通过修改改/etc/hosts.allow 来实现访问控制 但是有个小问题(详见155楼(第11页))

上网、浏览、聊天、下载等
回复
243750496
帖子: 1037
注册时间: 2012-06-09 15:40
送出感谢: 0
接收感谢: 7 次

Re: vsftp 500 OOPS: priv_sock_get_cmd 错误: 严重文件传输错误(123楼 求高人来

#151

帖子 243750496 » 2013-06-25 14:07

太白痴了 。。。。 应该是local_root=/home/cc/AAA/BBB
243750496
帖子: 1037
注册时间: 2012-06-09 15:40
送出感谢: 0
接收感谢: 7 次

Re: vsftp 500 OOPS: priv_sock_get_cmd 错误: 严重文件传输错误(123楼 求高人来

#152

帖子 243750496 » 2013-06-25 17:47

开放所有,限制特定

可指定一组用户限制

chroot_local_user=NO
chroot_list_enable=YES
chroot_list_file=/etc/vsftpd.chroot_list

随后创建列表

sudo gedit /etc/vsftpd.chroot_list

我输入cc然后保存

一行一个用户名 重启vsftp

sudo service vsftpd restart

可是用filezilla照登cc不误

不是应该是限制cc登陆吗???
243750496
帖子: 1037
注册时间: 2012-06-09 15:40
送出感谢: 0
接收感谢: 7 次

Re: vsftp 500 OOPS: priv_sock_get_cmd 错误: 严重文件传输错误(123楼 求高人来

#153

帖子 243750496 » 2013-06-26 21:56

sudo useradd -s /usr/sbin/nologin 243750496 可以添加用户但不允许登陆
243750496
帖子: 1037
注册时间: 2012-06-09 15:40
送出感谢: 0
接收感谢: 7 次

Re: vsftp 500 OOPS: priv_sock_get_cmd 错误: 严重文件传输错误(123楼 求高人来

#154

帖子 243750496 » 2013-06-27 9:46

明白了,确实不是限制登录 从代码名字来看是来chroot的 即限制目录漂移(可以访问上级甚至上上级的任意文件夹)而不是限制登录
243750496
帖子: 1037
注册时间: 2012-06-09 15:40
送出感谢: 0
接收感谢: 7 次

Re: vsftp 500 OOPS: priv_sock_get_cmd 错误: 严重文件传输错误(123楼 求高人来

#155

帖子 243750496 » 2013-06-30 18:19

tcp_wrappers配置

stand alone模式下提供基于主机的访问控制的配置

tcp_wrappers使用/etc/hosts.allow和/etc/hosts.deny两个配置文件实现访问控制,hosts.allow是一个许可表,hosts.deny是一个拒绝表 在hosts.allow中也可以使用DENY,所以通常可以只使用hosts.allow来实现访问控制。 对vsftpd而言,书写hosts.allow有三种语法形式

1: vsftpd:主机表 (设置允许访问的主机表)
2: vsftpd:主机表:DENY (设置拒绝访问的主机表)
3: vsftpd:主机表:setenv VSFTPD_LOAD_CONF 配置文件名 (对指定的主机使用另外的配置)

setenv VSFTPD_LOAD_CONF的值为指定的配置文件名,意图是让vsftpd守护进程读取新的配置项来覆盖主配置文件中的项,实现特定待遇 这有一个小例子来说明tcp_wrappers

功能:
》1.拒绝192.168.2.0/24访问
》2.对192.168.1.0/24内的所有主机不作连接限制和最大传输速率限制
》3.对其他主机的访问限制为:每ip连接数为1,最大传输速率为10kb/s (在主配置文件中设置就好了)

首先保证设定

tcp_wrappers=YES

然后编辑

sudo vi /etc/hosts.allow

vsftpd:192.168.2.0/24: DENY (阻止192.168.2.0子网的访问)
vsftpd:192.168.1.0/24 (允许192.168.1.0子网的访问)
vsftpd:192.168.1.0/24: setenv VSFTPD_LOAD_CONF /etc/xxx.conf (对192.168.1.0/24指定专有配置文件xxx.conf,xxx可以自己指定文件名,需要建立)

然后建立xxx.conf文件,并编辑 (建立文件可以用sudo touch /etc/xxx.conf建立)

如果只设置
vsftpd:192.168.2.0/24: DENY (阻止192.168.2.0子网的访问)
那么是不是除了192.168.2.0子网不能访问其他所有都能访问
如果只设置
vsftpd:192.168.1.0/24 (允许192.168.1.0子网的访问)
是不是除了192.168.1.0子网外都不能访问
那按照这个逻辑 设置
vsftpd:192.168.2.0/24: DENY (阻止192.168.2.0子网的访问)
vsftpd:192.168.1.0/24 (允许192.168.1.0子网的访问)
他的意思是阻止192.168.2.0子网的访问和允许192.168.1.0子网的访问,那既不是192.168.1.0子网也不是192.168.2.0子网的网络呢?比如192.168.9.0子网 到底是允不允许?按找配置文件他应该是既不允许也不阻止 哪有这样的逻辑?
那这两条命令到底啥含义 阻止的啥 允许的啥 到底咋用???



