一、ftp伺服器搭建與簡單配置
總結一下步驟吧：
1、安裝
sudo apt-get install vsftpd
可檢視版本號命令
vsftd -v
2、修改配置檔案/etc/vsftpd.conf
根據具體的情況進行修改，去掉註釋等，接下來會詳細介紹。
3、重啟vsftpd服務
sudo service vsftpd restart
然後檢視服務是否成功開啟
sudo service vsftpd status
如果看到active（running）就說明成功了，否則很可能是配置檔案修改出錯。
4、登入測試
實際測試一下是否達到預想的功能。
(這個並沒有什麼卵用，因為匿名使用者沒有開啟，主要看vsftpd.conf配置檔案內容來決定）
二、例項詳解ftp伺服器配置
我們搭建ftp伺服器想要實現以下特點：
1、user1使用者作為本地最高階使用者在ftp中幾乎不受什麼限制，可以訪問全部目錄，可以上傳可以下載，可以刪除，新建目錄，新建檔案。
2、user2使用者作為作為本地使用者，ftp登陸後限制在自己的主目錄內（/home/user2），在其主目錄下可以上傳可以下載，可以刪除，新建目錄，新建檔案。
3、匿名使用者（其他任何人，不需要專門的密碼就可以訪問）限制在/home/ftp目錄下，且只有下載許可權。
如上的特點大概符合一般場景，本地使用者中，管理員自然最大了，想幹啥就幹啥，其他本地使用者就訪問自己的目錄就好啦，在自己的範圍內想幹啥就幹啥，然後其他外來人員可以下載指定的資源，這樣管理員可以共享一些東西供其他人下載，其他人只能下載，不能修改，所以也不能造成什麼破壞。
第一步先設設定本地FTP工作使用者（冬瓜自研QQ:5264857）
sudo useradd -d /home/user1 -m user1 \\建立FTP使用者名稱 sudo passwd user1 \\設定密碼 chmod -R 777 /home/user1 \\設定ftp許可權 重複操作user2 sudo useradd -d /home/user2 -m user2 \\建立FTP使用者名稱 sudo passwd user2 \\設定密碼 chmod -R 777 /home/user2 \\設定ftp許可權
好啦，照著這個目標，開始配置/etc/vsftpd.conf檔案
允許匿名使用者訪問，並且對匿名使用者的目錄進行限制，限制到/home/ftp
1 anonymous_enable=YES 2 anon_root=/home/ftp
這裡特別說明，/home/ftp目錄，不能有w許可權，這是一個只讀的目錄，否者會報錯。修改許可權可以使用
sudo chmod a-w /home/ftp
本地使用者能夠訪問，且擁有寫的許可權
1 local_enable=YES 2 write_enable=YES
本地使用者登入後限制在自己的主目錄下，同時透過檔案/etc/vsftpd.chroot_list來指定不用限制目錄的使用者（比如我們的user1不用限制目錄，所以要在該檔案下寫上user1），同時允許使用者對自己的主目錄進行修改。
1 chroot_local_user=YES 2 chroot_list_enable=YES 3 chroot_list_file=/etc/vsftpd.chroot_list 4 allow_writeable_chroot=YES
啟用使用者列表，不在列表中的使用者禁止登陸（所以我們要在etc/allowed_users中寫上user1，user2，anonymous，ftp，其中最後兩個都表示匿名登入）
1 user_list_enable=YES 2 user_list_deny=NO 3 userlist_file=/etc/allowed_users
這個是經驗項，配置了據說可以避免一些錯誤，參考文獻中有介紹。
seccomp_sandbox=NO
到此，還注意到，裡面涉及到了兩個檔案，一個是/etc/vsftpd.chroot_list，一個是/etc/allowed_users，我們儲存了之後需要自己手動建立這兩個檔案，
sudo touch /etc/vsftpd.chroot_list
sudo touch /etc/allowed_users
然後在/etc/vsftpd.chroot_list中的使用者不被限制目錄，這個例子中我們要寫入user1，/etc/allowed_users中要寫入允許訪問伺服器的使用者，這裡就是user1，user2，還有匿名使用者anonymous，ftp，注意寫的時候每行只寫一個使用者名稱。
儲存好了就重啟服務，驗證即可。
最後，一點注意，匿名使用者只能訪問/home/ftp目錄，那麼裡面的檔案需要超級使用者複製進去，並且所有檔案需要有可讀的許可權，否者其他使用者下載會出錯。
貼一下配置檔案的整體程式碼，方便大家比對。
1 # Example config file /etc/vsftpd.conf 2 # 3 # The default compiled in settings are fairly paranoid. This sample file 4 # loosens things up a bit, to make the ftp daemon more usable. 5 # Please see vsftpd.conf.5 for all compiled in defaults. 6 # 7 # READ THIS: This example file is NOT an exhaustive list of vsftpd options. 8 # Please read the vsftpd.conf.5 manual page to get a full idea of vsftpd's 9 # capabilities. 10 # 11 # 12 # Run standalone? vsftpd can run either from an inetd or as a standalone 13 # daemon started from an initscript. 14 listen=NO 15 # 16 # This directive enables listening on IPv6 sockets. By default, listening 17 # on the IPv6 "any" address (::) will accept connections from both IPv6 18 # and IPv4 clients. It is not necessary to listen on *both* IPv4 and IPv6 19 # sockets. If you want that (perhaps because you want to listen on specific 20 # addresses) then you must run two copies of vsftpd with two configuration 21 # files. 22 listen_ipv6=YES 23 # 24 # Allow anonymous FTP? (Disabled by default). 25 anonymous_enable=YES 26 anon_root=/home/ftp 27 # 28 # Uncomment this to allow local users to log in. 29 local_enable=YES 30 # 31 # Uncomment this to enable any form of FTP write command. 32 write_enable=YES 33 # 34 # Default umask for local users is 077. You may wish to change this to 022, 35 # if your users expect that (022 is used by most other ftpd's) 36 #local_umask=022 37 # 38 # Uncomment this to allow the anonymous FTP user to upload files. This only 39 # has an effect if the above global write enable is activated. Also, you will 40 # obviously need to create a directory writable by the FTP user. 41 #anon_upload_enable=YES 42 # 43 # Uncomment this if you want the anonymous FTP user to be able to create 44 # new directories. 45 #anon_mkdir_write_enable=YES 46 # 47 # Activate directory messages - messages given to remote users when they 48 # go into a certain directory. 49 dirmessage_enable=YES 50 # 51 # If enabled, vsftpd will display directory listings with the time 52 # in your local time zone. The default is to display GMT. The 53 # times returned by the MDTM FTP command are also affected by this 54 # option. 55 use_localtime=YES 56 # 57 # Activate logging of uploads/downloads. 