https://wiki.zhouba.cz/index.php?action=history&feed=atom&title=ZhoubaWiki%3AVsftpd 2026-04-04T06:57:09Z Revision history for this page on the wiki MediaWiki 1.35.2 https://wiki.zhouba.cz/index.php?title=ZhoubaWiki:Vsftpd&diff=28&oldid=prev 2021-05-22T16:40:26Z

<p>Created page with &quot;=== Sample production config === &lt;pre&gt; # Example config file /etc/vsftpd.conf # # The default compiled in settings are fairly paranoid. This sample file # loosens things up a...&quot;</p> <p><b>New page</b></p><div>=== Sample production config ===<br /> <br /> &lt;pre&gt;<br /> # Example config file /etc/vsftpd.conf<br /> #<br /> # The default compiled in settings are fairly paranoid. This sample file<br /> # loosens things up a bit, to make the ftp daemon more usable.<br /> # Please see vsftpd.conf.5 for all compiled in defaults.<br /> #<br /> # READ THIS: This example file is NOT an exhaustive list of vsftpd options.<br /> # Please read the vsftpd.conf.5 manual page to get a full idea of vsftpd's<br /> # capabilities.<br /> #<br /> #<br /> # Run standalone? vsftpd can run either from an inetd or as a standalone<br /> # daemon started from an initscript.<br /> listen=YES<br /> #<br /> # Run standalone with IPv6?<br /> # Like the listen parameter, except vsftpd will listen on an IPv6 socket<br /> # instead of an IPv4 one. This parameter and the listen parameter are mutually<br /> # exclusive.<br /> #listen_ipv6=YES<br /> #<br /> # Allow anonymous FTP? (Disabled by default)<br /> anonymous_enable=NO<br /> #<br /> # Uncomment this to allow local users to log in.<br /> local_enable=YES<br /> #<br /> # Uncomment this to enable any form of FTP write command.<br /> write_enable=YES<br /> #<br /> # Default umask for local users is 077. You may wish to change this to 022,<br /> # if your users expect that (022 is used by most other ftpd's)<br /> #local_umask=022<br /> #<br /> # Uncomment this to allow the anonymous FTP user to upload files. This only<br /> # has an effect if the above global write enable is activated. Also, you will<br /> # obviously need to create a directory writable by the FTP user.<br /> #anon_upload_enable=YES<br /> #<br /> # Uncomment this if you want the anonymous FTP user to be able to create<br /> # new directories.<br /> #anon_mkdir_write_enable=YES<br /> #<br /> # Activate directory messages - messages given to remote users when they<br /> # go into a certain directory.<br /> dirmessage_enable=YES<br /> #<br /> # If enabled, vsftpd will display directory listings with the time<br /> # in your local time zone. The default is to display GMT. The<br /> # times returned by the MDTM FTP command are also affected by this<br /> # option.<br /> use_localtime=YES<br /> #<br /> # Activate logging of uploads/downloads.<br /> xferlog_enable=YES<br /> #<br /> # Make sure PORT transfer connections originate from port 20 (ftp-data).<br /> connect_from_port_20=YES<br /> #<br /> # If you want, you can arrange for uploaded anonymous files to be owned by<br /> # a different user. Note! Using &quot;root&quot; for uploaded files is not<br /> # recommended!<br /> #chown_uploads=YES<br /> #chown_username=whoever<br /> #<br /> # You may override where the log file goes if you like. The default is shown<br /> # below.<br /> #xferlog_file=/var/log/vsftpd.log<br /> #<br /> # If you want, you can have your log file in standard ftpd xferlog format.<br /> # Note that the default log file location is /var/log/xferlog in this case.<br /> #xferlog_std_format=YES<br /> #<br /> # You may change the default value for timing out an idle session.<br /> #idle_session_timeout=600<br /> #<br /> # You may change the default value for timing out a data connection.<br /> #data_connection_timeout=120<br /> #<br /> # It is recommended that you define on your system a unique user which the<br /> # ftp server can use as a totally isolated and unprivileged user.