Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

How do you whitelist IPs for the service to allow only certain subnets on? Do I use IPTables or is there an easier way like IPWrappers Do you have to register the service for it to work with IPWrappers(hosts.allow)

share|improve this question

2 Answers 2

up vote 1 down vote accepted

If your vsftpd has been compiled with tcp_wrappers support then you can use it if you turn on the vsftpd configurstion option

tcp_wrappers=yes

If enabled, and vsftpd was compiled with tcp_wrappers support, incoming connections will be fed through tcp_wrappers access control. Furthermore, there is a mechanism for per-IP based configuration. If tcp_wrappers sets the VSFTPD_LOAD_CONF environment variable, then the vsftpd session will try and load the vsftpd configuration file specified in this variable.

You can then use the standard hosts.allow and hosts.deny files.

You can check to see if your vsftpd has been compiled with libwrap support like so

ldd /usr/sbin/vsftpd | grep wrap
libwrap.so.0 => /lib64/libwrap.so.0 (0x00002ae164bb6000)
share|improve this answer

The easiest way would be to use iptables:

iptables -A INPUT -s 1.2.3.0/24 -p tcp --dport 21 -j ACCEPT
iptables -A INPUT -s 4.5.6.0/24 -p tcp --dport 21 -j ACCEPT
iptables -A INPUT -p tcp --dport 21 -j DROP

to allow from 1.2.3.0/24 and 4.5.6.0/24 and dissallow from everyone else.

Don't forget to save iptables configuration (depends on your linux distro), so it will survive reboot.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.