vsftpd cmds_allowed 实现权限控制

在实际的系统运维工作中,我们经常会面临或提及服务器数据安全问题,例如FTP连接时用户对文件可以进行覆盖操作 不具有删除权限等等。本文通过vsftpd cmds_allowed 参数配置对vsftpd服务实现精细权限控制做了详细的说明。

vsftpd cmds_allowed
cmds_allowed=ABOR,CWD,LIST,MDTM,MKD,NLST,
PASS,PASV,PORT,PWD,QUIT,RETR,RMD,RNFR,
RNTO,SITE,SIZE,STOR,TYPE,USER,ACCT,
APPE,CDUP,HELP,MODE,NOOP,REIN,STAT,STOU,STRU,SYST


注意:一定不能使用换行和空格,不然就没效果..

# ABOR - abort a file transfer
# CWD - change working directory
# DELE - delete a remote file
# LIST - list remote files
# MDTM - return the modification time of a file
# MKD - make a remote directory
# NLST - name list of remote directory
# PASS - send password
# PASV - enter passive mode
# PORT - open a data port
# PWD - print working directory
# QUIT - terminate the connection
# RETR - retrieve a remote file
# RMD - remove a remote directory
# RNFR - rename from
# RNTO - rename to
# SITE - site-specific commands
# SIZE - return the size of a file
# STOR - store a file on the remote host
# TYPE - set transfer type
# USER - send username
#

# less common commands:
# ACCT* - send account information
# APPE - append to a remote file
# CDUP - CWD to the parent of the current directory
# HELP - return help on using the server
# MODE - set transfer mode
# NOOP - do nothing
# REIN* - reinitialize the connection
# STAT - return server status
# STOU - store a file uniquely
# STRU - set file transfer structure
# SYST - return system type


VSFTPD的非常有用的权限控制语句,也许在使用FTP的过程中,可能是有一些权限控制的不如意,通过下面例子大家或许能找到适合自己需求的权限分配
我们首先来看看下面的几个例子:
1、只能上传。不能下载、删除、重命名。

cmds_allowed=FEAT,REST,CWD,LIST,MDTM,MKD,NLST,PASS,PASV,PORT,PWD,QUIT,RMD,SIZE,STOR,TYPE,USER,ACCT,APPE,CDUP,HELP,MODE,NOOP,REIN,STAT,STOU,STRU,SYST

2、只能下载。不能上传、删除、重命名。write_enable=NO
3、只能上传、删除、重命名。不能下载。download_enable=NO
4、只能下载、删除、重命名。不能上传。

cmds_allowed=FEAT,REST,CWD,LIST,MDTM,MKD,NLST,PASS,PASV,PORT,PWD,QUIT,RMD,RNFR,RNTO,RETR,DELE,SIZE,TYPE,USER,ACCT,APPE,CDUP,HELP,MODE,NOOP,REIN,STAT,STOU,STRU,SYST


以上的2、3两点好控制,可是1和4就不是那么好控制了!

我给出了1和4的方法,当然,大家也可以说说自己是如何实现1和4的控制的,我们相互交流!
下面我就把具体的一些参数来和大家说说!

CWD - change working directory 更改目录
LIST - list remote files 列目录
MKD - make a remote directory 新建文件夹
NLST - name list of remote directory
PWD - print working directory 显示当前工作目录
RETR - retrieve a remote file 下载文件
STOR - store a file on the remote host 上传文件

DELE - delete a remote file 删除文件
RMD - remove a remote directory 删除目录
RNFR - rename from 重命名
RNTO - rename to 重命名


以上是常用的一些参数,大家对照学习一下!下面是列也的全部参数,供大家参考!

# ABOR - abort a file transfer 取消文件传输
# CWD - change working directory 更改目录
# DELE - delete a remote file 删除文件
# LIST - list remote files 列目录
# MDTM - return the modification time of a file 返回文件的更新时间
# MKD - make a remote directory 新建文件夹
# NLST - name list of remote directory
# PASS - send password
# PASV - enter passive mode
# PORT - open a data port 打开一个传输端口
# PWD - print working directory 显示当前工作目录
# QUIT - terminate the connection 退出
# RETR - retrieve a remote file 下载文件
# RMD - remove a remote directory
# RNFR - rename from
# RNTO - rename to
# SITE - site-specific commands
# SIZE - return the size of a file 返回文件大小
# STOR - store a file on the remote host 上传文件
# TYPE - set transfer type
# USER - send username

# less common commands:

# ACCT* - send account information
# APPE - append to a remote file
# CDUP - CWD to the parent of the current directory
# HELP - return help on using the server
# MODE - set transfer mode
# NOOP - do nothing
# REIN* - reinitialize the connection
# STAT - return server status
# STOU - store a file uniquely
# STRU - set file transfer structure
# SYST - return system type



例如:vsftp 用户只能上传不能删除
编辑vsftpd.conf配置文件添加
# vi /etc/vsftpd/vsftpd.conf

cmds_allowed=ABOR,CWD,LIST,MDTM,MKD,NLST,PASS,PASV,PORT,PWD,QUIT,RETR,RNFR,RNTO,SIZE,STOR,TYPE,USER,REST,CDUP,HELP,MODE,NOOP,REIN,STAT,STOU,STRU,SYST,FEAT(一些FTP的命令,就是除了DELE等命令)

# service vsftpd restart

相关文章

仅有 1 条评论
  1. 若鱼

    看起来好高深的样子。

    若鱼

此处评论已关闭