通过修改改/etc/hosts.allow 来实现访问控制 但是有个小问题（详见155楼（第11页））

[243750496]

太白痴了 。。。。 应该是local_root=/home/cc/AAA/BBB

[243750496]

开放所有，限制特定

可指定一组用户限制

chroot_local_user=NO
chroot_list_enable=YES
chroot_list_file=/etc/vsftpd.chroot_list

随后创建列表

sudo gedit /etc/vsftpd.chroot_list

我输入cc然后保存

一行一个用户名 重启vsftp

sudo service vsftpd restart

可是用filezilla照登cc不误

不是应该是限制cc登陆吗？？？

[243750496]

sudo useradd -s /usr/sbin/nologin 243750496 可以添加用户但不允许登陆

[243750496]

明白了，确实不是限制登录 从代码名字来看是来chroot的 即限制目录漂移（可以访问上级甚至上上级的任意文件夹）而不是限制登录

[243750496]

tcp_wrappers配置

stand alone模式下提供基于主机的访问控制的配置

tcp_wrappers使用/etc/hosts.allow和/etc/hosts.deny两个配置文件实现访问控制，hosts.allow是一个许可表，hosts.deny是一个拒绝表 在hosts.allow中也可以使用DENY,所以通常可以只使用hosts.allow来实现访问控制。 对vsftpd而言，书写hosts.allow有三种语法形式

1： vsftpd:主机表 （设置允许访问的主机表）
2： vsftpd:主机表:DENY （设置拒绝访问的主机表）
3： vsftpd:主机表:setenv VSFTPD_LOAD_CONF 配置文件名 （对指定的主机使用另外的配置）

setenv VSFTPD_LOAD_CONF的值为指定的配置文件名，意图是让vsftpd守护进程读取新的配置项来覆盖主配置文件中的项，实现特定待遇 这有一个小例子来说明tcp_wrappers

功能：
》1.拒绝192.168.2.0/24访问
》2.对192.168.1.0/24内的所有主机不作连接限制和最大传输速率限制
》3.对其他主机的访问限制为：每ip连接数为1，最大传输速率为10kb/s (在主配置文件中设置就好了)

首先保证设定

tcp_wrappers=YES

然后编辑

sudo vi /etc/hosts.allow

vsftpd:192.168.2.0/24: DENY （阻止192.168.2.0子网的访问）
vsftpd:192.168.1.0/24 （允许192.168.1.0子网的访问）
vsftpd:192.168.1.0/24: setenv VSFTPD_LOAD_CONF /etc/xxx.conf (对192.168.1.0/24指定专有配置文件xxx.conf，xxx可以自己指定文件名，需要建立)

然后建立xxx.conf文件，并编辑 （建立文件可以用sudo touch /etc/xxx.conf建立）

如果只设置
vsftpd:192.168.2.0/24: DENY （阻止192.168.2.0子网的访问）
那么是不是除了192.168.2.0子网不能访问其他所有都能访问
如果只设置
vsftpd:192.168.1.0/24 （允许192.168.1.0子网的访问）
是不是除了192.168.1.0子网外都不能访问
那按照这个逻辑 设置
vsftpd:192.168.2.0/24: DENY （阻止192.168.2.0子网的访问）
vsftpd:192.168.1.0/24 （允许192.168.1.0子网的访问）
他的意思是阻止192.168.2.0子网的访问和允许192.168.1.0子网的访问，那既不是192.168.1.0子网也不是192.168.2.0子网的网络呢？比如192.168.9.0子网 到底是允不允许？按找配置文件他应该是既不允许也不阻止 哪有这样的逻辑？
那这两条命令到底啥含义 阻止的啥 允许的啥 到底咋用？？？



虚拟路径

比如我的ftp的默认目录是/srv/ftp，我想把/mnt/LinG/WinSoft文件夹，映射到/srv/ftp目录中，我就如下操作 命令：

#mount --bind [原有的目录] [新目录]

先创建文件夹

sudo mkdir /srv/ftp/WinSoft

执行mount命令

sudo mount --bind /mnt/LinG/WinSoft /srv/ftp/WinSoft

可是我做了之后登录ftp只有一个空空的WinSoft，没有链接啊，那如果虚拟路径的意思真的是建立软链接？？？那我自己建立软链接岂不更方便？？？？ 如不是 那是啥意思
相关教程：http://wiki.ubuntu.org.cn/Vsftpd

[243750496]

viewtopic.php?f=54&t=444682
上面是155楼问题的解
然后按照http://wiki.ubuntu.org.cn/Vsftpd%E5%92%8Cmysql%E9%85%8D%E7%BD%AE设置
只需要在/etc/vsftpd.conf中加上
guest_enable=YES
guest_username=vsftpd
local_root=/home/vsftpd/$USER
user_sub_token=$USER
virtual_use_local_privs=YES
user_config_dir=/etc/vsftpd_user_conf
就可以实现
如那个命令不懂打开下面网页然后ctrl+F搜索即可
viewtopic.php?f=54&t=444033

[243750496]

