ubuntu ftp 服务器搭建及vsftpd.conf配置实例详解
一、ftp服务器搭建与简单配置
总结一下步骤吧：
1、安装
sudo apt-get install vsftpd
可查看版本号命令
vsftd -v
2、修改配置文件/etc/vsftpd.conf
根据具体的情况进行修改，去掉注释等，接下来会详细介绍。
3、重启vsftpd服务
sudo service vsftpd restart
然后查看服务是否成功开启
sudo service vsftpd status
如果看到active（running）就说明成功了，否则很可能是配置文件修改出错。
4、登录测试
实际测试一下是否达到预想的功能。
(这个并没有什么卵用，因为匿名用户没有开启，主要看vsftpd.conf配置文件内容来决定）
二、实例详解ftp服务器配置
我们搭建ftp服务器想要实现以下特点：
1、user1用户作为本地最高级用户在ftp中几乎不受什么限制，可以访问全部目录，可以上传可以下载，可以删除，新建目录，新建文件。
2、user2用户作为作为本地用户，ftp登陆后限制在自己的主目录内（/home/user2），在其主目录下可以上传可以下载，可以删除，新建目录，新建文件。
3、匿名用户（其他任何人，不需要专门的密码就可以访问）限制在/home/ftp目录下，且只有下载权限。
如上的特点大概符合一般场景，本地用户中，管理员自然最大了，想干啥就干啥，其他本地用户就访问自己的目录就好啦，在自己的范围内想干啥就干啥，然后其他外来人员可以下载指定的资源，这样管理员可以共享一些东西供其他人下载，其他人只能下载，不能修改，所以也不能造成什么破坏。
第一步先设设置本地FTP工作用户（冬瓜自研QQ:5264857）
sudo useradd -d /home/user1 -m user1 \\创建FTP用户名 sudo passwd user1 \\设置密码 chmod -R 777 /home/user1 \\设置ftp权限 重复操作user2 sudo useradd -d /home/user2 -m user2 \\创建FTP用户名 sudo passwd user2 \\设置密码 chmod -R 777 /home/user2 \\设置ftp权限
好啦，照着这个目标，开始配置/etc/vsftpd.conf文件
允许匿名用户访问，并且对匿名用户的目录进行限制，限制到/home/ftp
1 anonymous_enable=YES 2 anon_root=/home/ftp
这里特别说明，/home/ftp目录，不能有w权限，这是一个只读的目录，否者会报错。修改权限可以使用
sudo chmod a-w /home/ftp
本地用户能够访问，且拥有写的权限
1 local_enable=YES 2 write_enable=YES
本地用户登录后限制在自己的主目录下，同时通过文件/etc/vsftpd.chroot_list来指定不用限制目录的用户（比如我们的user1不用限制目录，所以要在该文件下写上user1），同时允许用户对自己的主目录进行修改。
1 chroot_local_user=YES 2 chroot_list_enable=YES 3 chroot_list_file=/etc/vsftpd.chroot_list 4 allow_writeable_chroot=YES
启用用户列表，不在列表中的用户禁止登陆（所以我们要在etc/allowed_users中写上user1，user2，anonymous，ftp，其中最后两个都表示匿名登录）
1 user_list_enable=YES 2 user_list_deny=NO 3 userlist_file=/etc/allowed_users
这个是经验项，配置了据说可以避免一些错误，参考文献中有介绍。
seccomp_sandbox=NO
到此，还注意到，里面涉及到了两个文件，一个是/etc/vsftpd.chroot_list，一个是/etc/allowed_users，我们保存了之后需要自己手动创建这两个文件，
sudo touch /etc/vsftpd.chroot_list
sudo touch /etc/allowed_users
然后在/etc/vsftpd.chroot_list中的用户不被限制目录，这个例子中我们要写入user1，/etc/allowed_users中要写入允许访问服务器的用户，这里就是user1，user2，还有匿名用户anonymous，ftp，注意写的时候每行只写一个用户名。
保存好了就重启服务，验证即可。
最后，一点注意，匿名用户只能访问/home/ftp目录，那么里面的文件需要超级用户复制进去，并且所有文件需要有可读的权限，否者其他用户下载会出错。
贴一下配置文件的整体代码，方便大家比对。
1 # Example config file /etc/vsftpd.conf 2 # 3 # The default compiled in settings are fairly paranoid. This sample file 4 # loosens things up a bit, to make the ftp daemon more usable. 5 # Please see vsftpd.conf.5 for all compiled in defaults. 6 # 7 # READ THIS: This example file is NOT an exhaustive list of vsftpd options. 8 # Please read the vsftpd.conf.5 manual page to get a full idea of vsftpd's 9 # capabilities. 10 # 11 # 12 # Run standalone? vsftpd can run either from an inetd or as a standalone 13 # daemon started from an initscript. 14 listen=NO 15 # 16 # This directive enables listening on IPv6 sockets. By default, listening 17 # on the IPv6 "any" address (::) will accept connections from both IPv6 18 # and IPv4 clients. It is not necessary to listen on *both* IPv4 and IPv6 19 # sockets. If you want that (perhaps because you want to listen on specific 20 # addresses) then you must run two copies of vsftpd with two configuration 21 # files. 22 listen_ipv6=YES 23 # 24 # Allow anonymous FTP? (Disabled by default). 25 anonymous_enable=YES 26 anon_root=/home/ftp 27 # 28 # Uncomment this to allow local users to log in. 29 local_enable=YES 30 # 31 # Uncomment this to enable any form of FTP write command. 32 write_enable=YES 33 # 34 # Default umask for local users is 077. You may wish to change this to 022, 35 # if your users expect that (022 is used by most other ftpd's) 36 #local_umask=022 37 # 38 # Uncomment this to allow the anonymous FTP user to upload files. This only 39 # has an effect if the above global write enable is activated. Also, you will 40 # obviously need to create a directory writable by the FTP user. 41 #anon_upload_enable=YES 42 # 43 # Uncomment this if you want the anonymous FTP user to be able to create 44 # new directories. 45 #anon_mkdir_write_enable=YES 46 # 47 # Activate directory messages - messages given to remote users when they 48 # go into a certain directory. 49 dirmessage_enable=YES 50 # 51 # If enabled, vsftpd will display directory listings with the time 52 # in your local time zone. The default is to display GMT. The 53 # times returned by the MDTM FTP command are also affected by this 54 # option. 55 use_localtime=YES 56 # 57 # Activate logging of uploads/downloads. 