某某大厂文件服务器配置

admin

# Example config file /etc/vsftpd/vsftpd.conf
#
# The default compiled in settings are fairly paranoid. This sample file
$ U4 R6 t7 u3 u$ p' j# loosens things up a bit, to make the ftp daemon more usable.
# Please see vsftpd.conf.5 for all compiled in defaults.
#
# READ THIS: This example file is NOT an exhaustive list of vsftpd options.
3 U! e: r9 ]% t# Please read the vsftpd.conf.5 manual page to get a full idea of vsftpd's
% @; ?$ D. z% ~' H& U# capabilities.
#
3 D' o- f6 C% Z# Allow anonymous FTP? (Beware - allowed by default if you comment this out).
anonymous_enable=NO
$ i5 q8 ]* {; Y$ A#
6 a$ ^+ c; \9 D; \' b# Uncomment this to allow local users to log in.
# When SELinux is enforcing check for SE bool ftp_home_dir
local_enable=YES
#
# Uncomment this to enable any form of FTP write command.
4 l' Q( N  d2 E4 l3 [' owrite_enable=YES
#
; ~; v8 w) g# m# v+ j. P* l# Default umask for local users is 077. You may wish to change this to 022,
# if your users expect that (022 is used by most other ftpd's)
8 h( n% C# ]5 h5 P: Dlocal_umask=022
( P/ `. m( j# J  G8 N# t- _4 o#
! W' q0 V' `! ]* }+ j: v# Uncomment this to allow the anonymous FTP user to upload files. This only
4 @4 w3 e0 `3 q5 G# has an effect if the above global write enable is activated. Also, you will
# obviously need to create a directory writable by the FTP user.
# When SELinux is enforcing check for SE bool allow_ftpd_anon_write, allow_ftpd_full_access
#anon_upload_enable=YES
#
# Uncomment this if you want the anonymous FTP user to be able to create
6 [8 {, b4 ?9 K6 _. _/ {& e# new directories.
1 R+ @; q8 Y  f, ^* x+ ]#anon_mkdir_write_enable=YES
#
# C$ ~% o( B8 F- P# @8 R7 H" y# Activate directory messages - messages given to remote users when they
% P3 f/ T+ |# b7 h0 a# go into a certain directory.
) }5 N+ S' \" M9 mdirmessage_enable=YES
#
+ S& `: s+ \4 f6 Y$ ]$ o/ A3 k4 ^# Activate logging of uploads/downloads.
xferlog_enable=YES
#
# Make sure PORT transfer connections originate from port 20 (ftp-data).
connect_from_port_20=YES
#
! m1 e' i% a' Q# X+ o, ~$ \# If you want, you can arrange for uploaded anonymous files to be owned by
% F& R: B( G3 _3 L3 H& V  X! w; q+ V, {# a different user. Note! Using "root" for uploaded files is not
4 _5 e- I- L3 G3 U4 F# recommended!
* h7 ]- H3 p- f#chown_uploads=YES
#chown_username=whoever
#
# You may override where the log file goes if you like. The default is shown
# below.
5 F+ U  {+ R: L7 t8 O* `xferlog_file=/var/log/xferlog
8 S" x. ]/ I) E  l#
# If you want, you can have your log file in standard ftpd xferlog format.
# Note that the default log file location is /var/log/xferlog in this case.
+ q7 r# `/ {' r# x% _xferlog_std_format=YES
#
2 `% q6 _) @5 D2 A9 ]1 s2 |# You may change the default value for timing out an idle session.
#idle_session_timeout=600
#
1 r% Z! n' x( e- s# p- c. Z# You may change the default value for timing out a data connection.
2 W# @! D6 ?! ?7 }#data_connection_timeout=120
9 Y8 U. I2 O) {9 R0 I) Z#
# It is recommended that you define on your system a unique user which the
! H: R2 B- Y( g: c' J' @$ {# ftp server can use as a totally isolated and unprivileged user.
#nopriv_user=ftpsecure
  f4 s2 J8 i# \; O; r/ V- {#
) O7 m9 h0 w" O7 X9 i# Enable this and the server will recognise asynchronous ABOR requests. Not
! e( E( I: c  I* h5 |# recommended for security (the code is non-trivial). Not enabling it,
# however, may confuse older FTP clients.
0 y$ x5 F; ?9 p! i, t9 c#async_abor_enable=YES
3 V: Q% ^* e/ I$ ?5 g#
# By default the server will pretend to allow ASCII mode but in fact ignore
) X8 C! ^( h  P" K* I8 O# the request. Turn on the below options to have the server actually do ASCII
# mangling on files when in ASCII mode. The vsftpd.conf(5) man page explains
7 v" l1 G& _, t) @# the behaviour when these options are disabled.
