Linux.vsftp: Unterschied zwischen den Versionen
Zur Navigation springen
Zur Suche springen
Root (Diskussion | Beiträge) |
Root (Diskussion | Beiträge) |
||
(36 dazwischenliegende Versionen von 2 Benutzern werden nicht angezeigt) | |||
Zeile 1: | Zeile 1: | ||
== Installation == | == Installation == | ||
systemctl enable vsftpd | |||
systemctl start vsftpd | |||
groupadd www | |||
== Konfiguration == | == Konfiguration == | ||
Zeile 36: | Zeile 36: | ||
pasv_max_port=52152 | pasv_max_port=52152 | ||
use_localtime=YES | use_localtime=YES | ||
* zum Vergleich | |||
# | |||
# /etc/vsftpd.conf | |||
# | |||
write_enable=YES | |||
dirmessage_enable=YES | |||
dirlist_enable=YES | |||
nopriv_user=ftpsecure | |||
ftpd_banner="Welcome to the OrgaMon-FTP-service." | |||
ls_recurse_enable=YES | |||
local_enable=YES | |||
local_umask=0000 | |||
chroot_local_user=YES | |||
allow_root_squashed_chroot=YES | |||
allow_writeable_chroot=YES | |||
anonymous_enable=NO | |||
syslog_enable=NO | |||
log_ftp_protocol=YES | |||
xferlog_enable=YES | |||
vsftpd_log_file=/var/log/vsftpd.log | |||
xferlog_std_format=YES | |||
xferlog_file=/var/log/vsftpd-xfer.log | |||
dual_log_enable=YES | |||
pam_service_name=vsftpd | |||
listen_ipv6=NO | |||
ssl_enable=NO | |||
pasv_min_port=49152 | |||
pasv_max_port=52152 | |||
use_localtime=YES | |||
=== mehr über Datei-Rechte === | === mehr über Datei-Rechte === | ||
Zeile 49: | Zeile 81: | ||
=== mehr über SSL-Aktivierung === | === mehr über SSL-Aktivierung === | ||
# SSL | # | ||
# optionales SSL | |||
# | |||
ssl_enable=YES | ssl_enable=YES | ||
rsa_cert_file=/etc/ | ssl_sslv2=NO | ||
ssl_sslv3=NO | |||
ssl_tlsv1=NO | |||
debug_ssl=YES | |||
rsa_cert_file=/etc/letsencrypt/live/orgamon.net/cert.pem | |||
rsa_private_key_file=/etc/letsencrypt/live/orgamon.net/privkey.pem | |||
force_local_data_ssl=NO | force_local_data_ssl=NO | ||
force_local_logins_ssl=NO | force_local_logins_ssl=NO | ||
Zeile 63: | Zeile 102: | ||
== Anlegen eines neuen ftp Benutzes == | == Anlegen eines neuen ftp Benutzes == | ||
=== YaST2 === | |||
* Login muss erlaubt werden | * Login muss erlaubt werden | ||
* Home-Verzeichnis wie gewünscht setzen, z.B. /srv/ftp/<Benutzername> | * Home-Verzeichnis wie gewünscht setzen, z.B. /srv/ftp/<Benutzername> | ||
* [ ] Leeres Homeverzeichnis darf angekreuzt werden | * [x] Leeres Homeverzeichnis darf angekreuzt werden | ||
* Shell sollte auf /bin/false gesetzt werden | * Shell sollte auf /bin/false gesetzt werden | ||
* Standard Gruppe mache ich auf "ftp" | * Standard Gruppe mache ich auf "ftp" | ||
* Die Zugehörigkeit auf "www" und "ftp" | * Die Zugehörigkeit auf "www" und "ftp" | ||
=== Kommandozeile === | |||
useradd --home /srv/ftp/<b><i>user</i></b> --groups ftp --gid www --shell /bin/bash <b><i>user</i></b> | |||
echo "<b><i>user</i></b>:<b><i>password</i></b>" | chpasswd | |||
== Gedanken über Benutzer Beschränkungen == | == Gedanken über Benutzer Beschränkungen == | ||
Zeile 100: | Zeile 144: | ||
== Double NAT Problem == | == Double NAT Problem == | ||
* Here is the solution running a FTP Server in ... | |||
** .. the local net | |||
** .. behind NAT via a Modem | |||
** .. behind NAT via a Router (wich is doing NAT too) | |||
* .. all in the same time, doing correct response to PASV | |||
[[Datei:Double-NAT.png]] | [[Datei:Double-NAT.png]] | ||
* If the FTP Server works behind | * If the FTP-Server works behind one single NAT-Interface, PASV works without any Problems (In the Picture IP-C). | ||
Internet calling Port 21 | Internet calling Port 21 | ||
Zeile 109: | Zeile 159: | ||
| | | | ||
v | v | ||
NAT @ IP- | NAT @ IP-C | ||
^ | ^ | ||
| | | | ||
v | v | ||
vsftpd:21 | vsftpd:21 | ||
PASV:enter passive (IP- | PASV:enter passive (IP-C,p1,p2) | ||
