问题[vsftpd](unix)

我将 vsftpd 配置为被动模式

listen=YES
log_ftp_protocol=YES
pasv_enable=YES
pasv_address=192.168.0.2
pasv_min_port=10090
pasv_max_port=10100

它可以工作，但使用随机端口！

查看传输期间 ss 的输出

tcp   ESTAB     0      0                            192.168.0.2:33150     192.168.0.2:21    users:(("ncftp",pid=14411,fd=4)) timer:(keepalive,119min,0) uid:1000 ino:236010 sk:400b cgroup:unreachable:1 <->    
tcp   ESTAB     0      0                            192.168.0.2:44985     192.168.0.2:20    users:(("ncftp",pid=14411,fd=7)) timer:(keepalive,119min,0) uid:1000 ino:246607 sk:4011 cgroup:unreachable:1 <->  

这没关系..没有防火墙，有防火墙和nat重定向端口是一个严重的问题为什么vsftpd使用随机端口？

我努力了

listen_ipv6=NO

并禁用 pasv_address 选项。但什么也没有

这实际上是完整的配置

anonymous_enable=YES
connect_from_port_20=NO
dirmessage_enable=YES
ftpd_banner=Welcome
listen=YES
listen_ipv6=NO
local_umask=022
log_ftp_protocol=YES
ls_recurse_enable=YES
pasv_address=192.168.0.2
pasv_enable=YES
pasv_max_port=10100
pasv_min_port=10090
seccomp_sandbox=NO
xferlog_enable=YES
xferlog_file=/var/log/vsftpd.log
xferlog_std_format=YES

我已经在 Slackware 15 和 Debian 12 上尝试过

这是一个例子：

ncftp 可以工作，但不尊重被动端口范围

ftp 可以工作，但不尊重被动端口范围

ftp -p 192.168.0.2
Connected to 192.168.0.2 (192.168.0.2).
220 Welcome
Name (192.168.0.2:me): anonymous
331 Please specify the password.
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> cd pub
250 Directory successfully changed.
ftp> get 4.mkv
local: 4.mkv remote: 4.mkv
227 Entering Passive Mode (192,168,0,2,39,112).
150 Opening BINARY mode data connection for 4.mkv (12904291 bytes).
226 Transfer complete.
12904291 bytes received in 0,0272 secs (473899,78 Kbytes/sec)

我正在尝试设置 vsftpd（或其他应用程序）作为 Ubuntu 服务器上的 sftp 服务。我想为一个（或少数几个）系统用户公开 sftp，理想情况下，他们应该有一个 chroot 监狱，位置与他们的主目录不同。这似乎是我应该能够使用 vsftpd 处理的事情，但是我不明白发生了什么，并且怀疑“其他一些服务”实际上正在响应我的 sftp 请求。这就是我所做的：

1. apt install vsftpd 并据我所知进行配置。
2. 我可以 sftp 进入服务器并放置和获取文件，但是 chroot 不起作用。
3. 我删除vsftpdapt purge vsftpd
4. 我仍然可以使用 sftp 连接到服务器并放置和获取文件吗？

