在实际的系统运维工作中，我们经常会面临或提及服务器数据安全问题，例如FTP连接时用户对文件可以进行覆盖操作 不具有删除权限等等。本文通过vsftpd cmds_allowed 参数配置对vsftpd服务实现精细权限控制做了详细的说明。

vsftpd cmds_allowed
cmds_allowed=ABOR,CWD,LIST,MDTM,MKD,NLST,
PASS,PASV,PORT,PWD,QUIT,RETR,RMD,RNFR,
RNTO,SITE,SIZE,STOR,TYPE,USER,ACCT,
APPE,CDUP,HELP,MODE,NOOP,REIN,STAT,STOU,STRU,SYST

注意:一定不能使用换行和空格，不然就没效果..

# ABOR - abort a file transfer
# CWD - change working directory
# DELE - delete a remote file
# LIST - list remote files
# MDTM - return the modification time of a file
# MKD - make a remote directory
# NLST - name list of remote directory
# PASS - send password
# PASV - enter passive mode
# PORT - open a data port
# PWD - print working directory
# QUIT - terminate the connection
# RETR - retrieve a remote file
# RMD - remove a remote directory
# RNFR - rename from
# RNTO - rename to
# SITE - site-specific commands
# SIZE - return the size of a file
# STOR - store a file on the remote host
# TYPE - set transfer type
# USER - send username
#

# less common commands:
# ACCT* - send account information
# APPE - append to a remote file
# CDUP - CWD to the parent of the current directory
# HELP - return help on using the server
# MODE - set transfer mode
# NOOP - do nothing
# REIN* - reinitialize the connection
# STAT - return server status
# STOU - store a file uniquely
# STRU - set file transfer structure
# SYST - return system type

VSFTPD的非常有用的权限控制语句，也许在使用FTP的过程中，可能是有一些权限控制的不如意，通过下面例子大家或许能找到适合自己需求的权限分配
我们首先来看看下面的几个例子：
1、只能上传。不能下载、删除、重命名。

cmds_allowed＝FEAT,REST,CWD,LIST,MDTM,MKD,NLST,PASS,PASV,PORT,PWD,QUIT,RMD,SIZE,STOR,TYPE,USER,ACCT,APPE,CDUP,HELP,MODE,NOOP,REIN,STAT,STOU,STRU,SYST

2、只能下载。不能上传、删除、重命名。write_enable=NO
3、只能上传、删除、重命名。不能下载。download_enable＝NO
4、只能下载、删除、重命名。不能上传。

cmds_allowed=FEAT,REST,CWD,LIST,MDTM,MKD,NLST,PASS,PASV,PORT,PWD,QUIT,RMD,RNFR,RNTO,RETR,DELE,SIZE,TYPE,USER,ACCT,APPE,CDUP,HELP,MODE,NOOP,REIN,STAT,STOU,STRU,SYST

以上的2、3两点好控制，可是1和4就不是那么好控制了！

我给出了1和4的方法，当然，大家也可以说说自己是如何实现1和4的控制的，我们相互交流！
下面我就把具体的一些参数来和大家说说！

CWD - change working directory 更改目录
LIST - list remote files 列目录
MKD - make a remote directory 新建文件夹
NLST - name list of remote directory
PWD - print working directory 显示当前工作目录
RETR - retrieve a remote file 下载文件
STOR - store a file on the remote host 上传文件

DELE - delete a remote file 删除文件
RMD - remove a remote directory 删除目录
RNFR - rename from 重命名
RNTO - rename to 重命名

以上是常用的一些参数，大家对照学习一下！下面是列也的全部参数，供大家参考！

# ABOR - abort a file transfer 取消文件传输
# CWD - change working directory 更改目录
# DELE - delete a remote file 删除文件
# LIST - list remote files 列目录
# MDTM - return the modification time of a file 返回文件的更新时间
# MKD - make a remote directory 新建文件夹
# NLST - name list of remote directory
# PASS - send password
# PASV - enter passive mode
# PORT - open a data port 打开一个传输端口
# PWD - print working directory 显示当前工作目录
# QUIT - terminate the connection 退出
# RETR - retrieve a remote file 下载文件
# RMD - remove a remote directory
# RNFR - rename from
# RNTO - rename to
# SITE - site-specific commands
# SIZE - return the size of a file 返回文件大小
# STOR - store a file on the remote host 上传文件
# TYPE - set transfer type
# USER - send username

# less common commands:

# ACCT* - send account information
# APPE - append to a remote file
# CDUP - CWD to the parent of the current directory
# HELP - return help on using the server
# MODE - set transfer mode
# NOOP - do nothing
# REIN* - reinitialize the connection
# STAT - return server status
# STOU - store a file uniquely
# STRU - set file transfer structure
# SYST - return system type

例如：vsftp 用户只能上传不能删除
编辑vsftpd.conf配置文件添加
# vi /etc/vsftpd/vsftpd.conf

cmds_allowed=ABOR,CWD,LIST,MDTM,MKD,NLST,PASS,PASV,PORT,PWD,QUIT,RETR,RNFR,RNTO,SIZE,STOR,TYPE,USER,REST,CDUP,HELP,MODE,NOOP,REIN,STAT,STOU,STRU,SYST,FEAT（一些FTP的命令，就是除了DELE等命令）

# service vsftpd restart

相关文章

• PureFTPd安装配置 权限分离
• vsftpd连接错误425 Security: Bad IP connecting解决方法