* But: If you have two NAT Routers between your PASV Response needs to be well formed | * But: If you have two NAT Routers between your PASV Response needs to be well formed | ||
* The Solution is to have 2 second Instance of | * The Solution is to have 2 second Instance of vsftpd on another port, say 2121, route all the traffic from the double NATed to the 2121-Instance. Here you have a well formed static setting that ensures the correct PASV Host Adresse | ||
** <code>listen_port=2121</code> | |||
** <code>pasv_address=217.91.31.84</code> | |||
* Ensure that you have you local access routet to Port 21, the default vsftpd instance | |||
Internet calling Port 21 | Internet calling Port 21 | ||
Zeile 133: | Zeile 186: | ||
v | v | ||
vsftpd:2121 | vsftpd:2121 | ||
PASV:enter passive (IP-B,p1,p2) will fail | PASV:enter passive (IP-B,p1,p2) will fail (that is the case if you do nothing) | ||
PASV:enter passive (IP-A,p1,p2) will do it | PASV:enter passive (IP-A,p1,p2) will do it, but you have to place IP-A in the config file of vsftpd | ||
* extent your xinetd-Configuration to ensure you have 2 vsftpd systems with different configurations (one listen on port 21, another on 2121) | |||
** /etc/xinet.d/vsftpd | |||
# default: off | |||
# description: | |||
# The vsftpd FTP server serves FTP connections. It uses | |||
# normal, unencrypted usernames and passwords for authentication. | |||
# vsftpd is designed to be secure. | |||
# | |||
# NOTE: This file contains the configuration for xinetd to start vsftpd. | |||
# the configuration file for vsftp itself is in /etc/vsftpd.conf | |||
service ftp | |||
{ | |||
socket_type = stream | |||
protocol = tcp | |||
wait = no | |||
user = root | |||
server = /usr/sbin/vsftpd | |||
} | |||
service scientia-ssdb | |||
{ | |||
port = 2121 | |||
socket_type = stream | |||
protocol = tcp | |||
wait = no | |||
user = root | |||
server = /usr/sbin/vsftpd | |||
server_args = /etc/vsftpd2.conf | |||
} | |||
== Diagnose == | |||
=== bestehende Verbindungen === | |||
* Kommandoverbindungen und Datenverbindungen | |||
netstat -n -p | grep tcp | grep vsftpd | |||
=== bestehende vsftpd Prozesse === | |||
systemctl status vsftpd.service | |||
== Links == | |||
[[raspberrypi.vsftpd]] |
Aktuelle Version vom 14. Dezember 2023, 14:20 Uhr
Installation
systemctl enable vsftpd systemctl start vsftpd groupadd www
Konfiguration
- Typische Einstellungen für OrgaMon-App FTP-Server
# # /etc/vsftpd.conf # write_enable=YES dirmessage_enable=YES nopriv_user=ftpsecure ftpd_banner="Welcome to the OrgaMon-FTP-service." ls_recurse_enable=YES local_enable=YES local_umask=0000 chroot_local_user=YES allow_root_squashed_chroot=YES allow_writeable_chroot=YES anonymous_enable=NO syslog_enable=NO log_ftp_protocol=YES xferlog_enable=YES vsftpd_log_file=/var/log/vsftpd.log xferlog_std_format=YES xferlog_file=/var/log/vsftpd-xfer.log dual_log_enable=YES pam_service_name=vsftpd listen_ipv6=NO ssl_enable=NO pasv_min_port=49152 pasv_max_port=52152 use_localtime=YES
- zum Vergleich
# # /etc/vsftpd.conf # write_enable=YES dirmessage_enable=YES dirlist_enable=YES nopriv_user=ftpsecure ftpd_banner="Welcome to the OrgaMon-FTP-service." ls_recurse_enable=YES local_enable=YES local_umask=0000 chroot_local_user=YES allow_root_squashed_chroot=YES allow_writeable_chroot=YES anonymous_enable=NO syslog_enable=NO log_ftp_protocol=YES xferlog_enable=YES vsftpd_log_file=/var/log/vsftpd.log xferlog_std_format=YES xferlog_file=/var/log/vsftpd-xfer.log dual_log_enable=YES pam_service_name=vsftpd listen_ipv6=NO ssl_enable=NO pasv_min_port=49152 pasv_max_port=52152 use_localtime=YES
mehr über Datei-Rechte
# für rw-r--r-- local_umask=0022 # für rw-rw-rw- local_umask=0000
Der Wert von local_umask wird hier von den Ausgangswerten des vsftp (666 und 777) abgezogen, so dass in diesem Beisiel 644 (Verzeichnisse) und 755 (Dateien) rauskommt.
