227 Entering Passive Mode (192,168,11,16,192,88).
150 Here comes the directory listing.
-rw-r--r--    1 1000     1000         1803 Feb 26 07:01 initial-setup-ks.cfg
drwxr-xr-x    2 1000     1000            6 Jan 11 01:37 下载
drwxr-xr-x    2 1000     1000            6 Jan 11 01:37 公共
drwxr-xr-x    2 1000     1000            6 Jan 11 01:37 图片
drwxr-xr-x    2 1000     1000            6 Jan 11 01:37 文档
drwxr-xr-x    2 1000     1000            6 Jan 11 01:37 桌面
drwxr-xr-x    2 1000     1000            6 Jan 11 01:37 模板
drwxr-xr-x    2 1000     1000            6 Jan 11 01:37 视频
drwxr-xr-x    2 1000     1000            6 Jan 11 01:37 音乐
226 Directory send OK.

The delete command can delete your own files

#删除initial-setup-ks.cfg文件
ftp> delete initial-setup-ks.cfg
250 Delete operation successful.
ftp> ls
227 Entering Passive Mode (192,168,11,16,168,142).
150 Here comes the directory listing.
drwxr-xr-x    2 1000     1000            6 Jan 11 01:37 下载
drwxr-xr-x    2 1000     1000            6 Jan 11 01:37 公共
drwxr-xr-x    2 1000     1000            6 Jan 11 01:37 图片
drwxr-xr-x    2 1000     1000            6 Jan 11 01:37 文档
drwxr-xr-x    2 1000     1000            6 Jan 11 01:37 桌面
drwxr-xr-x    2 1000     1000            6 Jan 11 01:37 模板
drwxr-xr-x    2 1000     1000            6 Jan 11 01:37 视频
drwxr-xr-x    2 1000     1000            6 Jan 11 01:37 音乐
226 Directory send OK.

8. Configure secure ftp based on virtual users

In ftp, both anonymous users and real-name users are real users in the system, and there are more or less security risks. In order to avoid this risk, developers have added the concept of a virtual user to ftp. Virtual users will be uniformly mapped to a system account, eliminating the trouble of managing too many accounts. So how to implement this virtual user?

8.1) Modify configuration file

[root@fixpng pam.d]# egrep -v "^#" /etc/vsftpd/vsftpd.conf 
anonymous_enable=YES
local_enable=YES
write_enable=YES
local_umask=022
dirmessage_enable=YES
xferlog_enable=YES
connect_from_port_20=YES
xferlog_std_format=YES
chroot_local_user=YES
listen=NO
listen_ipv6=YES


#虚拟用户配置选项
#pam登陆验证
pam_service_name=vftp
#允许虚拟用户功能
guest_enable=YES
#虚拟用户映射到本地用户hello
guest_username=hello
#这里我通过指令改变了默认设置,允许虚拟用户写
allow_writeable_chroot=YES 

#本地用户的根目录
#这里是定义虚拟用户主目录,用户和组必须指定为宿主用户hello
local_root=/home/hello


#允许虚拟用户和本地用户权限一致
virtual_use_local_privs=YES

#如果虚拟用户和本地用户权限不同,可以通过以下的指令来设置指令,配置文件和登陆名同步即可。
#user_config_dir=/etc/vsftpd/vconf.d/

8.2) Generate virtual user account password file

Odd numbered lines are accounts, even numbered lines are passwords

[root@fixpng ~]# cat /etc/vsftpd/vuser
vuser01
123456
vuser02
123456

使用db_load转成db格式
[root@fixpng ~]# db_load -T -t hash -f /etc/vsftpd/vuser /etc/vsftpd/vuser.db
要求权限是600
[root@fixpng ~]# chmod 600 /etc/vsftpd/vuser.db

8.3) Configure pam authentication, pay attention to the order

[root@fixpng ~]# cat /etc/pam.d/vftp 
#虚拟用户登录
auth       sufficient     /lib64/security/pam_userdb.so db=/etc/vsftpd/vuser
account    sufficient     /lib64/security/pam_userdb.so db=/etc/vsftpd/vuser
#本地登陆
session    optional     pam_keyinit.so    force revoke
auth       required    pam_listfile.so item=user sense=deny file=/etc/vsftpd/ftpusers onerr=succeed
auth       required    pam_shells.so
auth       include    password-auth
account    include    password-auth
session    required     pam_loginuid.so
session    include    password-auth

8.3) Restart the service to take effect

[root@fixpng ~]# systemctl restart vsftpd
[root@fixpng ~]# cat /etc/vsftpd/chroot_list 
vuser01
vuser02

8.4) Verify login

[root@fixpng ~]# ftp 192.168.11.16
Connected to 192.168.11.16 (192.168.11.16).
220 Welcome to ayitula FTP service.
Name (192.168.11.16:root): vuser01
331 Please specify the password.
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls
227 Entering Passive Mode (192,168,11,16,82,91).
150 Here comes the directory listing.
226 Transfer done (but failed to open directory).

Landed successfully

Guess you like

Origin blog.csdn.net/qq_45277554/article/details/131452806