Proftp最简匿名访问配置

前言

每一次做ftp的配置都要弄半天，找文档，各种权限控制的坑，折腾半天，这次还是准备记录下来，以备不时之需，这里不配置什么高级的功能，就去实现一个最简单的配置

匿名用户的上传和下载

配置proftp过程

配置过程尽量少的动原配置文件，需要共享的为/share/a目录，首先修改默认的目录

DefaultRoot                     ~ !adm

修改为:

DefaultRoot                     /share

让默认的根目录为 /share,默认的为用户的根目录，匿名用户对应的ftp用户的根目录

修改匿名用户的目录

<Anonymous ~ftp>

修改为

<Anonymous /share>

修改原匿名用户ftp的用户目录为/share

修改默认屏蔽权限WRITE

    <Limit WRITE SITE_CHMOD>
      DenyAll
    </Limit>

改成

    <Limit  SITE_CHMOD>
      DenyAll
    </Limit>

默认会屏蔽掉写的操作，就没法上传了

配置访问的目录

默认启用了vroot，所以写路径的时候写相对路径即可，添加如下：

    <Directory "/*">
        AllowOverwrite          no
        <Limit ALL>
            DenyAll
        </Limit>
        <Limit DIRS>
            AllowAll
        </Limit>
    </Directory>
    <Directory "/a">
        AllowOverwrite          no
        <Limit ALL>
            AllowAll
        </Limit>
    </Directory>

/a就代表的是/share/a

开启匿名

修改配置vim /etc/sysconfig/proftpd

PROFTPD_OPTIONS=""

改成:

PROFTPD_OPTIONS="-DANONYMOUS_FTP"

给目录访问权限

chown ftp:ftp /share/a
chmod 755  /share/a

启动proftp服务

systemctl restart proftpd

完整配置文件

ServerName			"ProFTPD server"
ServerIdent			on "FTP Server ready."
ServerAdmin			root@localhost
DefaultServer			on
DefaultRoot			~ !adm
AuthPAMConfig			proftpd
AuthOrder			mod_auth_pam.c* mod_auth_unix.c
UseReverseDNS			off
User				nobody
Group				nobody
MaxInstances			20
UseSendfile			off
LogFormat			default	"%h %l %u %t \"%r\" %s %b"
LogFormat			auth	"%v [%P] %h %t \"%r\" %s"
LoadModule mod_ctrls_admin.c
LoadModule mod_vroot.c
ModuleControlsACLs		insmod,rmmod allow user root
ModuleControlsACLs		lsmod allow user *
ControlsEngine			on
ControlsACLs			all allow user root
ControlsSocketACL		allow user *
ControlsLog			/var/log/proftpd/controls.log
<IfModule mod_ctrls_admin.c>
  AdminControlsEngine		on
  AdminControlsACLs		all allow user root
</IfModule>
<IfModule mod_vroot.c>
  VRootEngine			on
</IfModule>
<IfDefine TLS>
  TLSEngine			on
  TLSRequired			on
  TLSRSACertificateFile		/etc/pki/tls/certs/proftpd.pem
  TLSRSACertificateKeyFile	/etc/pki/tls/certs/proftpd.pem
  TLSCipherSuite		ALL:!ADH:!DES
  TLSOptions			NoCertRequest
  TLSVerifyClient		off
  TLSLog			/var/log/proftpd/tls.log
  <IfModule mod_tls_shmcache.c>
    TLSSessionCache		shm:/file=/var/run/proftpd/sesscache
  </IfModule>
</IfDefine>
<IfDefine DYNAMIC_BAN_LISTS>
  LoadModule			mod_ban.c
  BanEngine			on
  BanLog			/var/log/proftpd/ban.log
  BanTable			/var/run/proftpd/ban.tab
  BanOnEvent			MaxLoginAttempts 2/00:10:00 01:00:00
  BanMessage			"Host %a has been banned"
  BanControlsACLs		all allow user ftpadm
</IfDefine>
<IfDefine QOS>
  LoadModule			mod_qos.c
  QoSOptions			dataqos throughput ctrlqos lowdelay
</IfDefine>
<Global>
  Umask				022
  AllowOverwrite		yes
  <Limit ALL SITE_CHMOD>
    AllowAll
  </Limit>
</Global>
<IfDefine ANONYMOUS_FTP>
  <Anonymous /share/>
    User			ftp
    Group			ftp
    AccessGrantMsg		"Anonymous login ok, restrictions apply."
    UserAlias			anonymous ftp
    MaxClients			10 "Sorry, max %m users -- try again later"
    DisplayLogin		/welcome.msg
    DisplayChdir		.message
    DisplayReadme		README*
    DirFakeUser			on ftp
    DirFakeGroup		on ftp
    <Limit  SITE_CHMOD>
      DenyAll
    </Limit>
    <IfModule mod_vroot.c>
       <Directory "/*">
	       AllowOverwrite          no
        <Limit ALL>
        DenyAll
        </Limit>
        <Limit DIRS>
        AllowAll
        </Limit>
       </Directory>
       <Directory "/a">
              AllowOverwrite          no
        <Limit ALL>
          AllowAll
        </Limit>
       </Directory>
    </IfModule>
    WtmpLog			off
    ExtendedLog			/var/log/proftpd/access.log WRITE,READ default
    ExtendedLog			/var/log/proftpd/auth.log AUTH auth
  </Anonymous>
</IfDefine>

总结

最简配置就完成了，也可以根据需要再去做更复杂的配置，这里就不做过多的介绍，比较容易错误的点就是容易出现权限问题无法访问，或者是上下的设置关联错误，可以开启调试模式进行调试

proftpd   -n -d 10 -c /etc/proftpd.conf -DANONYMOUS_FTP

变更记录

Why	Who	When
创建	武汉-运维-磨渣	2016-09-01