58 xferlog_enable=YES 59 # 60 # Make sure PORT transfer connections originate from port 20 (ftp-data). 61 connect_from_port_20=YES 62 # 63 # If you want, you can arrange for uploaded anonymous files to be owned by 64 # a different user. Note! Using "root" for uploaded files is not 65 # recommended! 66 #chown_uploads=YES 67 #chown_username=whoever 68 # 69 # You may override where the log file goes if you like. The default is shown 70 # below. 71 #xferlog_file=/var/log/vsftpd.log 72 # 73 # If you want, you can have your log file in standard ftpd xferlog format. 74 # Note that the default log file location is /var/log/xferlog in this case. 75 #xferlog_std_format=YES 76 # 77 # You may change the default value for timing out an idle session. 78 #idle_session_timeout=600 79 # 80 # You may change the default value for timing out a data connection. 81 #data_connection_timeout=120 82 # 83 # It is recommended that you define on your system a unique user which the 84 # ftp server can use as a totally isolated and unprivileged user. 85 #nopriv_user=ftpsecure 86 # 87 # Enable this and the server will recognise asynchronous ABOR requests. Not 88 # recommended for security (the code is non-trivial). Not enabling it, 89 # however, may confuse older FTP clients. 90 #async_abor_enable=YES 91 # 92 # By default the server will pretend to allow ASCII mode but in fact ignore 93 # the request. Turn on the below options to have the server actually do ASCII 94 # mangling on files when in ASCII mode. 95 # Beware that on some FTP servers, ASCII support allows a denial of service 96 # attack (DoS) via the command "SIZE /big/file" in ASCII mode. vsftpd 97 # predicted this attack and has always been safe, reporting the size of the 98 # raw file. 99 # ASCII mangling is a horrible feature of the protocol. 100 #ascii_upload_enable=YES 101 #ascii_download_enable=YES 102 # 103 # You may fully customise the login banner string: 104 #ftpd_banner=Welcome to blah FTP service. 105 # 106 # You may specify a file of disallowed anonymous e-mail addresses. Apparently 107 # useful for combatting certain DoS attacks. 108 #deny_email_enable=YES 109 # (default follows) 110 #banned_email_file=/etc/vsftpd.banned_emails 111 # 112 # You may restrict local users to their home directories. See the FAQ for 113 # the possible risks in this before using chroot_local_user or 114 # chroot_list_enable below. 115 #chroot_local_user=YES 116 # 117 # You may specify an explicit list of local users to chroot() to their home 118 # directory. If chroot_local_user is YES, then this list becomes a list of 119 # users to NOT chroot(). 120 # (Warning! chroot'ing can be very dangerous. If using chroot, make sure that 121 # the user does not have write access to the top level directory within the 122 # chroot) 123 chroot_local_user=YES 124 chroot_list_enable=YES 125 # (default follows) 126 chroot_list_file=/etc/vsftpd.chroot_list 127 # 128 # You may activate the "-R" option to the builtin ls. This is disabled by 129 # default to avoid remote users being able to cause excessive I/O on large 130 # sites. However, some broken FTP clients such as "ncftp" and "mirror" assume 131 # the presence of the "-R" option, so there is a strong case for enabling it. 132 #ls_recurse_enable=YES 133 # 134 # Customization 135 # 136 # Some of vsftpd's settings don't fit the filesystem layout by 137 # default. 138 # 139 # This option should be the name of a directory which is empty. Also, the 140 # directory should not be writable by the ftp user. This directory is used 141 # as a secure chroot() jail at times vsftpd does not require filesystem 142 # access. 143 secure_chroot_dir=/var/run/vsftpd/empty 144 # 145 # This string is the name of the PAM service vsftpd will use. 146 pam_service_name=vsftpd 147 # 148 # This option specifies the location of the RSA certificate to use for SSL 149 # encrypted connections. 150 rsa_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem 151 rsa_private_key_file=/etc/ssl/private/ssl-cert-snakeoil.key 152 ssl_enable=NO 153 154 userlist_enable=YES 155 userlist_deny=NO 156 userlist_file=/etc/allowed_users 157 #local_root=/home 158 seccomp_sandbox=NO 159 allow_writeable_chroot=YES 160 # 161 # Uncomment this to indicate that vsftpd use a utf8 filesystem. 162 #utf8_filesystem=YES