, i+ ~; u1 o- J6 H& `% ?# Beware that on some FTP servers, ASCII support allows a denial of service
# attack (DoS) via the command "SIZE /big/file" in ASCII mode. vsftpd
5 x, ^3 i  M. Z: t( A& |: S# predicted this attack and has always been safe, reporting the size of the
/ ?! @+ O  y& z6 ^3 J# raw file.
# ASCII mangling is a horrible feature of the protocol.
2 R) ?" `+ m/ {) s2 @, Hascii_upload_enable=YES
- _7 B- Y, |* a5 q) q. x& Qascii_download_enable=YES
#
- \. e. P+ }8 i6 a4 U; _# You may fully customise the login banner string:
$ d" L' f2 V+ }9 @#ftpd_banner=Welcome to blah FTP service.
#
9 k4 ?7 e" E1 Y7 u0 e2 G# You may specify a file of disallowed anonymous e-mail addresses. Apparently
9 Y4 B8 x; d6 T# useful for combatting certain DoS attacks.
#deny_email_enable=YES
# (default follows)
#banned_email_file=/etc/vsftpd/banned_emails
#
# You may specify an explicit list of local users to chroot() to their home
4 Z8 [- ?. e( K! Y9 Y( t4 w9 [# directory. If chroot_local_user is YES, then this list becomes a list of
# a& r$ c8 O, w# t: f) L, D# users to NOT chroot().
( r# K% T- B7 B; `# (Warning! chroot'ing can be very dangerous. If using chroot, make sure that
* q& `  O* j+ I: L7 ~" m# the user does not have write access to the top level directory within the
+ B, s) V5 P/ p+ \2 y) Q9 c/ l# chroot)
; E; l6 |! Z5 Tchroot_local_user=YES
6 N& E* C4 y( y2 _/ P' T4 w1 @#chroot_list_enable=YES
1 D1 E) \0 i2 p* B# (default follows)
; ^9 c: U8 S: v+ l8 b#chroot_list_file=/etc/vsftpd/chroot_list
2 X  I. s7 e( C' F3 F, I#
# You may activate the "-R" option to the builtin ls. This is disabled by
# default to avoid remote users being able to cause excessive I/O on large
& G) d" h; o3 a% ?, K- \5 E; j# sites. However, some broken FTP clients such as "ncftp" and "mirror" assume
' Z' v8 @2 z7 M, d: x$ V+ I# the presence of the "-R" option, so there is a strong case for enabling it.
! x7 ]9 G( d8 C+ e% Q1 a2 }#ls_recurse_enable=YES
#
# When "listen" directive is enabled, vsftpd runs in standalone mode and
# listens on IPv4 sockets. This directive cannot be used in conjunction
# with the listen_ipv6 directive.
listen=YES
4 @8 I. [5 `/ plisten_port=990
# \8 e5 h0 X; }$ N, M2 Ypasv_address=公网IP
#
: k5 R! P# l3 ]! _& W+ g# This directive enables listening on IPv6 sockets. By default, listening
# on the IPv6 "any" address (: will accept connections from both IPv6
# and IPv4 clients. It is not necessary to listen on *both* IPv4 and IPv6
5 I, O9 g* ]: \6 H" e# sockets. If you want that (perhaps because you want to listen on specific
# addresses) then you must run two copies of vsftpd with two configuration
# files.
# Make sure, that one of the listen options is commented !!
listen_ipv6=NO
pam_service_name=vsftpd
( R9 P+ m- E. B, s+ f& duserlist_enable=NO
2 {- A9 [3 X( r0 f: o' f( e2 Btcp_wrappers=YES
; w, |. o8 r/ T3 N- i' Y8 Lallow_writeable_chroot=YES
% Y% x# j& {+ buserlist_file=/etc/vsftpd/userlist
userlist_deny=NO
# ]! _( i' I) y# N7 assl_enable=YES
ssl_tlsv1_2=YES
3 h& x) q% J# o+ Nssl_sslv2=YES
1 z6 L2 a& b4 E, m8 c3 H3 Assl_sslv3=YES
rsa_cert_file=/etc/ssl/private/vsftpd.pem
  A$ @7 _& n/ t6 D7 T9 D2 Lrsa_private_key_file=/etc/ssl/private/vsftpd.pem
allow_anon_ssl=NO
force_local_data_ssl=YES
* w. {, l! m( [$ R- ^force_local_logins_ssl=YES
. |7 C6 S6 P( f: yrequire_ssl_reuse=NO
ssl_ciphers=HIGH
: ?$ ?9 }9 ?+ x9 G: j: aimplicit_ssl=YES
" Y( Y, A/ k; X$ e5 D3 qftp_data_port=50000
pasv_enable=YES
pasv_min_port=40000
* w; e5 h, m/ h4 h( F& R- z# M! Kpasv_max_port=50000
' ~% B+ `9 f+ Qport_enable=YES
debug_ssl=YES
pasv_promiscuous=YES   解决vsftpd连接错误425 Security: Bad IP connecting

6 G) j% E. @/ M& B& p" D9 K0 j
. M; Q  l) ~5 k6 \# u不知道他们IT修改了哪里  换个IP居然联不上  尼玛  把报错一个一个排查完