# Example config file /etc/vsftpd.conf
#
# The default compiled in settings are fairly paranoid. This sample file
# loosens things up a bit, to make the ftp daemon more usable.
# Please see vsftpd.conf.5 for all compiled in defaults.
#
# READ THIS: This example file is NOT an exhaustive list of vsftpd options.
# Please read the vsftpd.conf.5 manual page to get a full idea of vsftpd's
# capabilities.
#
#
# Run standalone? vsftpd can run either from an inetd or as a standalone
# daemon started from an initscript.
listen=YES
#
# Run standalone with IPv6?
# Like the listen parameter, except vsftpd will listen on an IPv6 socket
# instead of an IPv4 one. This parameter and the listen parameter are mutually
# exclusive.
#listen_ipv6=YES
#
# Allow anonymous FTP? (Disabled by default)
anonymous_enable=NO
#
# Uncomment this to allow local users to log in.
local_enable=YES
#
# Uncomment this to enable any form of FTP write command.
write_enable=YES
#
# Default umask for local users is 077. You may wish to change this to 022,
# if your users expect that (022 is used by most other ftpd's)
anon_umask=022
#local_umask=022
#
# Uncomment this to allow the anonymous FTP user to upload files. This only
# has an effect if the above global write enable is activated. Also, you will
# obviously need to create a directory writable by the FTP user.
anon_upload_enable=YES
#
# Uncomment this if you want the anonymous FTP user to be able to create
# new directories.
anon_mkdir_write_enable=YES
#
# Activate directory messages - messages given to remote users when they
# go into a certain directory.
dirmessage_enable=YES
#
# If enabled, vsftpd will display directory listings with the time
# in your local time zone. The default is to display GMT. The
# times returned by the MDTM FTP command are also affected by this
# option.
use_localtime=YES
#
# Activate logging of uploads/downloads.
xferlog_enable=YES
#
# Make sure PORT transfer connections originate from port 20 (ftp-data).
connect_from_port_20=YES
#
# If you want, you can arrange for uploaded anonymous files to be owned by
# a different user. Note! Using "root" for uploaded files is not
# recommended!
seccomp_sandbox=NO
chown_uploads=YES
chown_username=root
#
# You may override where the log file goes if you like. The default is shown
# below.
#xferlog_file=/var/log/vsftpd.log
#
# If you want, you can have your log file in standard ftpd xferlog format.
# Note that the default log file location is /var/log/xferlog in this case.
#xferlog_std_format=YES
#
# You may change the default value for timing out an idle session.
#idle_session_timeout=600
#
# You may change the default value for timing out a data connection.
#data_connection_timeout=120
#
# It is recommended that you define on your system a unique user which the
# ftp server can use as a totally isolated and unprivileged user.
#nopriv_user=ftpsecure
#
# Enable this and the server will recognise asynchronous ABOR requests. Not
# recommended for security (the code is non-trivial). Not enabling it,
# however, may confuse older FTP clients.
#async_abor_enable=YES
#
# By default the server will pretend to allow ASCII mode but in fact ignore
# the request. Turn on the below options to have the server actually do ASCII
# mangling on files when in ASCII mode.
# Beware that on some FTP servers, ASCII support allows a denial of service
# attack (DoS) via the command "SIZE /big/file" in ASCII mode. vsftpd
# predicted this attack and has always been safe, reporting the size of the
# raw file.
# ASCII mangling is a horrible feature of the protocol.
#ascii_upload_enable=YES
#ascii_download_enable=YES
#
# You may fully customise the login banner string:
#ftpd_banner=Welcome to blah FTP service.
#
# You may specify a file of disallowed anonymous e-mail addresses. Apparently
# useful for combatting certain DoS attacks.
#deny_email_enable=YES
# (default follows)
#banned_email_file=/etc/vsftpd.banned_emails
#
# You may restrict local users to their home directories. See the FAQ for
# the possible risks in this before using chroot_local_user or
# chroot_list_enable below.
#chroot_local_user=YES
#
# You may specify an explicit list of local users to chroot() to their home
# directory. If chroot_local_user is YES, then this list becomes a list of
# users to NOT chroot().
# (Warning! chroot'ing can be very dangerous. If using chroot, make sure that
# the user does not have write access to the top level directory within the
# chroot)
#chroot_local_user=YES
#chroot_list_enable=YES
# (default follows)
#chroot_list_file=/etc/vsftpd.chroot_list
#
# You may activate the "-R" option to the builtin ls. This is disabled by
# default to avoid remote users being able to cause excessive I/O on large
# sites. However, some broken FTP clients such as "ncftp" and "mirror" assume
# the presence of the "-R" option, so there is a strong case for enabling it.
#ls_recurse_enable=YES
#
# Customization
#
# Some of vsftpd's settings don't fit the filesystem layout by
# default.
#
# This option should be the name of a directory which is empty. Also, the
# directory should not be writable by the ftp user. This directory is used
# as a secure chroot() jail at times vsftpd does not require filesystem
# access.
secure_chroot_dir=/var/run/vsftpd/empty
#
# This string is the name of the PAM service vsftpd will use.
pam_service_name=vsftpd
#
anon_root=/home/cc/AAA
local_root=/home/cc/AAA
guest_enable=YES
guest_username=vsftpd
virtual_use_local_privs=NO
user_config_dir=/etc/vsftpd_user_conf
# This option specifies the location of the RSA certificate to use for SSL
# encrypted connections.
rsa_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem
# This option specifies the location of the RSA key to use for SSL
# encrypted connections.
rsa_private_key_file=/etc/ssl/private/ssl-cert-snakeoil.key

[243750496]

设置好mysql的虚拟用户后本地用户cc无法登录了？？？530 Login incorrect 十万火急！！！！！！！！
viewtopic.php?f=54&t=445321
这篇帖子求解答

[jinjiachen]

很佩服你的折腾精神