某某大厂文件服务器配置

admin

# Example config file /etc/vsftpd/vsftpd.conf
#
  L; a  }2 @5 E# The default compiled in settings are fairly paranoid. This sample file
# loosens things up a bit, to make the ftp daemon more usable.
# Please see vsftpd.conf.5 for all compiled in defaults.
' Z( f3 H8 U7 J8 R& A7 M+ Q+ H#
; D  a$ G3 E- k# READ THIS: This example file is NOT an exhaustive list of vsftpd options.
# Please read the vsftpd.conf.5 manual page to get a full idea of vsftpd's
# capabilities.
! ]: e, i2 t- S" z+ ], \#
9 D; b1 }7 i1 T; V, i& W# Allow anonymous FTP? (Beware - allowed by default if you comment this out).
anonymous_enable=NO
8 G0 S/ ?+ O3 i2 \4 o. I, d#
# Uncomment this to allow local users to log in.
# When SELinux is enforcing check for SE bool ftp_home_dir
/ w  z6 O! S/ g+ @4 c9 mlocal_enable=YES
4 z8 @5 e) D% m5 D& E9 T#
" f5 G" p7 A' z* q' A3 O+ Y# Uncomment this to enable any form of FTP write command.
write_enable=YES
#
# Default umask for local users is 077. You may wish to change this to 022,
+ i+ h* C' b! B# if your users expect that (022 is used by most other ftpd's)
local_umask=022
4 a/ e, d, J, D0 e3 o8 G/ H1 ]#
# Uncomment this to allow the anonymous FTP user to upload files. This only
  Z  @3 h  @% N# has an effect if the above global write enable is activated. Also, you will
# obviously need to create a directory writable by the FTP user.
" n! U8 C8 N1 F; D7 |: a! ]# When SELinux is enforcing check for SE bool allow_ftpd_anon_write, allow_ftpd_full_access
/ @: [0 h1 J' c" L! [#anon_upload_enable=YES
#
7 _, p3 A( |' V8 Q# Uncomment this if you want the anonymous FTP user to be able to create
# new directories.
9 O0 X9 F9 i5 v$ I#anon_mkdir_write_enable=YES
- U, }- y' g: z; N+ D( c#
# Activate directory messages - messages given to remote users when they
$ G$ I, E+ d" @( F# go into a certain directory.
dirmessage_enable=YES
$ O; r7 H) H7 @" x#
$ e8 j( l7 [" _% ~) b0 W( X9 P" C9 e- Z# Activate logging of uploads/downloads.
xferlog_enable=YES
#
1 \: J# K- c8 e1 h, J) p& i# Make sure PORT transfer connections originate from port 20 (ftp-data).
connect_from_port_20=YES
#
# If you want, you can arrange for uploaded anonymous files to be owned by
# a different user. Note! Using "root" for uploaded files is not
# recommended!
! n5 F; l! j" ^' [6 G8 ?. T4 k#chown_uploads=YES
# y7 _& p* B' y7 L5 Y! f6 e#chown_username=whoever
#
/ ^5 j- U# e8 ?6 M4 ?# You may override where the log file goes if you like. The default is shown
+ S1 q) U2 ]! T2 P  [- U# below.
xferlog_file=/var/log/xferlog
9 W9 ~+ l1 e* m. m- ^/ J4 R0 C#
8 i: H% \, r5 n9 a4 e" H& I( ~- t# If you want, you can have your log file in standard ftpd xferlog format.
9 e3 V9 }7 G  K! A$ n( a# Note that the default log file location is /var/log/xferlog in this case.
2 s, D& H& c; l1 K' F; R  cxferlog_std_format=YES
& _1 e: o# c* ?4 O0 h) I#
6 p! O% A3 G3 s% D7 M# You may change the default value for timing out an idle session.
#idle_session_timeout=600
5 D9 R( [2 _$ v% u#
- n" D8 p" C0 C5 O! f# You may change the default value for timing out a data connection.
#data_connection_timeout=120
9 s7 [$ y/ D  ^% ^: H* m2 Y#
# It is recommended that you define on your system a unique user which the
# ftp server can use as a totally isolated and unprivileged user.
#nopriv_user=ftpsecure
#
! G2 K8 o8 E9 o. C' E+ l% W9 V# Enable this and the server will recognise asynchronous ABOR requests. Not
: p3 a2 x& n! E: A# recommended for security (the code is non-trivial). Not enabling it,
# however, may confuse older FTP clients.
. F: Q# m( R1 T% V/ d9 _7 k#async_abor_enable=YES
+ V0 ?+ I( X7 \5 H#
# By default the server will pretend to allow ASCII mode but in fact ignore
, }$ \: A: y) t! {: a# the request. Turn on the below options to have the server actually do ASCII
( M1 Q/ I% ?, D! n5 z; ?# mangling on files when in ASCII mode. The vsftpd.conf(5) man page explains