所以 - 似乎我需要理解/解决的第一个问题是谁在实际回复我的 sftp 请求 - 因为它似乎不是 vsftpd 安装？

这是一个股票 Ubuntu 20.04 安装

我希望 VSFTPD 的根目录是 /var/www/html。
我能怎么做？
这是我的配置文件

# Example config file /etc/vsftpd.conf
#
# The default compiled in settings are fairly paranoid. This sample file
# loosens things up a bit, to make the ftp daemon more usable.
# Please see vsftpd.conf.5 for all compiled in defaults.
#
# READ THIS: This example file is NOT an exhaustive list of vsftpd options.
# Please read the vsftpd.conf.5 manual page to get a full idea of vsftpd's
# capabilities.
#
#
# Run standalone?  vsftpd can run either from an inetd or as a standalone
# daemon started from an initscript.
listen=NO
#
# This directive enables listening on IPv6 sockets. By default, listening
# on the IPv6 "any" address (::) will accept connections from both IPv6
# and IPv4 clients. It is not necessary to listen on *both* IPv4 and IPv6
# sockets. If you want that (perhaps because you want to listen on specific
# addresses) then you must run two copies of vsftpd with two configuration
# files.
listen_ipv6=YES
#
# Allow anonymous FTP? (Disabled by default).
anonymous_enable=YES
#
# Uncomment this to allow local users to log in.
local_enable=YES
#
# Uncomment this to enable any form of FTP write command.
write_enable=YES
#
# Default umask for local users is 077. You may wish to change this to 022,
# if your users expect that (022 is used by most other ftpd's)
#local_umask=022
#
# Uncomment this to allow the anonymous FTP user to upload files. This only
# has an effect if the above global write enable is activated. Also, you will
# obviously need to create a directory writable by the FTP user.
anon_upload_enable=YES
#
# Uncomment this if you want the anonymous FTP user to be able to create
# new directories.
anon_mkdir_write_enable=YES
#
# Activate directory messages - messages given to remote users when they
# go into a certain directory.
dirmessage_enable=YES
#
# If enabled, vsftpd will display directory listings with the time
# in  your  local  time  zone.  The default is to display GMT. The
# times returned by the MDTM FTP command are also affected by this
# option.
use_localtime=YES
#
# Activate logging of uploads/downloads.
xferlog_enable=YES
#
# Make sure PORT transfer connections originate from port 20 (ftp-data).
connect_from_port_20=YES
#
# If you want, you can arrange for uploaded anonymous files to be owned by
# a different user. Note! Using "root" for uploaded files is not
# recommended!
chown_uploads=YES
#chown_username=whoever
#
# You may override where the log file goes if you like. The default is shown
# below.
#xferlog_file=/var/log/vsftpd.log
#
# If you want, you can have your log file in standard ftpd xferlog format.
# Note that the default log file location is /var/log/xferlog in this case.
#xferlog_std_format=YES
#
# You may change the default value for timing out an idle session.
#idle_session_timeout=600
#
# You may change the default value for timing out a data connection.
#data_connection_timeout=120
#
# It is recommended that you define on your system a unique user which the
# ftp server can use as a totally isolated and unprivileged user.
#nopriv_user=ftpsecure
#
# Enable this and the server will recognise asynchronous ABOR requests. Not
# recommended for security (the code is non-trivial). Not enabling it,
# however, may confuse older FTP clients.
#async_abor_enable=YES
#
# By default the server will pretend to allow ASCII mode but in fact ignore
# the request. Turn on the below options to have the server actually do ASCII
# mangling on files when in ASCII mode.
# Beware that on some FTP servers, ASCII support allows a denial of service
# attack (DoS) via the command "SIZE /big/file" in ASCII mode. vsftpd
# predicted this attack and has always been safe, reporting the size of the
# raw file.
# ASCII mangling is a horrible feature of the protocol.
#ascii_upload_enable=YES
#ascii_download_enable=YES
#
# You may fully customise the login banner string:
#ftpd_banner=Welcome to blah FTP service.
#
# You may specify a file of disallowed anonymous e-mail addresses. Apparently
# useful for combatting certain DoS attacks.
#deny_email_enable=YES
# (default follows)
#banned_email_file=/etc/vsftpd.banned_emails
#
# You may restrict local users to their home directories.  See the FAQ for
# the possible risks in this before using chroot_local_user or
# chroot_list_enable below.
chroot_local_user=YES
#
# You may specify an explicit list of local users to chroot() to their home
# directory. If chroot_local_user is YES, then this list becomes a list of
# users to NOT chroot().
# (Warning! chroot'ing can be very dangerous. If using chroot, make sure that
# the user does not have write access to the top level directory within the
# chroot)
#chroot_local_user=YES
chroot_list_enable=YES
# (default follows)
chroot_list_file=/etc/vsftpd.chroot_list
#
# You may activate the "-R" option to the builtin ls. This is disabled by
# default to avoid remote users being able to cause excessive I/O on large
# sites. However, some broken FTP clients such as "ncftp" and "mirror" assume
# the presence of the "-R" option, so there is a strong case for enabling it.
#ls_recurse_enable=YES
#
# Customization
#
# Some of vsftpd's settings don't fit the filesystem layout by
# default.
#
# This option should be the name of a directory which is empty.  Also, the
# directory should not be writable by the ftp user. This directory is used
# as a secure chroot() jail at times vsftpd does not require filesystem
# access.
secure_chroot_dir=/var/run/vsftpd/empty
#
# This string is the name of the PAM service vsftpd will use.
pam_service_name=vsftpd
#
# This option specifies the location of the RSA certificate to use for SSL
# encrypted connections.
rsa_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem
rsa_private_key_file=/etc/ssl/private/ssl-cert-snakeoil.key
ssl_enable=NO

#
# Uncomment this to indicate that vsftpd use a utf8 filesystem.
#utf8_filesystem=YES

请原谅我的英语不好，我真的累了，明天我纠正。

我有一个在我的 Ubuntu 服务器上运行的 vsftpd 实例。当用户更改为特定目录时，我需要显示横幅，即：

ftp> cd /cars
>>> These cars are for lease

有没有办法做到这一点？我知道如何为整个服务器设置横幅，但不确定如何为单个目录设置？

我需要正确的 tftp 语法来获取和放置文件。我的最终目标是使用busybox tftp（这应该是第二个问题），但即使尝试使用本地Ubuntu tftp客户端进行测试也失败了。