mehr über SSL-Aktivierung
# # optionales SSL # ssl_enable=YES ssl_sslv2=NO ssl_sslv3=NO ssl_tlsv1=NO debug_ssl=YES rsa_cert_file=/etc/letsencrypt/live/orgamon.net/cert.pem rsa_private_key_file=/etc/letsencrypt/live/orgamon.net/privkey.pem force_local_data_ssl=NO force_local_logins_ssl=NO
SSL Zertifikat selbst erstellen
cd /etc md vsftpd openssl req -x509 -nodes -days 365 -newkey rsa:1024 -keyout vsftpd.pem -out vsftpd.pem
Anlegen eines neuen ftp Benutzes
YaST2
- Login muss erlaubt werden
- Home-Verzeichnis wie gewünscht setzen, z.B. /srv/ftp/<Benutzername>
- [x] Leeres Homeverzeichnis darf angekreuzt werden
- Shell sollte auf /bin/false gesetzt werden
- Standard Gruppe mache ich auf "ftp"
- Die Zugehörigkeit auf "www" und "ftp"
Kommandozeile
useradd --home /srv/ftp/user --groups ftp --gid www --shell /bin/bash user echo "user:password" | chpasswd
Gedanken über Benutzer Beschränkungen
ftp Benutzer sollten kein ssh login machen können mail Benutzer sollten kein ftp/ssh login machen können: Zumindest in /etc/ftpusers können die Mail Benutzer eingetragen werden, hier werden alle Benutzer aufgeführt, die kein FTP machen dürfen.
Man kann die Verzeichnis-Struktur eines FTP-Servers in sein eigenes lokales Dateisystem einhängen:
zypper install curlftpfs md incoming curlftpfs orgamon.net incoming/ -o user=incoming:******
Aushängen
umount incoming/
Bug: File Mask ? do not work
# # # LIST ?????.DAT do not work any more
Double NAT Problem
- Here is the solution running a FTP Server in ...
- .. the local net
- .. behind NAT via a Modem
- .. behind NAT via a Router (wich is doing NAT too)
- .. all in the same time, doing correct response to PASV
- If the FTP-Server works behind one single NAT-Interface, PASV works without any Problems (In the Picture IP-C).
Internet calling Port 21 ^ | v NAT @ IP-C ^ | v vsftpd:21 PASV:enter passive (IP-C,p1,p2)
- But: If you have two NAT Routers between your PASV Response needs to be well formed
- The Solution is to have 2 second Instance of vsftpd on another port, say 2121, route all the traffic from the double NATed to the 2121-Instance. Here you have a well formed static setting that ensures the correct PASV Host Adresse
listen_port=2121
pasv_address=217.91.31.84
- Ensure that you have you local access routet to Port 21, the default vsftpd instance
Internet calling Port 21 ^ | v NAT @ IP-A ^ | v NAT @ IP-B Redirect Port 21->2121 ^ | v vsftpd:2121 PASV:enter passive (IP-B,p1,p2) will fail (that is the case if you do nothing) PASV:enter passive (IP-A,p1,p2) will do it, but you have to place IP-A in the config file of vsftpd
- extent your xinetd-Configuration to ensure you have 2 vsftpd systems with different configurations (one listen on port 21, another on 2121)
- /etc/xinet.d/vsftpd
# default: off # description: # The vsftpd FTP server serves FTP connections. It uses # normal, unencrypted usernames and passwords for authentication. # vsftpd is designed to be secure. # # NOTE: This file contains the configuration for xinetd to start vsftpd. # the configuration file for vsftp itself is in /etc/vsftpd.conf service ftp { socket_type = stream protocol = tcp wait = no user = root server = /usr/sbin/vsftpd } service scientia-ssdb { port = 2121 socket_type = stream protocol = tcp wait = no user = root server = /usr/sbin/vsftpd server_args = /etc/vsftpd2.conf }
Diagnose
bestehende Verbindungen
- Kommandoverbindungen und Datenverbindungen
netstat -n -p | grep tcp | grep vsftpd
bestehende vsftpd Prozesse
systemctl status vsftpd.service