ftp の一部のコマンドを使えないようにする設定のメモです。
ディレクトリ削除コマンド rmdir を使えなくしてみます。
まずは、コマンド一覧と rmdir が使える状態である事を確認します。
ftp> help
Commands may be abbreviated. Commands are:
! cr mdir proxy send
$ delete mget sendport site
account debug mkdir put size
append dir mls pwd status
ascii disconnect mode quit struct
bell form modtime quote system
binary get mput recv sunique
bye glob newer reget tenex
case hash nmap rstatus trace
ccc help nlist rhelp type
cd idle ntrans rename user
cdup image open reset umask
chmod lcd passive restart verbose
clear ls private rmdir ?
close macdef prompt runique
cprotect mdelete protect safe
(rmdir がありますね)
ftp> mkdir testdir1
257 "/testdir1" created
ftp> dir
227 Entering Passive Mode (127,0,0,1,234,141)
150 Here comes the directory listing.
drwxrwsr-x 2 14 50 4096 Sep 06 11:55 testdir1
226 Directory send OK.
ftp> rmdir testdir1
250 Remove directory operation successful.
ftp> dir
227 Entering Passive Mode (127,0,0,1,234,153)
150 Here comes the directory listing.
226 Directory send OK.
ftp>
(rmdir コマンドが実行できます) |
ftp> help
Commands may be abbreviated. Commands are:
! cr mdir proxy send
$ delete mget sendport site
account debug mkdir put size
append dir mls pwd status
ascii disconnect mode quit struct
bell form modtime quote system
binary get mput recv sunique
bye glob newer reget tenex
case hash nmap rstatus trace
ccc help nlist rhelp type
cd idle ntrans rename user
cdup image open reset umask
chmod lcd passive restart verbose
clear ls private rmdir ?
close macdef prompt runique
cprotect mdelete protect safe
(rmdir がありますね)
ftp> mkdir testdir1
257 "/testdir1" created
ftp> dir
227 Entering Passive Mode (127,0,0,1,234,141)
150 Here comes the directory listing.
drwxrwsr-x 2 14 50 4096 Sep 06 11:55 testdir1
226 Directory send OK.
ftp> rmdir testdir1
250 Remove directory operation successful.
ftp> dir
227 Entering Passive Mode (127,0,0,1,234,153)
150 Here comes the directory listing.
226 Directory send OK.
ftp>
(rmdir コマンドが実行できます)
次に vsftpd.conf に cmds_allowed を追加します。
version 2.1 からは cmds_denied が使えるみたいです。
cmds_allowed=ABOR,ACCT,ALLO,APPE,CDUP,CWD,DELE,HELP,LIST,MKD,NLLST,NOOP,MODE,PASV,PORT,PWD,QUIT,REIN,REST,RETR,RNFR,RNTO,SITE,SMNT,STAT,STOR,STOU,STRU,SYST,TYPE,LPRT,LPSV,ADAT,AUTH,CCC,CONF,ENC,MIC,PBSZ,FEAT,OPTS,EPRT,EPSV,LANG,MDTM,MLSD,MLST,SIZE |
cmds_allowed=ABOR,ACCT,ALLO,APPE,CDUP,CWD,DELE,HELP,LIST,MKD,NLLST,NOOP,MODE,PASV,PORT,PWD,QUIT,REIN,REST,RETR,RNFR,RNTO,SITE,SMNT,STAT,STOR,STOU,STRU,SYST,TYPE,LPRT,LPSV,ADAT,AUTH,CCC,CONF,ENC,MIC,PBSZ,FEAT,OPTS,EPRT,EPSV,LANG,MDTM,MLSD,MLST,SIZE
こんなに要らない？ 🙂
vsftpd.conf を変更したので vsftpd を再起動します。
root# service vsftpd restart |
root# service vsftpd restart
rmdir が使えなくなった事を確認します。
ftp> mkdir testdir2
257 "/testdir2" created
ftp> dir
227 Entering Passive Mode (127,0,0,1,234,190)
150 Here comes the directory listing.
drwxrwsr-x 2 14 50 4096 Sep 06 12:25 testdir2
226 Directory send OK.
ftp> rmdir testdir2
550 Permission denied.
ftp> dir
227 Entering Passive Mode (127,0,0,1,234,120)
150 Here comes the directory listing.
drwxrwsr-x 2 14 50 4096 Sep 06 12:25 testdir2
226 Directory send OK.
(rmdir コマンドを実行しようとすると Permission denied. になりました) |
ftp> mkdir testdir2
257 "/testdir2" created
ftp> dir
227 Entering Passive Mode (127,0,0,1,234,190)
150 Here comes the directory listing.
drwxrwsr-x 2 14 50 4096 Sep 06 12:25 testdir2
226 Directory send OK.
ftp> rmdir testdir2
550 Permission denied.
ftp> dir
227 Entering Passive Mode (127,0,0,1,234,120)
150 Here comes the directory listing.
drwxrwsr-x 2 14 50 4096 Sep 06 12:25 testdir2
226 Directory send OK.
(rmdir コマンドを実行しようとすると Permission denied. になりました)
コマンド一覧からは rmdir が消えないみたいですね 
ftp> help
Commands may be abbreviated. Commands are:
! cr mdir proxy send
$ delete mget sendport site
account debug mkdir put size
append dir mls pwd status
ascii disconnect mode quit struct
bell form modtime quote system
binary get mput recv sunique
bye glob newer reget tenex
case hash nmap rstatus trace
ccc help nlist rhelp type
cd idle ntrans rename user
cdup image open reset umask
chmod lcd passive restart verbose
clear ls private rmdir ?
close macdef prompt runique
cprotect mdelete protect safe |
ftp> help
Commands may be abbreviated. Commands are:
! cr mdir proxy send
$ delete mget sendport site
account debug mkdir put size
append dir mls pwd status
ascii disconnect mode quit struct
bell form modtime quote system
binary get mput recv sunique
bye glob newer reget tenex
case hash nmap rstatus trace
ccc help nlist rhelp type
cd idle ntrans rename user
cdup image open reset umask
chmod lcd passive restart verbose
clear ls private rmdir ?
close macdef prompt runique
cprotect mdelete protect safe
今回はシステム全体で rmdir を使えなくしちゃいましたが、ユーザ毎に個別に設定する事もできるみたいです。
