某某大厂文件服务器配置

admin

# Example config file /etc/vsftpd/vsftpd.conf
2 d3 ^* Y' Z2 D1 R% A2 Z0 W#
# The default compiled in settings are fairly paranoid. This sample file
: B! a+ c2 @: e3 y# loosens things up a bit, to make the ftp daemon more usable.
# Please see vsftpd.conf.5 for all compiled in defaults.
5 X, @" F, C5 V  l; u% }2 I#
) n+ O$ u7 ^0 k5 _% ^$ z' O8 m# READ THIS: This example file is NOT an exhaustive list of vsftpd options.
# Please read the vsftpd.conf.5 manual page to get a full idea of vsftpd's
& {4 _- y  f: `) Y) o- r# capabilities.
#
  {% Z! F2 I+ H7 e# Allow anonymous FTP? (Beware - allowed by default if you comment this out).
anonymous_enable=NO
1 J3 A6 H; e! o3 k#
# Uncomment this to allow local users to log in.
# When SELinux is enforcing check for SE bool ftp_home_dir
: {2 P' r+ o" |& w8 R, Q1 tlocal_enable=YES
#
; F& V. p0 k& M- a8 B" i( S# Uncomment this to enable any form of FTP write command.
write_enable=YES
2 V7 q) t# x# Y! |0 r1 E6 |8 S#
" x1 [  d' a, B! ^" Y; @4 Z# Default umask for local users is 077. You may wish to change this to 022,
: j& n- R" x; v! W  J0 q# v# if your users expect that (022 is used by most other ftpd's)
) P/ x& N) w; ^& ^9 h% c7 p5 g' i! u# ~local_umask=022
#
# Uncomment this to allow the anonymous FTP user to upload files. This only
2 [/ h, x& O+ q; f# has an effect if the above global write enable is activated. Also, you will
# obviously need to create a directory writable by the FTP user.
# When SELinux is enforcing check for SE bool allow_ftpd_anon_write, allow_ftpd_full_access
#anon_upload_enable=YES
+ B" }" y4 I% K! @#
* {6 ]0 ]: @# A% `  E0 E# Uncomment this if you want the anonymous FTP user to be able to create
# new directories.
2 p& V9 i" Y' F& Y/ z6 b#anon_mkdir_write_enable=YES
#
1 {9 W% ]- r8 J# Activate directory messages - messages given to remote users when they
4 L4 ?9 h0 o% @! K# go into a certain directory.
dirmessage_enable=YES
#
3 R6 U$ _" J/ [& |3 e. a4 }2 R# Activate logging of uploads/downloads.
xferlog_enable=YES
#
# Make sure PORT transfer connections originate from port 20 (ftp-data).
connect_from_port_20=YES
6 f: V# D5 [) F3 F. A: Q#
' c8 e# v0 ?- |' R2 k7 P7 ?# If you want, you can arrange for uploaded anonymous files to be owned by
; B7 `9 o% P. X9 H2 I9 |# a different user. Note! Using "root" for uploaded files is not
: }) J; C6 O- I! W/ N7 T# recommended!
: K' I$ z" j4 i0 s0 A% X5 ^# \' u#chown_uploads=YES
#chown_username=whoever
#
# You may override where the log file goes if you like. The default is shown
( n: ?% K% h3 l1 [7 c% R# below.
xferlog_file=/var/log/xferlog
" d/ \% v. T, J#
# If you want, you can have your log file in standard ftpd xferlog format.
4 K- b2 ~- Y& Q* m& J3 @2 o2 Y# Note that the default log file location is /var/log/xferlog in this case.
xferlog_std_format=YES
#
# You may change the default value for timing out an idle session.
1 {7 _4 U! P( T- M; j: h#idle_session_timeout=600
#
# You may change the default value for timing out a data connection.
#data_connection_timeout=120
#
8 t+ G1 \( J, V. x% v# It is recommended that you define on your system a unique user which the
# ftp server can use as a totally isolated and unprivileged user.
#nopriv_user=ftpsecure
#
# Enable this and the server will recognise asynchronous ABOR requests. Not
+ ]* n( X, o: j! E& B1 i# recommended for security (the code is non-trivial). Not enabling it,
- y- x# g  {$ j8 h# j# however, may confuse older FTP clients.
#async_abor_enable=YES
#
# By default the server will pretend to allow ASCII mode but in fact ignore
# the request. Turn on the below options to have the server actually do ASCII
# mangling on files when in ASCII mode. The vsftpd.conf(5) man page explains
# the behaviour when these options are disabled.
. [$ t3 D4 P9 f* B' U( v% x) c# Beware that on some FTP servers, ASCII support allows a denial of service
# attack (DoS) via the command "SIZE /big/file" in ASCII mode. vsftpd
  g( V7 F1 _. F- Q0 |; ^# predicted this attack and has always been safe, reporting the size of the
* U; b: f: b( t( [# raw file.