58 xferlog_enable=YES 59 # 60 # Make sure PORT transfer connections originate from port 20 (ftp-data). 61 connect_from_port_20=YES 62 # 63 # If you want, you can arrange for uploaded anonymous files to be owned by 64 # a different user. Note! Using "root" for uploaded files is not 65 # recommended! 66 #chown_uploads=YES 67 #chown_username=whoever 68 # 69 # You may override where the log file goes if you like. The default is shown 70 # below. 71 #xferlog_file=/var/log/vsftpd.log 72 # 73 # If you want, you can have your log file in standard ftpd xferlog format. 74 # Note that the default log file location is /var/log/xferlog in this case. 75 #xferlog_std_format=YES 76 # 77 # You may change the default value for timing out an idle session. 78 #idle_session_timeout=600 79 # 80 # You may change the default value for timing out a data connection. 81 #data_connection_timeout=120 82 # 83 # It is recommended that you define on your system a unique user which the 84 # ftp server can use as a totally isolated and unprivileged user. 85 #nopriv_user=ftpsecure 86 # 87 # Enable this and the server will recognise asynchronous ABOR requests. Not 88 # recommended for security (the code is non-trivial). Not enabling it, 89 # however, may confuse older FTP clients. 90 #async_abor_enable=YES 91 # 92 # By default the server will pretend to allow ASCII mode but in fact ignore 93 # the request. Turn on the below options to have the server actually do ASCII 94 # mangling on files when in ASCII mode. 95 # Beware that on some FTP servers, ASCII support allows a denial of service 96 # attack (DoS) via the command "SIZE /big/file" in ASCII mode. vsftpd 97 # predicted this attack and has always been safe, reporting the size of the 98 # raw file. 99 # ASCII mangling is a horrible feature of the protocol. 100 #ascii_upload_enable=YES 101 #ascii_download_enable=YES 102 # 103 # You may fully customise the login banner string: 104 #ftpd_banner=Welcome to blah FTP service. 105 # 106 # You may specify a file of disallowed anonymous e-mail addresses. Apparently 107 # useful for combatting certain DoS attacks. 108 #deny_email_enable=YES 109 # (default follows) 110 #banned_email_file=/etc/vsftpd.banned_emails 111 # 112 # You may restrict local users to their home directories. See the FAQ for 113 # the possible risks in this before using chroot_local_user or 114 # chroot_list_enable below. 115 #chroot_local_user=YES 116 # 117 # You may specify an explicit list of local users to chroot() to their home 118 # directory. If chroot_local_user is YES, then this list becomes a list of 119 # users to NOT chroot(). 120 # (Warning! chroot'ing can be very dangerous. If using chroot, make sure that 121 # the user does not have write access to the top level directory within the 122 # chroot) 123 chroot_local_user=YES 124 chroot_list_enable=YES 125 # (default follows) 126 chroot_list_file=/etc/vsftpd.chroot_list 127 # 128 # You may activate the "-R" option to the builtin ls. This is disabled by 129 # default to avoid remote users being able to cause excessive I/O on large 130 # sites. However, some broken FTP clients such as "ncftp" and "mirror" assume 131 # the presence of the "-R" option, so there is a strong case for enabling it. 132 #ls_recurse_enable=YES 133 # 134 # Customization 135 # 136 # Some of vsftpd's settings don't fit the filesystem layout by 137 # default. 138 # 139 # This option should be the name of a directory which is empty. Also, the 140 # directory should not be writable by the ftp user. This directory is used 141 # as a secure chroot() jail at times vsftpd does not require filesystem 142 # access. 143 secure_chroot_dir=/var/run/vsftpd/empty 144 # 145 # This string is the name of the PAM service vsftpd will use. 146 pam_service_name=vsftpd 147 # 148 # This option specifies the location of the RSA certificate to use for SSL 149 # encrypted connections. 150 rsa_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem 151 rsa_private_key_file=/etc/ssl/private/ssl-cert-snakeoil.key 152 ssl_enable=NO 153 154 userlist_enable=YES 155 userlist_deny=NO 156 userlist_file=/etc/allowed_users 157 #local_root=/home 158 seccomp_sandbox=NO 159 allow_writeable_chroot=YES 160 # 161 # Uncomment this to indicate that vsftpd use a utf8 filesystem. 162 #utf8_filesystem=YES
