某某大厂文件服务器配置

admin

# Example config file /etc/vsftpd/vsftpd.conf
#
# The default compiled in settings are fairly paranoid. This sample file
# loosens things up a bit, to make the ftp daemon more usable.
# Please see vsftpd.conf.5 for all compiled in defaults.
# ?( o1 _: k7 ?' I/ b/ m- K4 W#
6 ]# J0 I" C# C# j9 p! E* Y* T% _# READ THIS: This example file is NOT an exhaustive list of vsftpd options.
/ i- K7 o2 }% R- E+ Y0 Q, v# Please read the vsftpd.conf.5 manual page to get a full idea of vsftpd's
1 E+ L- i; D0 u: w" v/ p# capabilities.
2 S4 N& Y. ]; v2 _" I& F9 c#
# Allow anonymous FTP? (Beware - allowed by default if you comment this out).
anonymous_enable=NO
$ K+ B# \& F7 e1 j5 c- A#
# Uncomment this to allow local users to log in.
# When SELinux is enforcing check for SE bool ftp_home_dir
* L+ O7 d& r% e: l0 Vlocal_enable=YES
  E4 Z0 W, b. L4 l# R0 a5 J; I" K#
. h2 I2 J2 e* }) ~& ~$ H# Uncomment this to enable any form of FTP write command.
write_enable=YES
, M5 w) R3 I* Q) I( b* |#
# Default umask for local users is 077. You may wish to change this to 022,
2 P) S, X/ i2 ~$ O# if your users expect that (022 is used by most other ftpd's)
' u) J  v6 J5 H, y7 U7 Klocal_umask=022
0 U0 s( l4 N) Z' L% f8 U4 R0 A#
# Uncomment this to allow the anonymous FTP user to upload files. This only
# has an effect if the above global write enable is activated. Also, you will
# Q7 z4 \8 H) R, y/ \* g+ N# obviously need to create a directory writable by the FTP user.
+ D2 M+ N4 j& C- r  J8 @' ~9 [# When SELinux is enforcing check for SE bool allow_ftpd_anon_write, allow_ftpd_full_access
#anon_upload_enable=YES
* l+ a) @: L: N3 d6 p" D3 a#
: y) }+ }2 @+ ?1 D+ M8 n- U9 h- u4 n# Uncomment this if you want the anonymous FTP user to be able to create
# new directories.
#anon_mkdir_write_enable=YES
# a0 ^. r5 Q7 A2 K4 _6 M4 z#
# Activate directory messages - messages given to remote users when they
  t8 m) n$ c4 u- L# go into a certain directory.
dirmessage_enable=YES
#
# Activate logging of uploads/downloads.
xferlog_enable=YES
' [. k. j  V, N#
* o: H  T( S* F. q+ g) w# Make sure PORT transfer connections originate from port 20 (ftp-data).
( Q7 P& X; m) |% |( aconnect_from_port_20=YES
9 r  K5 O7 c% [, F! v#
1 }. n% i6 A2 d* A# If you want, you can arrange for uploaded anonymous files to be owned by
# a different user. Note! Using "root" for uploaded files is not
7 b7 p" Q) o+ S1 [2 E/ f# recommended!
$ J; `4 L1 m7 E6 M#chown_uploads=YES
; }8 W! m7 Z: Y#chown_username=whoever
. N  T: t  a5 p% r#
# You may override where the log file goes if you like. The default is shown
# below.
xferlog_file=/var/log/xferlog
#
# If you want, you can have your log file in standard ftpd xferlog format.
, D3 Q7 B& K4 L/ m+ q) O# Note that the default log file location is /var/log/xferlog in this case.
3 i/ g9 E* m7 Wxferlog_std_format=YES
: K$ ?: B5 X" z/ f# J7 d$ U0 ~8 k#
; L& C' U" M8 e( G# You may change the default value for timing out an idle session.
) i. Z  K" f& \. }#idle_session_timeout=600
#
" }( E# ]! |! K# y) T7 `7 t3 v# You may change the default value for timing out a data connection.
9 @* a' c7 ]: T" h: y5 ]$ F#data_connection_timeout=120
( R8 R0 F" S) m  N6 x#
# It is recommended that you define on your system a unique user which the
# ftp server can use as a totally isolated and unprivileged user.
#nopriv_user=ftpsecure
4 F1 U8 i& e6 P3 a# S/ I  r, A8 n#
# Enable this and the server will recognise asynchronous ABOR requests. Not
# recommended for security (the code is non-trivial). Not enabling it,
# however, may confuse older FTP clients.
#async_abor_enable=YES
#
5 g4 f( _' ^  n- x5 T# By default the server will pretend to allow ASCII mode but in fact ignore
4 `/ p/ n- D/ t9 ~. p3 h# the request. Turn on the below options to have the server actually do ASCII
