Come limitare/limitare i comandi FTP sui servizi Vsftpd (CentOS/RHEL 6,7)

Scopri come limitare o limitare i comandi ftp che l'utente può eseguire sui servizi vsftpd. Ad esempio, come negare a un utente di creare o rimuovere una directory.

1. I servizi vsftpd sono installati e configurati con le opzioni predefinite. La creazione e l'eliminazione delle directory sta funzionando come previsto.

# ftp localhost
Trying 127.0.0.1...
Connected to localhost (127.0.0.1).
220 (vsFTPd 3.0.2)
Name (localhost:root): test
331 Please specify the password.
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp>ftp> mkdir test
257 "/home/test/test" created

ftp> rmdir test
250 Remove directory operation successful.
ftp>

2. Utente negato per creare o rimuovere una directory. Aggiungi le righe seguenti alla fine del file /etc/vsftpd/vsftpd.conf .

# tail /etc/vsftpd/vsftpd.conf
tcp_wrappers=YES

# Allowed commands
#cmds_allowed=ABOR,ACCT,ALLO,APPE,CDUP,CWD,DELE,EPRT,EPSV,FEAT,HELP,LIST,MDTM,MODE,NLST,NOOP,OPTS,PASS,PASV,PORT,PWD,QUIT,REIN,REST,RETR,RMD,RNFR,RNTO,SITE,SIZE,SMNT,STAT,STOR,STOU,STRU,SYST,TYPE,USER,XCUP,XCWD,XPWD,XRMD

# Explicitly denied commands
cmds_denied=RMD,RMDIR,XRMD,MKD,MKDIR,XMKD

3. Riavvia il servizio vsftpd

# systemctl restart vsftpd

Nota:per Oracle Linux 6 utilizzare

# service vsftpd restart

4. L'utente non può creare o rimuovere una directory:

# ftp localhost
Trying 127.0.0.1...
Connected to localhost (127.0.0.1).
220 (vsFTPd 3.0.2)
Name (localhost:root): test
331 Please specify the password.
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp>
ftp> mkdir test2
550 Permission denied.   
ftp>
ftp> rmdir test
550 Permission denied.   
ftp>

Fare riferimento alle pagine man per ulteriori informazioni:

# man vsftpd.conf

cmds_allowed
This option specifies a comma-separated list of allowed FTP commands (post login. USER, PASS and QUIT and
others are always allowed pre-login). Other commands are rejected. This is a powerful method of really
locking down an FTP server. Example: cmds_allowed=PASV,RETR,QUIT

Default: (none)

cmds_denied
This option specifies a comma-separated list of denied FTP commands (post login. USER, PASS, QUIT and
others are always allowed pre-login). If a command appears on both this and cmds_allowed then the denial
takes precedence. (Added in v2.1.0).