Security

vsftpd 中的匿名與訪客登錄?

  • March 17, 2017

anonymousguestlogin in和有什麼不一樣vsftpd

兩者都可以啟用/禁用:

anonymous_enable=
guest_enable=

兩者都映射到不同的使用者名:

ftp_username=
guest_username=

幾乎我所知道的一切都anonymous適用於guest.

guest那麼,如果anonymous看起來足夠好,為什麼還要存在呢?

編輯

請考慮以下vsftpd配置。在左邊我有anonymous配置,在右邊guest。除了這 3 行之外,配置的其餘部分是連貫的。

# Standalone mode               # Standalone mode
listen=YES                      listen=YES

# Access rights                 # Access rights
anon_root=/var/ftp              anon_root=/var/ftp
download_enable=YES             download_enable=YES
anonymous_enable=YES         |  guest_enable=YES
local_enable=NO                 local_enable=NO
ftp_username=ftp             |  guest_username=ftp2

# Upload Access rights          # Upload Access rights
write_enable=YES                write_enable=YES
anon_mkdir_write_enable=YES     anon_mkdir_write_enable=YES
anon_other_write_enable=NO      anon_other_write_enable=NO
anon_upload_enable=YES          anon_upload_enable=YES
delete_failed_uploads=YES       delete_failed_uploads=YES

# Security                      # Security
anon_world_readable_only=YES    anon_world_readable_only=YES
connect_from_port_20=YES        connect_from_port_20=YES
hide_ids=YES                    hide_ids=YES
ls_recurse_enable=NO            ls_recurse_enable=NO
tilde_user_enable=NO            tilde_user_enable=NO
pasv_min_port=50000             pasv_min_port=50000
pasv_max_port=60000             pasv_max_port=60000

# Features                      # Features
ftpd_banner=Welcome Anonymou |  ftpd_banner=Welcome Guest !!
no_anon_password=YES            no_anon_password=YES
xferlog_enable=YES              xferlog_enable=YES

anonymous啟用後的使用者體驗:

$ lftp -d 127.0.0.1
---- Resolving host address...
---- 1 address found: 127.0.0.1
lftp 127.0.0.1:~> ls
---- Connecting to 127.0.0.1 (127.0.0.1) port 21
<--- 220 Welcome Anonymous !!
---> FEAT
<--- 211-Features:
<---  EPRT
<---  EPSV
<---  MDTM
<---  PASV
<---  REST STREAM
<---  SIZE
<---  TVFS
<--- 211 End
---> USER anonymous
<--- 230 Login successful. 
---> PWD
<--- 257 "/" is the current directory
---> EPSV
<--- 229 Entering Extended Passive Mode (|||52743|)
---- Connecting data socket to (127.0.0.1) port 52743
---- Data connection established
---> LIST
<--- 150 Here comes the directory listing.
---- Got EOF on data connection
---- Closing data socket
drwxrwxr-x    2 ftp      ftp          4096 Mar 16 13:21 upload
drwxr-xr-x    2 ftp      ftp          4096 Mar 16 13:30 vagrant
<--- 226 Directory send OK.
lftp 127.0.0.1:/> exit
---> QUIT
<--- 221 Goodbye.
---- Closing control socket

guest啟用後的使用者體驗:

$ lftp -d 127.0.0.1
---- Resolving host address...
---- 1 address found: 127.0.0.1
lftp 127.0.0.1:~> ls
---- Connecting to 127.0.0.1 (127.0.0.1) port 21
<--- 220 Welcome Guest !!
---> FEAT
<--- 211-Features:
<---  EPRT
<---  EPSV
<---  MDTM
<---  PASV
<---  REST STREAM
<---  SIZE
<---  TVFS
<--- 211 End
---> USER anonymous
<--- 230 Login successful. 
---> PWD
<--- 257 "/" is the current directory
---> EPSV
<--- 229 Entering Extended Passive Mode (|||51032|)
---- Connecting data socket to (127.0.0.1) port 51032
---- Data connection established
---> LIST
<--- 150 Here comes the directory listing.
---- Got EOF on data connection
---- Closing data socket
drwxrwxr-x    2 ftp      ftp          4096 Mar 16 13:21 upload
drwxr-xr-x    2 ftp      ftp          4096 Mar 16 13:30 vagrant
<--- 226 Directory send OK.
lftp 127.0.0.1:/> exit
---> QUIT
<--- 221 Goodbye.
---- Closing control socket

據我所知,無論配置如何,我的使用者體驗都沒有什麼不同。

這句話描述了它:

guest_enable 如果啟用,所有非匿名登錄都被歸類為“訪客”登錄。訪客登錄被重新映射到 guest_username 設置中指定的使用者。

匿名訪問主要用於向所有人提供對公共文件的訪問。

客人需要登錄名/密碼。訪客功能將訪問權限僅限於一組人(例如公司員工或註冊客戶)。

引用自:https://unix.stackexchange.com/questions/351885