redhat-vsftpd

# yum install vsftpd

# setsebool -P ftp_home_directory 1
 

#local user chroot forbiden

vi /etc/vsftpd/vsftpd.conf

chroot_list_enable= YES

chroot_list_file=/etc/vsftpd/chroot_list

 

add user to chroot_list file.

the user then can not change to his own home directory .

 

and the take care the selinux boolean as that one will override config file.

 

# anonymous_enable=YES  If you don't want anonymous access, you'll have to set this to NO.

 

# local_enable=YES  If you don't want regular users to log in, comment this out

 

#write_enable=YES  If you don't want remote users writing to your directories,

 

#chroot_list_enable=YES  If you set chroot_local_user=YES

#pam_service_name=vsftpd  Configures Pluggable Authentication Modules (PAM) security.

 

#userlist_enable=YES  Don't change this! This keeps users such as root from logging into your system.

 

#tcp_wrappers=YES  Supports the use of security commands in /etc/hosts.allow and /etc/hosts.deny.

 

#when login anonymous and find entering passive mode ,connect: no route to host ,means the vsftpd is given random port. add ip_conntrack_tcp to below config to lock the port. portmap can be fixed

firewall,for ftp ,has to use this approch

vi /etc/sysconf/iptables-config

IPTABLES_MODULES="ip_conntrack_ftp"

 enable root to login vsftp
take root out of /etc/vsftpd/ftpuser and /etc/vsftpd/user_list


#verify vsftp
getent passwd ftp  to check the home dircectory

$lftp station8    check anonymoue (default id ftp) access ftp's home
default home directory /var/ftp
$get lll

$lftp user1@station8  check local account user1s access
$get

-----------
man ftpd_selinux
------------
better update /etc/vsftpd/ftpuser rather than user_list as pam.d
read ftpuser without rebooting service