CentOS 7搭建FTP服务器

本教程在CentOS 7主机下成功部署FTP服务器并和局域网内的主机成功通信。
花了一上午时间，终于在自己的CentOS 7主机下搭建好了FTP服务器，并且成功让局域网内的其他主机访问到。记录一下这里的坑：

1.关闭CentOS自带防火墙：
教程见本人另一篇博客：CentOS 7.X 关闭默认防火墙

2.安装vsftpd并设置开机自启：

yum -y install vsftpd             #安装vsftpdsystemctl start vsftpd.service    #启动vsftpdsystemctl enable vsftpd.service   #设置vsftpd开机自启动：

3.编辑/etc/vsftpd/vsftpd.conf文件:

vim /etc/vsftpd/vsftpd.conf

我在这里贴一份我已经改好的vsftpd.conf文件，具体各个参数含义选项可自行百度：

# Example config file /etc/vsftpd/vsftpd.conf## The default compiled in settings are fairly paranoid. This sample file# loosens things up a bit, to make the ftp daemon more usable.# Please see vsftpd.conf.5 for all compiled in defaults.## READ THIS: This example file is NOT an exhaustive list of vsftpd options.# Please read the vsftpd.conf.5 manual page to get a full idea of vsftpd's# capabilities.## Allow anonymous FTP? (Beware - allowed by default if you comment this out).anonymous_enable=YES## Uncomment this to allow local users to log in.# When SELinux is enforcing check for SE bool ftp_home_dirlocal_enable=YES#userlist_deny=NO# Uncomment this to enable any form of FTP write command.write_enable=YES## Default umask for local users is 077. You may wish to change this to 022,# if your users expect that (022 is used by most other ftpd's)local_umask=077## Uncomment this to allow the anonymous FTP user to upload files. This only# has an effect if the above global write enable is activated. Also, you will# obviously need to create a directory writable by the FTP user.# When SELinux is enforcing check for SE bool allow_ftpd_anon_write, allow_ftpd_full_accessanon_upload_enable=YES## Uncomment this if you want the anonymous FTP user to be able to create# new directories.#anon_mkdir_write_enable=YES## Activate directory messages - messages given to remote users when they# go into a certain directory.dirmessage_enable=YES## Activate logging of uploads/downloads.xferlog_enable=YES## Make sure PORT transfer connections originate from port 20 (ftp-data).connect_from_port_20=YES## If you want, you can arrange for uploaded anonymous files to be owned by# a different user. Note! Using "root" for uploaded files is not# recommended!#chown_uploads=YES#chown_username=whoever## You may override where the log file goes if you like. The default is shown# below.#xferlog_file=/var/log/xferlog## If you want, you can have your log file in standard ftpd xferlog format.# Note that the default log file location is /var/log/xferlog in this case.xferlog_std_format=YES## You may change the default value for timing out an idle session.#idle_session_timeout=600## You may change the default value for timing out a data connection.#data_connection_timeout=120## It is recommended that you define on your system a unique user which the# ftp server can use as a totally isolated and unprivileged user.#nopriv_user=ftpsecure## Enable this and the server will recognise asynchronous ABOR requests. Not# recommended for security (the code is non-trivial). Not enabling it,# however, may confuse older FTP clients.#async_abor_enable=YES## By default the server will pretend to allow ASCII mode but in fact ignore# the request. Turn on the below options to have the server actually do ASCII# mangling on files when in ASCII mode.# Beware that on some FTP servers, ASCII support allows a denial of service# attack (DoS) via the command "SIZE /big/file" in ASCII mode. vsftpd# predicted this attack and has always been safe, reporting the size of the# raw file.# ASCII mangling is a horrible feature of the protocol.#ascii_upload_enable=YES#ascii_download_enable=YES## You may fully customise the login banner string:#ftpd_banner=Welcome to blah FTP service.## You may specify a file of disallowed anonymous e-mail addresses. Apparently# useful for combatting certain DoS attacks.#deny_email_enable=YES# (default follows)#banned_email_file=/etc/vsftpd/banned_emails## You may specify an explicit list of local users to chroot() to their home# directory. If chroot_local_user is YES, then this list becomes a list of# users to NOT chroot().# (Warning! chroot'ing can be very dangerous. If using chroot, make sure that# the user does not have write access to the top level directory within the# chroot)#chroot_local_user=YES#chroot_list_enable=YES# (default follows)#chroot_list_file=/etc/vsftpd/chroot_list## You may activate the "-R" option to the builtin ls. This is disabled by# default to avoid remote users being able to cause excessive I/O on large# sites. However, some broken FTP clients such as "ncftp" and "mirror" assume# the presence of the "-R" option, so there is a strong case for enabling it.#ls_recurse_enable=YES## When "listen" directive is enabled, vsftpd runs in standalone mode and# listens on IPv4 sockets. This directive cannot be used in conjunction# with the listen_ipv6 directive.listen=YES## This directive enables listening on IPv6 sockets. By default, listening# on the IPv6 "any" address (::) will accept connections from both IPv6# and IPv4 clients. It is not necessary to listen on *both* IPv4 and IPv6# sockets. If you want that (perhaps because you want to listen on specific# addresses) then you must run two copies of vsftpd with two configuration# files.# Make sure, that one of the listen options is commented !!#listen_ipv6=YESpam_service_name=vsftpduserlist_enable=NOtcp_wrappers=YESpasv_enable=YES#被动模式最小端口号30000pasv_min_port=30000#被动模式最大端口号31000pasv_max_port=31000