虚拟路径

比如我的ftp的默认目录是/srv/ftp,我想把/mnt/LinG/WinSoft文件夹,映射到/srv/ftp目录中,我就如下操作 命令:

#mount --bind [原有的目录] [新目录]

先创建文件夹

sudo mkdir /srv/ftp/WinSoft

执行mount命令

sudo mount --bind /mnt/LinG/WinSoft /srv/ftp/WinSoft

可是我做了之后登录ftp只有一个空空的WinSoft,没有链接啊,那如果虚拟路径的意思真的是建立软链接???那我自己建立软链接岂不更方便???? 如不是 那是啥意思
相关教程:http://wiki.ubuntu.org.cn/Vsftpd
243750496
帖子: 1037
注册时间: 2012-06-09 15:40
送出感谢: 0
接收感谢: 7 次

Re: 通过修改改/etc/hosts.allow 来实现访问控制 但是有个小问题(详见155楼(第11页))

#156

帖子 243750496 » 2013-07-05 22:30

viewtopic.php?f=54&t=444682
上面是155楼问题的解
然后按照http://wiki.ubuntu.org.cn/Vsftpd%E5%92%8Cmysql%E9%85%8D%E7%BD%AE设置
只需要在/etc/vsftpd.conf中加上
guest_enable=YES
guest_username=vsftpd
local_root=/home/vsftpd/$USER
user_sub_token=$USER
virtual_use_local_privs=YES
user_config_dir=/etc/vsftpd_user_conf
就可以实现
如那个命令不懂打开下面网页然后ctrl+F搜索即可
viewtopic.php?f=54&t=444033
243750496
帖子: 1037
注册时间: 2012-06-09 15:40
送出感谢: 0
接收感谢: 7 次

Re: 通过修改改/etc/hosts.allow 来实现访问控制 但是有个小问题(详见155楼(第11页))