<br /> #nopriv_user=ftpsecure<br /> #<br /> # Enable this and the server will recognise asynchronous ABOR requests. Not<br /> # recommended for security (the code is non-trivial). Not enabling it,<br /> # however, may confuse older FTP clients.<br /> #async_abor_enable=YES<br /> #<br /> # By default the server will pretend to allow ASCII mode but in fact ignore<br /> # the request. Turn on the below options to have the server actually do ASCII<br /> # mangling on files when in ASCII mode.<br /> # Beware that on some FTP servers, ASCII support allows a denial of service<br /> # attack (DoS) via the command &quot;SIZE /big/file&quot; in ASCII mode. vsftpd<br /> # predicted this attack and has always been safe, reporting the size of the<br /> # raw file.<br /> # ASCII mangling is a horrible feature of the protocol.<br /> #ascii_upload_enable=YES<br /> #ascii_download_enable=YES<br /> #<br /> # You may fully customise the login banner string:<br /> #ftpd_banner=Welcome to blah FTP service.<br /> #<br /> # You may specify a file of disallowed anonymous e-mail addresses. Apparently<br /> # useful for combatting certain DoS attacks.<br /> #deny_email_enable=YES<br /> # (default follows)<br /> #banned_email_file=/etc/vsftpd.banned_emails<br /> #<br /> # You may restrict local users to their home directories. See the FAQ for<br /> # the possible risks in this before using chroot_local_user or<br /> # chroot_list_enable below.<br /> chroot_local_user=YES<br /> #<br /> # You may specify an explicit list of local users to chroot() to their home<br /> # directory. If chroot_local_user is YES, then this list becomes a list of<br /> # users to NOT chroot().<br /> # (Warning! chroot'ing can be very dangerous. If using chroot, make sure that<br /> # the user does not have write access to the top level directory within the<br /> # chroot)<br /> #chroot_local_user=YES<br /> #chroot_list_enable=YES<br /> # (default follows)<br /> #chroot_list_file=/etc/vsftpd.chroot_list<br /> #<br /> # You may activate the &quot;-R&quot; option to the builtin ls. This is disabled by<br /> # default to avoid remote users being able to cause excessive I/O on large<br /> # sites. However, some broken FTP clients such as &quot;ncftp&quot; and &quot;mirror&quot; assume<br /> # the presence of the &quot;-R&quot; option, so there is a strong case for enabling it.<br /> #ls_recurse_enable=YES<br /> #<br /> # Customization<br /> #<br /> # Some of vsftpd's settings don't fit the filesystem layout by<br /> # default.<br /> #<br /> # This option should be the name of a directory which is empty. Also, the<br /> # directory should not be writable by the ftp user. This directory is used<br /> # as a secure chroot() jail at times vsftpd does not require filesystem<br /> # access.<br /> secure_chroot_dir=/var/run/vsftpd/empty<br /> #<br /> # This string is the name of the PAM service vsftpd will use.<br /> pam_service_name=vsftpd<br /> #<br /> # This option specifies the location of the RSA certificate to use for SSL<br /> # encrypted connections.<br /> #rsa_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem<br /> #rsa_cert_file=/etc/ssl/private/vsftpd.pem<br /> rsa_cert_file=/etc/ssl/certs/example_com.crt<br /> # This option specifies the location of the RSA key to use for SSL<br /> # encrypted connections.<br /> #rsa_private_key_file=/etc/ssl/private/ssl-cert-snakeoil.key<br /> #rsa_private_key_file=/etc/ssl/private/vsftpd.pem<br /> rsa_private_key_file=/etc/ssl/private/example_com.key<br /> <br /> pasv_enable=YES<br /> pasv_min_port=40000<br /> pasv_max_port=40100<br /> <br /> ssl_enable=YES<br /> allow_anon_ssl=NO<br /> force_local_data_ssl=NO<br /> force_local_logins_ssl=NO<br /> <br /> ssl_tlsv1=YES<br /> ssl_sslv2=NO<br /> ssl_sslv3=NO<br /> <br /> require_ssl_reuse=NO<br /> ssl_ciphers=HIGH<br /> allow_writeable_chroot=YES<br /> <br /> seccomp_sandbox=no<br /> &lt;/pre&gt;</div>

Garak