Red Hat Certified Engineer Tutorials
Sharing on a Network / FTP – Security Options
Visitors to VTC.com will be able to view all introductory videos for each training course.
Free Trial Members will gain access to first three chapters for each training course.
Full Access Members have full access to VTC.com�s entire library of video tutorials.
Learn More
Subtitles of the Movie (Red Hat Certified Engineer / Sharing on a Network / FTP – Security Options)
There are four levels of security available for the FTP server. The first is associated with directives listed in the vsftp configuration file, some of which were discussed in another video. The second is associated with a Firewall. It's easy enough to open a Firewall for all access using the Security Level Configuration tool. Just disable the Firewall. But what if you want limited access? You could run the iptables command directly, which can support limited access using IP addresses. Myself, I use the Security Level Configuration tool to allow access to the FTP service, which opens up port 21. Then, I open up the associated configuration file, etc slash sysconfig slash iptables, and then I include the dash s switch in the appropriate command. The dash s allows me to specify the IP address or network of my choice. In this case, 192 dot 168 dot 0 dot 0 with the 255 dot 255 dot 255 dot 0 network mask. This is the directive that allows access through port 21, and the dash s switch supports access and limits it to that specific network. I restart the Firewall service and look at that. Access to the FTP service is now limited to that specific network. Similar Firewall security measures are possible using TCP Wrappers. Vsftp is a TCP service and thus can be controlled by TCP Wrappers configuration files, specifically etc slash hosts dot allow, and etc slash hosts dot deny. I've discussed the configuration of these files in another video. Just remember to cite the daemon, as configured in the user slash sbin directory. In this case, it's vsftpd, and the equivalent command to the Firewall command discussed earlier is to limit access as shown here. Finally, security includes settings associated with SELinux. Let's review the options associated with FTP. The SELinux Management tool is easiest to see and configure from the GUI. The settings associated with FTP apply to the FTP server. The first option here, active by default, allows vsftpd to be run as a regular service without benefit of the x inetd daemon. In other words, you could control sftpd via service script in the etc slash inetd directory. The second option helps limit uploads, even if they're enabled in the vsftpd configuration file. Uploads are only allowed to those directories with the noted label. To configure that label on a directory, such as var slash ftp slash pub, you want to add the label shown here to that directory, and the t at the end indicates that it's a type label and with a chcon command, you can add that to the directory of your choice. This particular command adds it to var slash ftp slash pub. The next two directives allow FTP servers access to directories that are mounted from remote systems, in this case, from a remote Samba or combinator net file system, in this case, from a remotely mounted network file system share. The next to last directive is almost self-explanatory, and goes with allowing users access to their home directories via FTP. The final directive disables SELinux protection for the vsftp service and should be a last resort. If you're exam requires SELinux, this option means you won't get full credit for your work, if you end up having to enable it.
Tutorial Information
| Course: | Red Hat Certified Engineer |
| Author: | Michael Jang |
| SKU: | 33845 |
| ISBN: | 1-934743-47-X |
| Release Date: | 2008-01-18 |
| Duration: | 6.5 hrs / 94 lessons |
| Captions: | No |
| Compatibility: |
Vista/XP/2000, OS X, Linux QuickTime 7, Flash 8 |
VTC Sign up & Benefits
- Unlimited Access
- 81,350 Video Tutorials (14,200 free)
- Video Available as Flash or QuickTime
- Over 715 Courses
- $30 for One Month Access
- Multi-User Discounts Available