# mangling on files when in ASCII mode. The vsftpd.conf(5) man page explains
# the behaviour when these options are disabled.
# Beware that on some FTP servers, ASCII support allows a denial of service
% G. w5 q$ k1 e& M8 U$ M' E5 R# attack (DoS) via the command "SIZE /big/file" in ASCII mode. vsftpd
& c! m6 F* a' T- ?1 i' V# S# predicted this attack and has always been safe, reporting the size of the
# raw file.
# ASCII mangling is a horrible feature of the protocol.
ascii_upload_enable=YES
ascii_download_enable=YES
#
# You may fully customise the login banner string:
( @& ~$ A8 ^7 }5 e' R: T#ftpd_banner=Welcome to blah FTP service.
#
# You may specify a file of disallowed anonymous e-mail addresses. Apparently
# useful for combatting certain DoS attacks.
#deny_email_enable=YES
# (default follows)
#banned_email_file=/etc/vsftpd/banned_emails
! @0 x* S* c  q- B, T) V#
# You may specify an explicit list of local users to chroot() to their home
# directory. If chroot_local_user is YES, then this list becomes a list of
( t/ o* s. S4 {1 A4 C, W# users to NOT chroot().
0 `: ^+ n$ j: [% h# (Warning! chroot'ing can be very dangerous. If using chroot, make sure that
. Q2 H4 [2 K, k, ?; P# the user does not have write access to the top level directory within the
# chroot)
chroot_local_user=YES
9 M; O; k) _. e* {#chroot_list_enable=YES
# p* d+ m1 h' W: |  V+ m# (default follows)
( ]  L0 j+ L' e#chroot_list_file=/etc/vsftpd/chroot_list
#
# You may activate the "-R" option to the builtin ls. This is disabled by
# default to avoid remote users being able to cause excessive I/O on large
# sites. However, some broken FTP clients such as "ncftp" and "mirror" assume
+ d: b0 j4 l1 _" I6 D3 i# e# the presence of the "-R" option, so there is a strong case for enabling it.
# B9 s. S; V+ B( E; V, m3 @#ls_recurse_enable=YES
- z8 L" f6 }4 h1 C9 M4 R#
" Y* f+ o: U* O3 K5 L# When "listen" directive is enabled, vsftpd runs in standalone mode and
1 X" {. b5 B) g# P# listens on IPv4 sockets. This directive cannot be used in conjunction
# with the listen_ipv6 directive.
listen=YES
, z7 {1 K2 v" x$ Nlisten_port=990
pasv_address=公网IP
8 d5 K3 d2 C3 O$ ~  g% G4 z) \#
# This directive enables listening on IPv6 sockets. By default, listening
# on the IPv6 "any" address (: will accept connections from both IPv6
# and IPv4 clients. It is not necessary to listen on *both* IPv4 and IPv6
- W! _, L7 {  p. @$ P# sockets. If you want that (perhaps because you want to listen on specific
% R+ U, Y9 P# w+ O+ m/ j# addresses) then you must run two copies of vsftpd with two configuration
" ^6 |" _: f$ F+ X" @/ R# files.
# Make sure, that one of the listen options is commented !!
listen_ipv6=NO
) T, ]. _. Y' r& xpam_service_name=vsftpd
5 n! h  c) p2 V2 H: e1 `* Duserlist_enable=NO
% u5 B9 l7 b1 e5 D) _tcp_wrappers=YES
allow_writeable_chroot=YES
/ N: P9 P, {/ B0 T, Guserlist_file=/etc/vsftpd/userlist
userlist_deny=NO
/ X, s) h& ^, ^  T0 P! Ussl_enable=YES
ssl_tlsv1_2=YES
3 S! @; f9 h( |" i3 J0 xssl_sslv2=YES
ssl_sslv3=YES
6 d, Z9 O2 s+ L& vrsa_cert_file=/etc/ssl/private/vsftpd.pem
/ ^% F% o  A1 D( @0 T0 ]rsa_private_key_file=/etc/ssl/private/vsftpd.pem
* K9 ~* p( g6 p0 i) Iallow_anon_ssl=NO
# F8 Y' r. P" e# sforce_local_data_ssl=YES
force_local_logins_ssl=YES
require_ssl_reuse=NO
, t' J6 r  F- y, i0 D. Y' w! n3 hssl_ciphers=HIGH
implicit_ssl=YES
6 V  u  ]. a4 z2 R* M' _" Hftp_data_port=50000
& D8 y+ B$ R1 G3 O, fpasv_enable=YES
pasv_min_port=40000
7 C- ^3 V7 ?5 B, O1 t7 ?pasv_max_port=50000
% f( l+ J' f0 l' n9 N& D. T/ v. _, `, kport_enable=YES
) E7 U8 }+ R9 ]' Y4 G+ Vdebug_ssl=YES
! W6 b; c7 R/ K* p: opasv_promiscuous=YES   解决vsftpd连接错误425 Security: Bad IP connecting

. z$ Z5 j& L& g# O( ?
: K2 e1 K% j5 k+ k9 R( T不知道他们IT修改了哪里  换个IP居然联不上  尼玛  把报错一个一个排查完