#157

帖子 243750496 » 2013-07-06 21:06

# Example config file /etc/vsftpd.conf
#
# The default compiled in settings are fairly paranoid. This sample file
# loosens things up a bit, to make the ftp daemon more usable.
# Please see vsftpd.conf.5 for all compiled in defaults.
#
# READ THIS: This example file is NOT an exhaustive list of vsftpd options.
# Please read the vsftpd.conf.5 manual page to get a full idea of vsftpd's
# capabilities.
#
#
# Run standalone? vsftpd can run either from an inetd or as a standalone
# daemon started from an initscript.
listen=YES
#
# Run standalone with IPv6?
# Like the listen parameter, except vsftpd will listen on an IPv6 socket
# instead of an IPv4 one. This parameter and the listen parameter are mutually
# exclusive.
#listen_ipv6=YES
#
# Allow anonymous FTP? (Disabled by default)
anonymous_enable=NO
#
# Uncomment this to allow local users to log in.
local_enable=YES
#
# Uncomment this to enable any form of FTP write command.
write_enable=YES
#
# Default umask for local users is 077. You may wish to change this to 022,
# if your users expect that (022 is used by most other ftpd's)
anon_umask=022
#local_umask=022
#
# Uncomment this to allow the anonymous FTP user to upload files. This only
# has an effect if the above global write enable is activated. Also, you will
# obviously need to create a directory writable by the FTP user.
anon_upload_enable=YES
#
# Uncomment this if you want the anonymous FTP user to be able to create
# new directories.
anon_mkdir_write_enable=YES
#
# Activate directory messages - messages given to remote users when they
# go into a certain directory.
dirmessage_enable=YES
#
# If enabled, vsftpd will display directory listings with the time
# in your local time zone. The default is to display GMT. The
# times returned by the MDTM FTP command are also affected by this
# option.
use_localtime=YES
#
# Activate logging of uploads/downloads.
xferlog_enable=YES
#
# Make sure PORT transfer connections originate from port 20 (ftp-data).
connect_from_port_20=YES
#
# If you want, you can arrange for uploaded anonymous files to be owned by
# a different user. Note! Using "root" for uploaded files is not
# recommended!
seccomp_sandbox=NO
chown_uploads=YES
chown_username=root
#
# You may override where the log file goes if you like. The default is shown
# below.
#xferlog_file=/var/log/vsftpd.log
#
# If you want, you can have your log file in standard ftpd xferlog format.
# Note that the default log file location is /var/log/xferlog in this case.
#xferlog_std_format=YES
#
# You may change the default value for timing out an idle session.
#idle_session_timeout=600
#
# You may change the default value for timing out a data connection.
#data_connection_timeout=120
#
# It is recommended that you define on your system a unique user which the
# ftp server can use as a totally isolated and unprivileged user.
#nopriv_user=ftpsecure
#
# Enable this and the server will recognise asynchronous ABOR requests. Not
# recommended for security (the code is non-trivial). Not enabling it,
# however, may confuse older FTP clients.
#async_abor_enable=YES
#
# By default the server will pretend to allow ASCII mode but in fact ignore
# the request. Turn on the below options to have the server actually do ASCII
# mangling on files when in ASCII mode.
# Beware that on some FTP servers, ASCII support allows a denial of service
# attack (DoS) via the command "SIZE /big/file" in ASCII mode. vsftpd
# predicted this attack and has always been safe, reporting the size of the
# raw file.
# ASCII mangling is a horrible feature of the protocol.
#ascii_upload_enable=YES
#ascii_download_enable=YES
#
# You may fully customise the login banner string:
#ftpd_banner=Welcome to blah FTP service.
#
# You may specify a file of disallowed anonymous e-mail addresses. Apparently
# useful for combatting certain DoS attacks.
#deny_email_enable=YES
# (default follows)
#banned_email_file=/etc/vsftpd.banned_emails
#
# You may restrict local users to their home directories. See the FAQ for
# the possible risks in this before using chroot_local_user or
# chroot_list_enable below.
#chroot_local_user=YES
#
# You may specify an explicit list of local users to chroot() to their home
# directory. If chroot_local_user is YES, then this list becomes a list of
# users to NOT chroot().
# (Warning! chroot'ing can be very dangerous. If using chroot, make sure that
# the user does not have write access to the top level directory within the
# chroot)
#chroot_local_user=YES
#chroot_list_enable=YES
# (default follows)
#chroot_list_file=/etc/vsftpd.chroot_list
#
# You may activate the "-R" option to the builtin ls. This is disabled by
# default to avoid remote users being able to cause excessive I/O on large
# sites. However, some broken FTP clients such as "ncftp" and "mirror" assume
# the presence of the "-R" option, so there is a strong case for enabling it.
#ls_recurse_enable=YES
#
# Customization
#
# Some of vsftpd's settings don't fit the filesystem layout by
# default.
#
# This option should be the name of a directory which is empty. Also, the
# directory should not be writable by the ftp user. This directory is used
# as a secure chroot() jail at times vsftpd does not require filesystem
# access.
secure_chroot_dir=/var/run/vsftpd/empty
#
# This string is the name of the PAM service vsftpd will use.
pam_service_name=vsftpd
#
anon_root=/home/cc/AAA
local_root=/home/cc/AAA
guest_enable=YES
guest_username=vsftpd
virtual_use_local_privs=NO
user_config_dir=/etc/vsftpd_user_conf
# This option specifies the location of the RSA certificate to use for SSL
# encrypted connections.
rsa_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem
# This option specifies the location of the RSA key to use for SSL
# encrypted connections.
rsa_private_key_file=/etc/ssl/private/ssl-cert-snakeoil.key
243750496
帖子: 1037
注册时间: 2012-06-09 15:40
送出感谢: 0
接收感谢: 7 次

Re: 通过修改改/etc/hosts.allow 来实现访问控制 但是有个小问题(详见155楼(第11页))

#158

帖子 243750496 » 2013-07-09 20:32

设置好mysql的虚拟用户后本地用户cc无法登录了???530 Login incorrect 十万火急!!!!!!!!
viewtopic.php?f=54&t=445321
这篇帖子求解答
jinjiachen
帖子: 2127
注册时间: 2012-12-16 15:43
系统: debian
送出感谢: 9 次
接收感谢: 27 次

Re: 通过修改改/etc/hosts.allow 来实现访问控制 但是有个小问题(详见155楼(第11页))

#159

帖子 jinjiachen » 2019-03-26 13:28

很佩服你的折腾精神
回复

回到 “互联网相关软件”