# ASCII mangling is a horrible feature of the protocol.
7 c+ q: _( O7 l# @6 P0 P# H- f6 Nascii_upload_enable=YES
ascii_download_enable=YES
$ w. |3 j  c$ S#
# You may fully customise the login banner string:
9 C, a4 j8 ?/ n: P#ftpd_banner=Welcome to blah FTP service.
#
# You may specify a file of disallowed anonymous e-mail addresses. Apparently
# useful for combatting certain DoS attacks.
#deny_email_enable=YES
# (default follows)
#banned_email_file=/etc/vsftpd/banned_emails
#
# You may specify an explicit list of local users to chroot() to their home
# directory. If chroot_local_user is YES, then this list becomes a list of
# users to NOT chroot().
# (Warning! chroot'ing can be very dangerous. If using chroot, make sure that
# the user does not have write access to the top level directory within the
3 P; ]. e! f9 j$ v& |# chroot)
7 y5 ]' f* s! P6 g- |chroot_local_user=YES
0 O% L7 v- J  R; i8 `$ d8 O2 U/ g5 K#chroot_list_enable=YES
; S, O: s; V3 G# (default follows)
#chroot_list_file=/etc/vsftpd/chroot_list
; e# t0 ]4 Q4 k" a+ D4 u, s#
# You may activate the "-R" option to the builtin ls. This is disabled by
3 `( r8 m& a; ~& u' _# default to avoid remote users being able to cause excessive I/O on large
4 _" H6 {2 W% s3 R! g; B4 @2 I# sites. However, some broken FTP clients such as "ncftp" and "mirror" assume
# the presence of the "-R" option, so there is a strong case for enabling it.
: h* H5 ]& R- }5 x#ls_recurse_enable=YES
#
# When "listen" directive is enabled, vsftpd runs in standalone mode and
# listens on IPv4 sockets. This directive cannot be used in conjunction
# with the listen_ipv6 directive.
listen=YES
, d, h- b. T1 ~: @listen_port=990
! |$ o) B" G" r5 n; S$ Mpasv_address=公网IP
# w8 P$ L$ a! |- w" M8 g1 u7 v8 e#
+ g4 y; C" v1 g2 a# {: p# This directive enables listening on IPv6 sockets. By default, listening
# on the IPv6 "any" address (: will accept connections from both IPv6
# and IPv4 clients. It is not necessary to listen on *both* IPv4 and IPv6
# sockets. If you want that (perhaps because you want to listen on specific
: t. m& D: |3 l. w/ c3 s6 I8 r; X# I% Q# addresses) then you must run two copies of vsftpd with two configuration
% t- g4 R2 s; P0 C% B% X8 n5 d$ I# files.
# Make sure, that one of the listen options is commented !!
3 \7 h- L1 C$ n( `' @1 Ylisten_ipv6=NO
pam_service_name=vsftpd
  E) }9 t7 Y0 x$ ]userlist_enable=NO
7 F; p" x! ?) X. l+ Ftcp_wrappers=YES
allow_writeable_chroot=YES
0 |' n2 d0 N- }3 v  z6 N$ m$ I5 V+ Z1 vuserlist_file=/etc/vsftpd/userlist
userlist_deny=NO
% r$ t& D( P& |1 Wssl_enable=YES
/ u8 D% t( _# rssl_tlsv1_2=YES
" r& Z1 X* o3 E1 B1 tssl_sslv2=YES
ssl_sslv3=YES
8 P7 ?" K3 P6 Brsa_cert_file=/etc/ssl/private/vsftpd.pem
' j- Q) J9 s- [2 ?/ N/ Z; ^rsa_private_key_file=/etc/ssl/private/vsftpd.pem
/ p" f) S2 |% P- d+ w6 w# q' lallow_anon_ssl=NO
force_local_data_ssl=YES
force_local_logins_ssl=YES
) w  l( r$ x$ Orequire_ssl_reuse=NO
ssl_ciphers=HIGH
implicit_ssl=YES
ftp_data_port=50000
pasv_enable=YES
pasv_min_port=40000
pasv_max_port=50000
+ ]  M( \  \; y+ s& ~, Oport_enable=YES
* A- X! A7 B' ^' b6 {$ Y: P- E. Qdebug_ssl=YES
' x4 W7 x% c  A. W+ t( kpasv_promiscuous=YES   解决vsftpd连接错误425 Security: Bad IP connecting
, S4 k0 v( I* a) T9 l2 F" F
) N( \* a1 S3 w' |" {
# R" s8 j  Y  l( n0 C, U不知道他们IT修改了哪里  换个IP居然联不上  尼玛  把报错一个一个排查完  
0 h  u/ Y* M  R; K