Vsftp installation creates users and limits users to their own directories
1、 Check if vsftpd has been installed
vsftpd -version
2、 Install vsftpd (CentOS7)
yum install -y vsftpd
3、 New FTP directory
The FTP directory created is as follows:
/data/KodServer/data/User/tomas/home
4、 Create new user
ftpname is the username you created for the ftp, and /data/KodServer/data/User/tomas/home is the location after logging in
useradd -d /data/KodServer/data/User/tomas/home -s /bin/bash ftpname
5、 Set a password for the newly created user
passwd ftpname
[Remark: Use cat etc/passwd to view current system users]
6、 Set the home directory (change the directory you see when you log in, depending on your personal needs, if step 4 has been set, this step can be ignored)
usermod -d /data/KodServer/data/User/tomas/home ftpname
7、 Add user group (this step can be ignored)
groupadd ftpgroup
8、 Add FTP service to firewall
firewall-cmd --permanent --zone=public --add-service=ftp
firewall-cmd --reload
Solution:
①, check the Selinux status of ftp: sestatus -b | grep ftp
②. You can see in the result: ftp_home_dir off
③. Change the status to on: setsebool -P ftp_home_dir on
④, restart vsftp service: systemctl restart vsftpd.service
setsebool -P ftpd_full_access on
systemctl restart firewalld.service
9、 The configuration can only access its own directory (/data/KodServer/data/User/tomas/home), not other paths
Modify /etc/vsftpd.conf
cd /etc/vsftpd/
vi vsftpd.conf
chroot_local_user=YES
ascii_upload_enable=YES
ascii_download_enable=YES
allow_writeable_chroot=YES
Save and restart vsftpd
Set boot up:
systemctl enable vsftpd.service
Start the vsftpd service
systemctl start vsftpd.service
Prohibit ftp users from logging in to the ftp server through port 22:
Due to the need to restrict ftp users to their own directories, there is no problem under port 21, but when ftp users log in with sftp, they can still access the upper-level directory, so the ftp user ssh login is prohibited and the communication on port 22 is cut off.
First, execute the following command to find the shell of nologin:
vi /etc/shells
You can see that the shell file forbidden to log in is /usr/sbin/nologin, and then execute the following command:
usermod -s /usr/sbin/nologin tomas
If you want to restore tomas's ssh login, execute the following command:
usermod -s /bin/bash tomas
Recommended Posts