然后记得保存完毕后重启vsftpd服务：

systemctl restart vsftpd.service

4.创建ftp用户：
这里创建的格式是：useradd -d 目录 用户名
例如：

useradd -d /home/ftp ftpuser

5.设置密码：

passwd ftpuser

回车之后输入密码确认。
至此，搭建FTP服务器的大部分流程已经走完，可以在Linux本机输入：

ftp localhost

试下，如果是要求输入密码，并且提示连接成功，再用常见的命令ls , dir试下。
如果一点错误都没出，表明FTP服务器搭建成功。
如果提示530，425之类的，再继续博客下面的操作。

6.更改ftp目录权限：
拿上面的/home/ftp为例，直接输入：

chmod 777 /home/ftp

把ftp对应这个文件夹权限全部开放。

7.修改selinux配置文件：

vi /etc/selinux/config

然后把SELINUX属性改为disabled。

SELINUX=disabled

8.修改iptables配置文件

vi /etc/sysconfig/iptables

加入以下字段：

-A INPUT -p tcp -m state --state NEW -m tcp --dport 21 -j ACCEPT-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT-A INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT-A INPUT -p tcp -m state --state NEW -m tcp --dport 3306 -j ACCEPT-A INPUT -p tcp --dport 30000:31000 -j ACCEPT

我的完整的/etc/sysconfig/iptables文件如下：

# sample configuration for iptables service# you can edit this manually or use system-config-firewall# please do not ask us to add additional ports/services to this default configuration*filter:INPUT ACCEPT [0:0]:FORWARD ACCEPT [0:0]:OUTPUT ACCEPT [0:0]-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT-A INPUT -p icmp -j ACCEPT-A INPUT -i lo -j ACCEPT-A INPUT -p tcp -m state --state NEW -m tcp --dport 21 -j ACCEPT-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT-A INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT-A INPUT -p tcp -m state --state NEW -m tcp --dport 3306 -j ACCEPT-A INPUT -p tcp --dport 30000:31000 -j ACCEPT-A INPUT -j REJECT --reject-with icmp-host-prohibited-A FORWARD -j REJECT --reject-with icmp-host-prohibitedCOMMIT

然后，重启iptables服务：

systemctl restart iptables.service

至此，我既可以在本机

ftp localhost

也可以用其他主机使用这台CentOS主机的FTP服务了。
参考：
1.CentOS 7 x64 搭建FTP服务器
2.CentOS 7 搭建ftp服务器
3.Linux环境下创建FTP用户
4.在linux中添加ftp用户，并设置相应的权限