1

How do you whitelist IPs for the service to allow only certain subnets on? Do I use IPTables or is there an easier way like IPWrappers Do you have to register the service for it to work with IPWrappers(hosts.allow)

2 Answers 2

3

If your vsftpd has been compiled with tcp_wrappers support then you can use it if you turn on the vsftpd configurstion option

tcp_wrappers=yes

If enabled, and vsftpd was compiled with tcp_wrappers support, incoming connections will be fed through tcp_wrappers access control. Furthermore, there is a mechanism for per-IP based configuration. If tcp_wrappers sets the VSFTPD_LOAD_CONF environment variable, then the vsftpd session will try and load the vsftpd configuration file specified in this variable.

You can then use the standard hosts.allow and hosts.deny files.

You can check to see if your vsftpd has been compiled with libwrap support like so

ldd /usr/sbin/vsftpd | grep wrap
libwrap.so.0 => /lib64/libwrap.so.0 (0x00002ae164bb6000)
2

The easiest way would be to use iptables:

iptables -A INPUT -s 1.2.3.0/24 -p tcp --dport 21 -j ACCEPT
iptables -A INPUT -s 4.5.6.0/24 -p tcp --dport 21 -j ACCEPT
iptables -A INPUT -p tcp --dport 21 -j DROP

to allow from 1.2.3.0/24 and 4.5.6.0/24 and dissallow from everyone else.

Don't forget to save iptables configuration (depends on your linux distro), so it will survive reboot.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .