Linux.vsftp: Unterschied zwischen den Versionen

Aus OrgaMon Wiki
Zur Navigation springen Zur Suche springen
Zeile 268: Zeile 268:


  netstat -anp --tcp | grep vsftpd | grep ESTABLISHED | grep -v " 192.168.178.66:21 "
  netstat -anp --tcp | grep vsftpd | grep ESTABLISHED | grep -v " 192.168.178.66:21 "
== Raspberry Pi Jessie Problem ==
user-nologin:x:1005:1001::/srv/ftp/user-nologin:/usr/sbin/nologin
user-false:x:1006:1001::/srv/ftp/user-false:/bin/false
user-bash:x:1007:1001::/srv/ftp/user-bash:/bin/bash
* I have 3 Users - only "user-bash" can login, but this is unsecure! Whats wrong?
# Core Settings
#
listen=YES
ftpd_banner="Welcome to pi2x00 FTP-service."
use_localtime=YES
local_umask=0000
chmod_enable=NO
hide_ids=YES
# Logging
#
xferlog_enable=YES
log_ftp_protocol=YES
vsftpd_log_file=/var/log/vsftpd.log
xferlog_file=/var/log/vsftpd-xfer.log
xferlog_std_format=YES
dual_log_enable=YES
# PASV
#
pasv_addr_resolve=YES
pasv_address=orgamon-2.dyndns.org
pasv_min_port=21000
pasv_max_port=21999
pasv_promiscuous=YES
# User - Authentification
#
write_enable=YES
anonymous_enable=NO
local_enable=YES
chroot_local_user=YES
#userlist_enable=YES
#userlist_deny=NO
#userlist_file=/etc/vsftpd.users
  #secure_chroot_dir=/var/run/vsftpd/empty
pam_service_name=vsftpd
allow_writeable_chroot=YES
nopriv_user=ftpsecure
# SSL
#
rsa_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem
rsa_private_key_file=/etc/ssl/private/ssl-cert-snakeoil.key
ssl_enable=NO

Version vom 25. August 2016, 21:26 Uhr

Installation

systemctl enable vsftpd
systemctl start vsftpd
groupadd www

Konfiguration

  • Typische Einstellungen für OrgaMon-App FTP-Server
#
# /etc/vsftpd.conf
#
write_enable=YES
dirmessage_enable=YES
nopriv_user=ftpsecure
ftpd_banner="Welcome to the OrgaMon-FTP-service."
ls_recurse_enable=YES
local_enable=YES
local_umask=0000
chroot_local_user=YES
allow_root_squashed_chroot=YES
allow_writeable_chroot=YES
anonymous_enable=NO
syslog_enable=NO
log_ftp_protocol=YES
xferlog_enable=YES
vsftpd_log_file=/var/log/vsftpd.log
xferlog_std_format=YES
xferlog_file=/var/log/vsftpd-xfer.log
dual_log_enable=YES
pam_service_name=vsftpd
listen_ipv6=NO
ssl_enable=NO
pasv_min_port=49152
pasv_max_port=52152
use_localtime=YES
  • zum Vergleich
#
# /etc/vsftpd.conf
#
write_enable=YES
dirmessage_enable=YES
dirlist_enable=YES
nopriv_user=ftpsecure
ftpd_banner="Welcome to the OrgaMon-FTP-service."
ls_recurse_enable=YES
local_enable=YES
local_umask=0000
chroot_local_user=YES
allow_root_squashed_chroot=YES
allow_writeable_chroot=YES
anonymous_enable=NO
syslog_enable=NO
log_ftp_protocol=YES
xferlog_enable=YES
vsftpd_log_file=/var/log/vsftpd.log
xferlog_std_format=YES
xferlog_file=/var/log/vsftpd-xfer.log
dual_log_enable=YES
pam_service_name=vsftpd
listen_ipv6=NO
ssl_enable=NO
pasv_min_port=49152
pasv_max_port=52152
use_localtime=YES


  • auf dem Raspberry Pi
# Core Settings
#
ftpd_banner="Welcome to pi2x01 at orgamon.de FTP-service."
use_localtime=YES
# *** listen=YES
# *** listen_ipv6=NO
anonymous_enable=NO
local_enable=YES
write_enable=YES
local_umask=0000
# *** dirmessage_enable=YES
# *** ls_recurse_enable=YES

# Logging
#
xferlog_enable=YES
log_ftp_protocol=YES
vsftpd_log_file=/var/log/vsftpd.log
xferlog_file=/var/log/vsftpd-xfer.log
xferlog_std_format=YES
# *** syslog_enable=NO
dual_log_enable=YES

# PASV
#
#pasv_addr_resolve=YES
pasv_address=217.91.31.84
pasv_min_port=21000
pasv_max_port=21999
pasv_promiscuous=YES

# Authentification
#
secure_chroot_dir=/var/run/vsftpd/empty
pam_service_name=vsftpd
chroot_local_user=YES
allow_writeable_chroot=YES
#nopriv_user=ftpsecure

# SSL
#
rsa_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem
rsa_private_key_file=/etc/ssl/private/ssl-cert-snakeoil.key
ssl_enable=NO


noch testen

chmod_enable=NO
hide_ids=YES
nopriv_user=ftpsecure

mehr über Datei-Rechte

# für rw-r--r--
local_umask=0022
# für rw-rw-rw-
local_umask=0000

Der Wert von local_umask wird hier von den Ausgangswerten des vsftp (666 und 777) abgezogen, so dass in diesem Beisiel 644 (Verzeichnisse) und 755 (Dateien) rauskommt.


mehr über SSL-Aktivierung

# SSL Sachen
ssl_enable=YES
rsa_cert_file=/etc/vsftpd/vsftpd.pem
force_local_data_ssl=NO
force_local_logins_ssl=NO

SSL Zertifikat selbst erstellen

cd /etc
md vsftpd
openssl req -x509 -nodes -days 365 -newkey rsa:1024 -keyout vsftpd.pem -out vsftpd.pem

Anlegen eines neuen ftp Benutzes

Im YaST2 einen neuen Benutzer anlegen:

  • Login muss erlaubt werden
  • Home-Verzeichnis wie gewünscht setzen, z.B. /srv/ftp/<Benutzername>
  • [x] Leeres Homeverzeichnis darf angekreuzt werden
  • Shell sollte auf /bin/false gesetzt werden
  • Standard Gruppe mache ich auf "ftp"
  • Die Zugehörigkeit auf "www" und "ftp"

Gedanken über Benutzer Beschränkungen

ftp Benutzer sollten kein ssh login machen können mail Benutzer sollten kein ftp/ssh login machen können: Zumindest in /etc/ftpusers können die Mail Benutzer eingetragen werden, hier werden alle Benutzer aufgeführt, die kein FTP machen dürfen.

Mounten eine ftp-Shares

Man kann die Verzeichnis-Struktur eines FTP-Servers in sein eigenes lokales Dateisystem einhängen: 

zypper install curlftpfs
md incoming
curlftpfs orgamon.net incoming/ -o user=incoming:******


Aushängen 

umount incoming/

Bug: File Mask ? do not work

#
#
#
LIST ?????.DAT

do not work any more

Double NAT Problem

  • Here is the solution running a FTP Server in ...
    • .. the local net
    • .. behind NAT via a Modem
    • .. behind NAT via a Router (wich is doing NAT too)
  • .. all in the same time, doing correct response to PASV

  • If the FTP-Server works behind one single NAT-Interface, PASV works without any Problems (In the Picture IP-C).
Internet calling Port 21
^
|
v
NAT @ IP-C
^
|
v 
vsftpd:21
 PASV:enter passive (IP-C,p1,p2)
  • But: If you have two NAT Routers between your PASV Response needs to be well formed
  • The Solution is to have 2 second Instance of vsftpd on another port, say 2121, route all the traffic from the double NATed to the 2121-Instance. Here you have a well formed static setting that ensures the correct PASV Host Adresse
    • listen_port=2121
    • pasv_address=217.91.31.84
  • Ensure that you have you local access routet to Port 21, the default vsftpd instance
Internet calling Port 21
^
|
v
NAT @ IP-A
^
|
v
NAT @ IP-B
 Redirect Port 21->2121
^
|
v 
vsftpd:2121
 PASV:enter passive (IP-B,p1,p2) will fail (that is the case if you do nothing)
 PASV:enter passive (IP-A,p1,p2) will do it, but you have to place IP-A in the config file of vsftpd


  • extent your xinetd-Configuration to ensure you have 2 vsftpd systems with different configurations (one listen on port 21, another on 2121)
    • /etc/xinet.d/vsftpd
# default: off
# description:
#   The vsftpd FTP server serves FTP connections. It uses
#   normal, unencrypted usernames and passwords for authentication.
# vsftpd is designed to be secure.
#
# NOTE: This file contains the configuration for xinetd to start vsftpd.
#       the configuration file for vsftp itself is in /etc/vsftpd.conf
service ftp
{
       socket_type     = stream
       protocol        = tcp
       wait            = no
       user            = root
       server          = /usr/sbin/vsftpd
}

service scientia-ssdb
{
       port = 2121
       socket_type     = stream
       protocol        = tcp
       wait            = no
       user            = root
       server          = /usr/sbin/vsftpd
       server_args     = /etc/vsftpd2.conf
}

Diagnose

Info über aktuelle bestehende Datenverbindungen

netstat -anp --tcp | grep vsftpd | grep ESTABLISHED | grep -v " 192.168.178.66:21 "


Raspberry Pi Jessie Problem

user-nologin:x:1005:1001::/srv/ftp/user-nologin:/usr/sbin/nologin
user-false:x:1006:1001::/srv/ftp/user-false:/bin/false
user-bash:x:1007:1001::/srv/ftp/user-bash:/bin/bash


  • I have 3 Users - only "user-bash" can login, but this is unsecure! Whats wrong?
# Core Settings
#
listen=YES
ftpd_banner="Welcome to pi2x00 FTP-service."
use_localtime=YES
local_umask=0000
chmod_enable=NO
hide_ids=YES

# Logging
#
xferlog_enable=YES
log_ftp_protocol=YES
vsftpd_log_file=/var/log/vsftpd.log
xferlog_file=/var/log/vsftpd-xfer.log
xferlog_std_format=YES
dual_log_enable=YES

# PASV
#
pasv_addr_resolve=YES
pasv_address=orgamon-2.dyndns.org
pasv_min_port=21000
pasv_max_port=21999
pasv_promiscuous=YES

# User - Authentification
#
write_enable=YES
anonymous_enable=NO
local_enable=YES
chroot_local_user=YES
#userlist_enable=YES
#userlist_deny=NO
#userlist_file=/etc/vsftpd.users
 #secure_chroot_dir=/var/run/vsftpd/empty
pam_service_name=vsftpd
allow_writeable_chroot=YES
nopriv_user=ftpsecure 

# SSL
#
rsa_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem
rsa_private_key_file=/etc/ssl/private/ssl-cert-snakeoil.key
ssl_enable=NO
Abgerufen von „https://wiki.orgamon.org/index.php?title=Linux.vsftp&oldid=25236“