vsftpd-1.1.3配製例項之三：PER_IP_CONFIG(轉)

vsftpd-1.1.3配製例項之三：PER_IP_CONFIG(轉)[@more@]

　　This example should quickly show you the possibilites of per-IP configuration

　　with vsftpd's tcp_wrappers integration. This is new with v1.1.3.

　　To use this, you need vsftpd built with tcp_wrappers! This is accomplished

　　by editing "builddefs.h" and changing

　　#undef VSF_BUILD_TCPWRAPPERS

　　to

　　#define VSF_BUILD_TCPWRAPPERS

　　And then rebuild. If you are lucky your vendor will have shipped the vsftpd

　　binary with this already done for you.

　　Next, to enable tcp_wrappers integration, you need this in your vsftpd.conf:

　　tcp_wrappers=YES

　　And you'll need a tcp_wrappers config file. An example one is supplied in this

　　directory: hosts.allow. It lives at /etc/hosts.allow.

　　Let's have a look at the example:

　　vsftpd: 192.168.1.3: setenv VSFTPD_LOAD_CONF /etc/vsftpd_tcp_wrap.conf

　　vsftpd: 192.168.1.4: DENY

　　The first line:

　　If a client connects from 192.168.1.3, then vsftpd will apply the vsftpd

　　config file /etc/vsftpd_tcp_wrap.conf to the session! These settings are

　　applied ON TOP of the default vsftpd.conf.

　　This is obviously very powerful. You might use this to apply different

　　access restrictions for some IPs (e.g. the ability to upload).

　　Or you could give certain classes of IPs the ability to skip connection

　　limits (max_clients=0).

　　Or you could increase / decrease the bandwidth limiter for certain classes

　　of IPs.

　　You get the point :-)

　　The second line:

　　Denies the ability of 192.168.1.4 to connect. Very useful to take care of

　　troublemakers. And now you don't need xinetd to do it - hurrah.

　　hosts.allow

　　#

　　# hosts.allow This file describes the names of the hosts which are

　　# allowed to use the local INET services, as decided

　　# by the '/usr/sbin/tcpd' server.

　　#

　　vsftpd: 192.168.1.3: setenv VSFTPD_LOAD_CONF /etc/vsftpd_tcp_wrap.conf

　　vsftpd: 192.168.1.4: DENY