* q# n: @  m6 b/ C, \  B# the behaviour when these options are disabled.
! W& G+ b: S  K/ u9 d" W1 [# Beware that on some FTP servers, ASCII support allows a denial of service
. q( C+ J, [3 k" t; V; j" `5 E# attack (DoS) via the command "SIZE /big/file" in ASCII mode. vsftpd
* \8 [  ]7 G8 L3 Q# predicted this attack and has always been safe, reporting the size of the
+ h2 C8 e. H7 Z, Y) s& L: p# raw file.
# ASCII mangling is a horrible feature of the protocol.
9 b$ k2 M: Y2 T. f" t6 ?ascii_upload_enable=YES
ascii_download_enable=YES
#
$ O$ M/ h+ n) H$ U# You may fully customise the login banner string:
#ftpd_banner=Welcome to blah FTP service.
1 G" e" a$ i4 M' n6 W#
# You may specify a file of disallowed anonymous e-mail addresses. Apparently
" E. n* t6 \2 o# useful for combatting certain DoS attacks.
#deny_email_enable=YES
# (default follows)
#banned_email_file=/etc/vsftpd/banned_emails
; t' @1 W: y/ ?$ \#
. |: X& c6 O: [2 c; |+ N# You may specify an explicit list of local users to chroot() to their home
# directory. If chroot_local_user is YES, then this list becomes a list of
# users to NOT chroot().
# (Warning! chroot'ing can be very dangerous. If using chroot, make sure that
# the user does not have write access to the top level directory within the
* L+ U0 l$ h9 q& X( X# chroot)
chroot_local_user=YES
#chroot_list_enable=YES
' n2 J! a2 @  H) d! @% F# (default follows)
) Q2 F. w- e3 j5 ?% Y#chroot_list_file=/etc/vsftpd/chroot_list
#
# You may activate the "-R" option to the builtin ls. This is disabled by
- P* ^' f. _# ~3 C, s' I( y( Y# default to avoid remote users being able to cause excessive I/O on large
( J3 V3 X. a8 S" [' a2 y% ~. F$ i( c# sites. However, some broken FTP clients such as "ncftp" and "mirror" assume
* `' A1 `- Q9 o0 l9 x2 k  ?. A2 Q# the presence of the "-R" option, so there is a strong case for enabling it.
* Z" w! r/ V& \7 Q1 Z* j#ls_recurse_enable=YES
: ]" P8 o" l- j#
* G5 L5 [) p1 V0 X- Z# When "listen" directive is enabled, vsftpd runs in standalone mode and
! O% f! W6 b+ s! I4 `# listens on IPv4 sockets. This directive cannot be used in conjunction
) N- ]5 e3 L4 j# with the listen_ipv6 directive.
listen=YES
listen_port=990
pasv_address=公网IP
7 e2 B, f$ F2 C0 P6 Z#
# This directive enables listening on IPv6 sockets. By default, listening
. V8 w5 m/ g* m& E$ I# on the IPv6 "any" address (: will accept connections from both IPv6
# and IPv4 clients. It is not necessary to listen on *both* IPv4 and IPv6
( i% ]4 Y9 D8 C' M# W# sockets. If you want that (perhaps because you want to listen on specific
3 X7 y7 ^/ O( v" m/ X( e# addresses) then you must run two copies of vsftpd with two configuration
# files.
# Make sure, that one of the listen options is commented !!
0 ?. e) S8 |4 I7 T3 {7 Hlisten_ipv6=NO
* Y. I& M) F, p6 {: _4 ~3 P3 Dpam_service_name=vsftpd
) `$ @; K1 l* ~. }; g% Y' G7 q: zuserlist_enable=NO
$ S) [) L* y" M1 W. ]+ J" Ltcp_wrappers=YES
allow_writeable_chroot=YES
6 o5 j2 Q7 \" o# m7 {userlist_file=/etc/vsftpd/userlist
% {% n3 |' F( K2 D- s1 quserlist_deny=NO
ssl_enable=YES
ssl_tlsv1_2=YES
& F3 C4 Y' Q4 j4 i7 L. `ssl_sslv2=YES
ssl_sslv3=YES
9 o" q3 U0 A& \" j  W8 arsa_cert_file=/etc/ssl/private/vsftpd.pem
rsa_private_key_file=/etc/ssl/private/vsftpd.pem
& U1 }6 Y: F( |, C3 v& Aallow_anon_ssl=NO
force_local_data_ssl=YES
$ X) q1 u9 o0 o/ n! Oforce_local_logins_ssl=YES
require_ssl_reuse=NO
ssl_ciphers=HIGH
; Z  Y  r2 C. H( d3 ^) Limplicit_ssl=YES
0 f. _# k0 y1 Y; a. pftp_data_port=50000
" W2 d8 L/ ^* M- @! N( bpasv_enable=YES
pasv_min_port=40000
% r3 ?  F) u5 y  [$ V8 w0 {# ipasv_max_port=50000
port_enable=YES
. l; O# e- X3 F! x* Ndebug_ssl=YES
3 o+ |$ H0 L/ D8 L6 _" G- V! Epasv_promiscuous=YES   解决vsftpd连接错误425 Security: Bad IP connecting

, A/ }( n7 A7 t( ?6 Z3 E; `
7 I9 t0 u: f0 f: g% k不知道他们IT修改了哪里  换个IP居然联不上  尼玛  把报错一个一个排查完