获取“许可拒绝”在Centos中使用PROFTPD SFTP [英] Getting "permission denied" with PROFTPD SFTP in Centos
问题描述
我想用CentOS 6配置SFTP服务器。但是当我使用Filezila客户端put时,我有这个消息:
I want configured a SFTP server with CentOS 6. But when I use "put" with Filezila client, I have this message :
open for write: permission denied
在我的日志sftp我有这个当我使用'put ':
In my logs sftp I Have this when I use 'put':
...
unsupported 'simply@putty.projects.tartarus.org' channel requested, ignoring
'subsystem' channel request for 'sftp' subsystem
..
error checking 'namefile' for REALPATH : Aucun fichier ou dossier de ce type
error opening 'filename'; Permission non accordée
我不明白,因为在Debian它工作得很好...
I do not understand because on Debian it works very well...
安装Proftpd:
sudo rpm –Uvh http://download.fedoraproject.org/pub/epel/6/i386/epel-release-6-8.noarch.rpm
sudo yum install proftpd
对我的测试,我阻止了防火墙:
For my tests, I blocked the firewall :
service iptables stop
我在ssh配置文件sshd_config中注释了Subsystem行
I commented the line "Subsystem" in ssh configuration file "sshd_config"
# Subsystem sftp ....
proftpd配置文件proftpd.conf中的行:
I add this lines in proftpd configuration file "proftpd.conf" :
nano /etc/proftpd.conf
LoadModule mod_sftp.c
LoadModule mod_sftp_pam.c
<IfModule mod_sftp.c>
# On écoute sur le port 2222
Port 2222
# On active le mode SFTP
SFTPEngine on
# Emplacement des clés de cryptage
SFTPHostKey /etc/ssh/ssh_host_rsa_key2
SFTPHostKey /etc/ssh/ssh_host_dsa_key2
# Pour le moment, on met authentification par mot de passé
# On changera après par authentification par clé
SFTPAuthMethods password
# L’utilisateur est bloqué au repertoire qu’on lui a attribué
lors de sa création
DefaultRoot ~
# On ajoute les fichiers log pour le sftp
SFTPLog /etc/sftp/log/sftp.log
TransferLog /etc/sftp/log/sftp-transfer.log
</IfModule>
我添加了一个新用户和新组:
I add a new user and new group :
groupadd upload
adduser --home /etc/sftp/home nom_utilisateur
# On associe le nouvel utilisateur à un des groupes (upload ou download)
usermod –g nom_groupe nom_utilisateur
我可以连接SFTP(日志文件填充),但我可以不使用put..当我在服务器中创建一个文件test时,在filezila文件被重命名'avril 28 12:45 test'..
I can connect to SFTP (the log file fills) but I can not use "put".. When I create a file "test" in a server, in filezila the file is rename 'avril 28 12:45 test"..
文件/ home的权限为777.
Permissions of file /home is 777.
这是这个proftpd.conf:
This is this proftpd.conf :
# This is the ProFTPD configuration file
ServerName "ProFTPD server"
ServerIdent on "FTP Server ready."
ServerAdmin root@localhost
DefaultServer on
VRootEngine on
VRootAlias /etc/security/pam_env.conf etc/security/pam_env.conf
# Use pam to authenticate (default) and be authoritative
AuthPAMConfig proftpd
AuthOrder mod_auth_pam.c* mod_auth_unix.c
# If you use NIS/YP/LDAP you may need to disable PersistentPasswd
PersistentPasswd off
# Don't do reverse DNS lookups (hangs on DNS problems)
UseReverseDNS off
# Set the user and group that the server runs as
User nobody
Group nobody
# Disable sendfile by default since it breaks displaying the download speeds in
# ftptop and ftpwho
UseSendfile on
# Define the log formats
LogFormat default "%h %l %u %t \"%r\" %s %b"
LogFormat auth "%v [%P] %h %t \"%r\" %s"
LoadModule mod_sftp.c
LoadModule mod_sftp_pam.c
# Dynamic ban lists (http://www.proftpd.org/docs/contrib/mod_ban.html)
# Enable this with PROFTPD_OPTIONS=-DDYNAMIC_BAN_LISTS in /etc/sysconfig/proftpd
<IfDefine DYNAMIC_BAN_LISTS>
LoadModule mod_ban.c
BanEngine on
BanLog /var/log/proftpd/ban.log
BanTable /var/run/proftpd/ban.tab
BanOnEvent MaxLoginAttempts 2/00:10:00 01:00:00
BanControlsACLs all allow user ftpadm
</IfDefine>
<Global>
# Umask 022 is a good standard umask to prevent new dirs and files
# from being group and world writable
Umask 022
# Allow users to overwrite files and change permissions
AllowOverwrite on
<Limit ALL SITE_CHMOD>
AllowAll
</Limit>
</Global>
## SFTP
....
推荐答案
默认情况下,SElinux保护您的服务器并禁止访问目录。
By default SElinux protect you server and disallow access to directories.
您可以通过使用chcon创建规则来允许访问。
You can allow acces by creating rules using chcon.
网站示例:
- 测试selinux:ls -dZ / home / myusergrp / myuser / ftp
- 允许访问权限:chcon -R -t httpd_sys_content_t / home / myusergrp / myuser / ftp
不要删除selinux,更倾向于/ etc / selinux / config,并配置SELINUX = permissive,而不是SELINUX = enforcing(并重新启动服务器)。
Dont remove selinux, prefert go to /etc/selinux/config and configure SELINUX=permissive instead SELINUX=enforcing (and reboot the server). It show you all access problem, that you can solve, and re-enable the enforcing mode after you solve it.
要了解更多信息: http://selinuxproject.org/page/FTPRecipes
我希望此帮助,
Mike
I hope this help, Mike
这篇关于获取“许可拒绝”在Centos中使用PROFTPD SFTP的文章就介绍到这了,希望我们推荐的答案对大家有所帮助,也希望大家多多支持IT屋!