\u6700\u8fd1\u516c\u53f8\u7684\u5ba2\u6236\uff0c\u7528ftp\u9023\u7dda\u6642\uff0c\u4e00\u76f4\u88ab\u4e3b\u6a5f\u7684\u9632\u706b\u7246\u8aa4\u5224\u70ba\u653b\u64ca\u3002\u9019\u500b\u554f\u984c\u662f\u9019\u6a23\u5b50\u7522\u751f\u7684\uff1a\u516c\u53f8\u7684\u9632\u706b\u7246\u662f\u7528csf firewall\u9019\u500b\u5957\u4ef6\uff0c\u800c\u9019\u500b\u5957\u4ef6\u5982\u679c\u6c92\u6709\u7279\u5225\u8a2d\u5b9a\u7684\u8a71\uff0c\u5c0d\u65bcftp\uff0c\u5f88\u5bb9\u6613\u8aa4\u64cb\u3002<\/p>\n

\u6839\u64dacsf\u7684\u6587\u4ef6\uff0clinux\u7684iptables\u5982\u679cip_conntrack\u548cip_conntrack_ftp\u6c92\u6709\u6b63\u5e38\u7684\u904b\u4f5c\u6642\uff0cFTP\u7684\u88ab\u52d5\u6a21\u5f0f\u5c31\u7121\u6cd5\u9806\u5229\u5730\u904b\u4f5c\u3002\u5728\u9019\u7a2e\u689d\u4ef6\u4e0b\uff0c\u6211\u5011\u5fc5\u9808\u8a2d\u5b9aftp\u7684\u88ab\u52d5\u901a\u8a0a\u57e0\u5728\u9632\u706b\u7246\u4e0a\u662f\u88ab\u8996\u70ba\u53ef\u9023\u63a5\u7684\u3002<\/p>\n

\u4ee5pure-ftp\u70ba\u4f8b\u5b50\uff1a
\n(1) \u5fc5\u9808\u4fee\u6539\/etc\/pure-ftpd.conf\uff0c\u53d6\u6d88
\nPassivePortRange 30000 35000
\n\u9019\u4e00\u884c\u7684\u8a3b\u89e3 (\u6ce8\u610f<\/span>\uff1a\u6b64\u8655\u7684port range\u8981\u548c\u4e4b\u5f8c\u6b65\u9a5f\uff0c\u8a2d\u5b9aCSF\u7684port range\u76f8\u7b26\u5408)
\n(2) \u91cd\u65b0\u555f\u52d5pure-ftp
\n(3) \u4fee\u6539csf\u7684config\u6a94\u3000\/etc\/csf\/csf.conf
\n\u5728 TCP_IN\u4e2d\uff0c\u52a0\u4e0a30000:\uff135000\uff0c\u4f8b\u5982\uff1a
\n# Allow incoming TCP ports
\nTCP_IN = \u201c20,21,22,25,53,80,110,143,443,465,587,993,995,2077,2078,2082,2083,2086,2087,2095,2096,1891,30000:\uff135000\u2033
\n(4) \u91cd\u65b0\u555f\u52d5csf<\/p>\n

\u9019\u6a23\u5b50\u8a2d\u5b9a\u4e4b\u5f8c\uff0c\u9632\u706b\u7246\u624d\u80fd\u548cftp\u5b8c\u7f8e\u7684\u5408\u4f5c\u3002<\/p>\n

\u53c3\u8003\u8cc7\u6599\uff1ahttp:\/\/www.configserver.com\/free\/csf\/readme.txt<\/a><\/p>\n

\u5ef6\u4f38\u95b1\u8b80:\u5982\u4f55\u67e5\u770blinux server\u9023\u7ddaport\u662f\u5426\u7570\u5e38\uff1f<\/a><\/p>\n

13. A note about FTP Connection Issues\r\n######################################\r\n\r\nIt is important when using an SPI firewall to ensure FTP client applications\r\nare configured to use Passive (PASV) mode connections to the server.\r\n\r\nOn servers running Monolithic kernels (e.g. VPS Virtuozzo\/OpenVZ and custom\r\nbuilt kernels) ip_conntrack and ip_conntrack_ftp iptables kernel modules may\r\nnot be available or fully functional. If this happens, FTP passive mode (PASV)\r\nwon't work. In such circumstances you will have to open a hole in your firewall\r\nand configure the FTP server to use that same hole.\r\n\r\nFor example, with pure-ftpd you could add the port range 30000:35000 to TCP_IN\r\nand add the following line to \/etc\/pure-ftpd.conf and then restart pure-ftpd:\r\nPassivePortRange\t30000 35000\r\n\r\nFor example, with proftpd you could add the port range 30000:35000 to TCP_IN\r\nand add the following line to \/etc\/proftpd.conf and then restart proftpd:\r\nPassivePorts\t30000 35000\r\n\r\nFTP over SSL\/TLS will usually fail when using an SPI firewall. This is because\r\nof the way the FTP protocol established a connection between client and server.\r\niptables fails to establish a related connection when using FTP over SSL\r\nbecause the FTP control connection is encrypted and so cannot track the\r\nrelationship between the connection and the allocation of an ephemeral port.\r\n\r\nIf you need to use FTP over SSL, you will have to open up a passive port block\r\nin both csf and your FTP server configuration (see above).\r\n\r\nPerversely, this makes your firewall less secure, while trying to make FTP\r\nconnections more secure.\r\n\r\n\r\n\r\n<\/pre>\n","protected":false},"excerpt":{"rendered":"
\u6700\u8fd1\u516c\u53f8\u7684\u5ba2\u6236\uff0c\u7528ftp\u9023\u7dda\u6642\uff0c\u4e00\u76f4\u88ab\u4e3b\u6a5f\u7684\u9632\u706b\u7246\u8aa4\u5224\u70ba\u653b\u64ca\u3002\u9019\u500b\u554f\u984c\u662f\u9019\u6a23\u5b50\u7522\u751f\u7684\uff1a\u516c\u53f8\u7684\u9632\u706b\u7246\u662f\u7528csf  … \u95b1\u8b80\u5168\u6587 \u5982\u4f55\u8b93\u4e3b\u6a5f\u7684\u9632\u706b\u7246csf\u4e0d\u6703\u8aa4\u64cb\u5230ftp<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_mi_skip_tracking":false},"categories":[3],"tags":[31,33,32],"_links":{"self":[{"href":"https:\/\/blog.unethost.com\/wp-json\/wp\/v2\/posts\/130"}],"collection":[{"href":"https:\/\/blog.unethost.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.unethost.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.unethost.com\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.unethost.com\/wp-json\/wp\/v2\/comments?post=130"}],"version-history":[{"count":8,"href":"https:\/\/blog.unethost.com\/wp-json\/wp\/v2\/posts\/130\/revisions"}],"predecessor-version":[{"id":4302,"href":"https:\/\/blog.unethost.com\/wp-json\/wp\/v2\/posts\/130\/revisions\/4302"}],"wp:attachment":[{"href":"https:\/\/blog.unethost.com\/wp-json\/wp\/v2\/media?parent=130"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.unethost.com\/wp-json\/wp\/v2\/categories?post=130"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.unethost.com\/wp-json\/wp\/v2\/tags?post=130"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}