CentOS 下 vsftpd 快速配置

说明：基于本地用户 nginx 的虚拟FTP用户的 vsftpd 配置。

yum install vsftpd 之后：

清空 vsftpd.conf，写入以下内容：

listen=YES
ftpd_banner=Support:root at upall dot cn
anonymous_enable=NO
local_enable=YES
local_umask=022
guest_enable=YES
guest_username=nginx
userlist_enable=YES
user_config_dir=/etc/vsftpd/vusers
dirmessage_enable=YES
xferlog_enable=YES
xferlog_std_format=YES
pam_service_name=vsftpd
connect_from_port_20=YES
tcp_wrappers=YES
pasv_enable=YES
pasv_min_port=5000
pasv_max_port=5500
reverse_lookup_enable=NO
allow_writeable_chroot=YES
# 以下用于支持 TLS
ssl_enable=YES
ssl_tlsv1=YES
ssl_ciphers=HIGH
force_local_logins_ssl=NO
force_local_data_ssl=NO
allow_anon_ssl=YES
rsa_cert_file=/etc/vsftpd/vsftpd.pem

生成 TLS SSL 证书

cd /etc/vsftpd/
openssl req -new -x509 -nodes -out vsftpd.pem -keyout vsftpd.pem -days 3650

FTP帐号的权限，文件名是FTP帐号：/etc/vsftpd/vusers/ftpUser

local_root=/data/web/ftpUser
anon_umask=077
write_enable=YES
anon_world_readable_only=NO
anon_upload_enable=YES
anon_mkdir_write_enable=YES
anon_other_write_enable=YES

FTP帐号：/etc/vsftpd/vusers.txt

ftpUser
ftpPassword

用于添加FTP帐号的脚本：/etc/vsftpd/makeFtpDb.sh

#!/bin/bash
db_load -T -t hash -f /etc/vsftpd/vusers.txt /etc/vsftpd/vusers.db
chmod 600 /etc/vsftpd/vusers.db

./makeFtpDb.sh 执行后会生成 vusers.db

全部注释，只添加下边的两行：/etc/pam.d/vsftpd

##%PAM-1.0
#session    optional     pam_keyinit.so    force revoke
#auth       required pam_listfile.so item=user sense=deny file=/etc/vsftpd
#auth       required pam_shells.so
#auth       include  password-auth
#account    include  password-auth
#session    required     pam_loginuid.so
#session    include  password-auth
auth    required /lib/security/pam_userdb.so db=/etc/vsftpd/vusers
account required /lib/security/pam_userdb.so db=/etc/vsftpd/vusers

64位系统把 “/lib/sec….”换成“/lib64/sec….”

配置防火墙

systemctl start firewalld.service
firewall-cmd --add-service=ftp --permanent
firewall-cmd --add-port=5000-5500/tcp --permanent
firewall-cmd --reload

— 完 —