正如您在下面看到的，ftp没有问题，只有tftp问题。这是回送 ip，所以不应该与 iptables 相关（同样，ftp没问题）。为了防止潜在的长路径问题，我只使用主目录进行测试。

xb@dnxb:/tmp$ grep anon_root /etc/vsftpd.conf
anon_root=/home/xiaobai/
xb@dnxb:/tmp$ cat /home/xiaobai/haha
7
xb@dnxb:/tmp$ ftp 127.0.0.1
Connected to 127.0.0.1.
220 (vsFTPd 3.0.3)
Name (127.0.0.1:xiaobai): anonymous
331 Please specify the password.
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> get haha
local: haha remote: haha
200 PORT command successful. Consider using PASV.
150 Opening BINARY mode data connection for haha (2 bytes).
226 Transfer complete.
2 bytes received in 0.00 secs (6.5541 kB/s)
ftp> 221 Goodbye.
xb@dnxb:/tmp$ tftp 127.0.0.1
tftp> get haha
Error code 1: File not found
tftp> get /home/xiaobai/haha
Error code 1: File not found
tftp> get /home/xiaobai/haha output
Error code 1: File not found
tftp> put /home/xiaobai/haha        
Error code 1: File not found
tftp> put haha
Error code 1: File not found
tftp> xb@dnxb:/tmp$ dpkg-query -W -f='${Description}\n\n${Homepage}\nMaintainer: ${Maintainer}\n\n' tftp
Trivial file transfer protocol client
 Tftp is the user interface to the Internet TFTP (Trivial File Transfer
 Protocol), which allows users to transfer files to and from a remote machine.
 The remote host may be specified on the command line, in which case tftp uses
 host as the default host for future transfers.

http://www.hcs.harvard.edu/~dholland/computers/netkit.html
Maintainer: Ubuntu Developers <[email protected]>

xb@dnxb:/tmp$

然后我按照这个答案：

xb@dnxb:/tmp$ tftp -v 127.0.0.1 -c get haha
usage: tftp host-name [port]
tftp> xb@dnxb:/tmp$ 
xb@dnxb:/tmp$ tftp -v 127.0.0.1 -c get /home/xiaobai/haha
usage: tftp host-name [port]
tftp> xb@dnxb:/tmp$ 
xb@dnxb:/tmp$ tftp -v 127.0.0.1 -c put haha
usage: tftp host-name [port]
tftp> xb@dnxb:/tmp$ tftp -v 127.0.0.1 -c put /home/xiaobai/haha
usage: tftp host-name [port]
tftp> ^F
?Invalid command
tftp> xb@dnxb:/tmp$ 
xb@dnxb:/tmp$ 

还有这个答案（评论或不评论似乎没有效果，我service vsftpd restart在编辑后做了）：

xb@dnxb:/tmp$ grep server_args /etc/xinetd.conf 
# server_args = -c -s /tftpboot
xb@dnxb:/tmp$ 

如果有人可以回答有关具有不同选项的busybox tftp，那就更好了：

# busybox tftp                                    
BusyBox v1.22.1 bionic (2017-11-04 12:54 +0800) multi-call binary.

Usage: tftp [OPTIONS] HOST [PORT]

Transfer a file from/to tftp server

        -l FILE Local FILE
        -r FILE Remote FILE
        -g      Get file
        -p      Put file

我的 Arch Linux 4.20.2 从vsftpd的默认根目录/srv/ftp/.

我对配置文件所做的唯一补充/etc/vsftpd.conf是

seccomp_sandbox=NO

这消除了访问文件时在 Firefox 中显示的以下错误：

500 OOPS：priv_sock_get_cmd

这一切都很好，但我想提供来自不同目录的文件，比如/home/jenkins.

查阅手册vsftpd.conf，我将其添加到/etc/vsftpd.conf：

anon_root=/home/jenkins/

为了使更改生效，我打电话给systemctl restart vsftpd.

然而，vsftpd（我使用的是 3.0.3 版）仍然在其默认根目录中提供文件，/srv/ftp/.

这是怎么回事？

我安装了一个非常小的虚拟机，用于测试目的，运行 CentOS 1708，配置了 vsftp。我用了

https://www.rootusers.com/how-to-join-centos-linux-to-an-active-directory-domain/

为操作系统部分设置广告身份验证，但不希望广告用户能够通过 FTP 客户端登录。

主要是我需要通过 ssh 在内部进行广告身份验证，而不是通过 Internet，以及纯粹通过本地用户进行 FTP 登录。

我注意到，如果用户没有通过 ssh 登录此虚拟机，他/她将无法使用广告凭据通过 ftp 端口 21 登录，因为它无法创建主目录。

我想这很好，但我正在寻找一种方法来完全防止通过 AD 进行广告身份验证，只允许通过 ssh 或终端

我不希望通过 ftp 进行广告身份验证，因为这会使我在互联网上的广告用户面临被“黑客”或锁定的风险

关于我如何做到这一点的任何建议？