Improving Linux FTP Server Security with vsftpd and AppArmor
1. Harden vsftpd Configuration
vsftpd (Very Secure FTP Daemon) is the foundation of a secure FTP server. Start by disabling anonymous access (anonymous_enable=NO) to prevent unauthorized users from logging in. Restrict local users to their home directories using chroot_local_user=YES (combined with allow_writeable_chroot=YES to avoid permission issues)—this limits users to their own files and prevents system-wide access. Enable SSL/TLS encryption (ssl_enable=YES, force_local_data_ssl=YES, force_local_logins_ssl=YES) to protect data in transit from eavesdropping. Use strong passwords for all FTP accounts and consider implementing a user list (userlist_enable=YES, userlist_deny=NO) to control which users can log in. For passive mode, restrict port ranges (pasv_enable=YES, pasv_min_port=50000, pasv_max_port=50010) to reduce exposure to unauthorized connections.
2. Configure AppArmor to Constrain vsftpd
AppArmor (Application Armor) is a mandatory access control (MAC) system that limits vsftpd’s access to only necessary files and directories. First, enforce the default vsftpd profile:
sudo aa-enforce /etc/apparmor.d/usr.sbin.vsftpd
Customize the profile to restrict vsftpd’s permissions further. For example, deny access to sensitive system directories (e.g., /etc/, /root/) and limit file operations to the user’s home directory. Use aa-logprof to analyze vsftpd logs and refine the profile based on actual usage—this ensures the profile is neither too permissive nor too restrictive. Regularly review and update the profile to adapt to changes in the server environment.
3. Combine vsftpd and AppArmor for Defense-in-Depth
vsftpd’s built-in security features (e.g., chroot, SSL) reduce the attack surface, while AppArmor adds an additional layer of protection by enforcing strict access controls. For instance, even if a vulnerability in vsftpd allows an attacker to execute arbitrary code, AppArmor prevents them from accessing critical system files outside the user’s home directory. This layered approach significantly lowers the risk of a successful breach.
4. Additional Security Measures
- Firewall Rules: Use
ufworfirewalldto allow only necessary FTP ports (21/tcp for control, 50000-50010/tcp for passive mode) and block all other incoming traffic. - Regular Updates: Keep vsftpd, AppArmor, and the operating system up to date to patch known vulnerabilities.
- Logging and Monitoring: Enable detailed logging in vsftpd (
xferlog_enable=YES,log_ftp_protocol=YES) and use tools likefail2banto automatically block suspicious IP addresses (e.g., multiple failed login attempts). - Virtual Users: For higher security, use virtual users (authenticated via a database) instead of system users—this isolates FTP access from system accounts and reduces the risk of privilege escalation.
以上就是关于“Linux vsftp与AppArmor：如何提高系统安全性”的相关介绍，筋斗云是国内较早的云主机应用的服务商，拥有10余年行业经验，提供丰富的云服务器、租用服务器等相关产品服务。云服务器资源弹性伸缩，主机vCPU、内存性能强悍、超高I/O速度、故障秒级恢复；电子化备案，提交快速，专业团队7×24小时服务支持！
简单好用、高性价比云服务器租用链接：https://www.jindouyun.cn/product/cvm