Red Hat Summit 红帽全球峰会支持控制台（Console）开发人员开始试用联系人

8.4. Securing the FTP service

You can use the File Transfer Protocol (FTP) to transfer files over a network. Because all FTP transactions with the server, including user authentication, are unencrypted, make sure it is configured securely.

Red Hat Enterprise Linux provides two FTP servers:

Red Hat Content Accelerator (tux)
A kernel-space web server with FTP capabilities.
Very Secure FTP Daemon (vsftpd)
A standalone, security-oriented implementation of the FTP service.

The following security guidelines are for setting up the vsftpd FTP service.

8.4.1. Securing the FTP greeting banner
复制链接

When a user connects to the FTP service, the server displays a greeting banner that, by default, includes version information. Attackers might use this information to identify vulnerabilities in the system. You can hide this information by changing the default banner.

You can define a custom banner by editing the /etc/banners/ftp.msg file to either directly include a single-line message, or to refer to a separate file, which can contain a multi-line message.

Procedure

  • To define a single line message, add the following option to the /etc/vsftpd/vsftpd.conf file: 

    ftpd_banner=Hello, all activity on ftp.example.com is logged.

  • To define a message in a separate file:

    • Create a .msg file which contains the banner message, for example /etc/banners/ftp.msg: 

      ######### Hello, all activity on ftp.example.com is logged. #########

      To simplify the management of multiple banners, place all banners into the /etc/banners/ directory.

    • Add the path to the banner file to the banner_file option in the /etc/vsftpd/vsftpd.conf file: 

      banner_file=/etc/banners/ftp.msg

Verification

  • Display the modified banner: 

    $ ftp localhost
Trying ::1…
Connected to localhost (::1).
Hello, all activity on ftp.example.com is logged.

8.4.2. Preventing anonymous access and uploads in FTP
复制链接

By default, installing the vsftpd package creates the /var/ftp/ directory and a directory tree for anonymous users with read-only permissions on the directories. Because anonymous users can access the data, do not store sensitive data in these directories.

To increase the security of the system, configure the FTP server to permit anonymous users to upload files to a specific directory and block them from reading data. In the following example procedure, the anonymous user must be able to upload files in the directory owned by the root user, but not change it.

Procedure

  1. Create a write-only directory in the /var/ftp/pub/ directory: 

    # mkdir /var/ftp/pub/upload
# chmod 730 /var/ftp/pub/upload
# ls -ld /var/ftp/pub/upload
drwx-wx---. 2 root ftp 4096 Nov 14 22:57 /var/ftp/pub/upload

  2. Add the following lines to the /etc/vsftpd/vsftpd.conf file: 

    anon_upload_enable=YES
anonymous_enable=YES

  3. Optional: If your system has SELinux enabled and enforcing, enable SELinux boolean attributes allow_ftpd_anon_write and allow_ftpd_full_access.

    警告

    Configuring directories for anonymous read and write access increases risk, because the server might become a repository for stolen software.

8.4.3. Securing user accounts for FTP
复制链接

FTP transmits usernames and passwords unencrypted over insecure networks for authentication. You can improve the security of FTP by denying system users access to the server from their user accounts.

Perform as many of the following steps as applicable for your configuration.

Procedure

  • Disable all user accounts in the vsftpd server, by adding the following line to the /etc/vsftpd/vsftpd.conf file: 

    local_enable=NO
  • Disable FTP access for specific accounts or specific groups of accounts, such as the root user and users with sudo privileges, by adding the usernames to the /etc/pam.d/vsftpd PAM configuration file.
  • Disable user accounts, by adding the usernames to the /etc/vsftpd/ftpusers file.
Red Hat logoGithubredditYoutubeTwitter

学习

尝试、购买和销售

社区

关于红帽文档

通过我们的产品和服务，以及可以信赖的内容，帮助红帽用户创新并实现他们的目标。 了解我们当前的更新.

让开源更具包容性

红帽致力于替换我们的代码、文档和 Web 属性中存在问题的语言。欲了解更多详情，请参阅红帽博客.

關於紅帽

我们提供强化的解决方案，使企业能够更轻松地跨平台和环境（从核心数据中心到网络边缘）工作。

Theme

© 2026 Red Hat返回顶部