|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 |
# VSFTPD chroot configuration >> Create a no-shell user useradd -d $HOME_PATH -s /sbin/nologin $FTPUSER && passwd $FTPUSER !!!MAKE SURE TO CHMOD 755 the parent directory!!! yum -y install vsftpd chkconfig vsftpd on sed -i -e 's/IPTABLES_MODULES=""/IPTABLES_MODULES="ip_conntrack_ftp"/g' /etc/sysconfig/iptables-config modprobe ip_conntrack_ftp echo "rack" >> /etc/vsftpd/vsftpd.chroot_list mv /etc/vsftpd/vsftpd.conf /etc/vsftpd/vsftpd.conf.ORIG cat >/etc/vsftpd/vsftpd.conf <<EOF # vsftpd.conf - PASSIVE anonymous_enable=NO local_enable=YES write_enable=YES local_umask=022 dirmessage_enable=YES xferlog_enable=YES listen_port=21 connect_from_port_20=YES xferlog_std_format=YES listen=YES pam_service_name=vsftpd userlist_enable=YES tcp_wrappers=YES pasv_min_port=60000 pasv_max_port=65000 # Add in /etc/vsftpd/vsftpd.chroot_list who you do *NOT* want to be chrooted chroot_local_user=YES chroot_list_enable=YES chroot_list_file=/etc/vsftpd/vsftpd.chroot_list # RackConnect # pasv_enable=YES # pasv_min_port=60000 # pasv_max_port=60100 # pasv_address=<publicRCip> (might not be required) # Logging xferlog_enable=YES log_ftp_protocol=NO syslog_enable=NO vsftpd_log_file=/var/log/vsftpd.log EOF >> Make sure to comment out "auth required pam_shells.so" in /etc/pam.d/vsftpd (errors in authenticate users with /bin/false shell): sed -i 's/^\(auth.*required.*pam_shells\.so.*$\)/#\1/' /etc/pam.d/vsftpd >> Enable firewall ports (in Rackconnect, open the same on the physical firewall): iptables -I INPUT -p tcp --dport 21 -m comment --comment "FTP" -j ACCEPT iptables -I INPUT -p tcp -m multiport --dports 60000:65000 -m comment --comment "FTP passive mode ports" -j ACCEPT /etc/init.d/iptables save >> Restart the service service vsfptd restart If -> vsftpd: refusing to run with writable root inside chroot () => allow_writable_chroot=YES ======================================================= SFTP Jailed: !!!! remember that the users home directory must be owned by root groupadd sftponly >> 1 domain managed by 1 or more users: useradd -d /var/www/vhosts -s /bin/false -G sftponly bob >> 1 user managing multiple domains: useradd -d /var/www/vhosts -s /bin/false -G sftponly bob SFTPUSER=bob SFTPUSERPASS=$(tr -cd '[:alnum:]' < /dev/urandom | fold -w12 | head -n1) echo "$SFTPUSERPASS" | passwd --stdin $SFTPUSER && echo -e "\nsfptuser: $SFTPUSER\npassword: $SFTPUSERPASS" >> /etc/ssh/sshd_config #Subsystem sftp /usr/libexec/openssh/sftp-server Subsystem sftp internal-sftp >> 1 domain managed by 1 or more users: Match Group sftponly ChrootDirectory %h X11Forwarding no AllowTCPForwarding no ForceCommand internal-sftp >> 1 user managing multiple domains: Match Group sftponly ChrootDirectory /var/www/vhosts/%u X11Forwarding no AllowTCPForwarding no ForceCommand internal-sftp sshd -t service sshd restart >> Set correct permissions!!! chmod 755 /var/www/ chown root:root /var/www chown -R root:sftponly /var/www/* find /var/www/ -type d | xargs chmod 2775 find /var/www/ -type f | xargs chmod 644 |