地 址：北京市通州区66号
电 话：18076342571
网址：dsesh.com
邮 箱：45509066@qq.com
sudo apt install vsftpd，配置2. 创建FTP共享路(lu)径：mkdir /ftp，配置3. 修改配置文件(jian)：nano /etc/vsftpd.conf,配置添加以下内容：listen=YES、listen_ipv6=NO、配置anonymous_enable=NO、配置write_enable=YES。配置Chroot,即Change Root,是一种Linux系统(tong)下的技术，通(tong)过Chroot,配置我们可以将一个进程的根目录更改为一个新的目录，从而使得(de)该进程(cheng)认为(wei)自己仍然在原来的配置根目录下(xia)运行，但实际(ji)上(shang)已(yi)经(jing)切换到了新(xin)的配置目录，这种技术可以(yi)用(yong)于实现安全(quan)的配置系统(tong)隔离、限制进程访问外部文件系统等目的配置。
1、安装必要的软件包：
sudo apt-get updatesudo apt-get install open=""ssh-serversudo apt-get install open="open"ssh-client
2、创建一个新的用户和组：
sudo groupadd ssh_userssudo useradd -m -g ssh_users -s /usr/sbin/nologin ssh_user
3、修改SSH配置文件，启用X11转发(fa)和密钥认证：
sudo nano /etc/ssh/sshd_config
将以下内容添加或修改到配置文件(jian)中：
X11Forwarding yesPasswordAuthentication yesPubkeyAuthentication yesAuthorizedKeysFile .ssh/authorized_keys保存(cun)并退出。
4、为新用户设置密码并生成SSH密钥对：
sudo passwd ssh_userssh-keygen -t rsa -b 4096 -f ~/.ssh/id_rsa -N ""5、将用户的公钥添加到SSH服务(wu)器：
cat ~/.ssh/id_rsa.pub >> ~/.ssh/authorized_keyschmod 600 ~/.ssh/authorized_keyschown -R ssh_user:ssh_users ~/.ssh/6、重(zhong)启SSH服务：
sudo systemctl restart ssh
7、在Debian 10中创建一个新的目录作为Chroot环境的根目录：
sudo mkdir /var/chroot_env8、将用户的(de)家(jia)目录挂载到新创建的目录上，并设置相应的权限(xian)：
sudo mount --bind ~/home/ssh_user /var/chroot_env/home/ssh_usersudo chown ssh_user:ssh_users /var/chroot_env/home/ssh_user -Rsudo chmod 700 /var/chroot_env/home/ssh_user -R
9、在Debian 10中创建一个新的systemd服务文件，用于管理Chroot环境：
sudo nano /etc/systemd/system/chroot.service
将以下(xia)内(nei)容(rong)添加到服务文件中：
[Unit]Description=Chroot environment for SSH user ssh_user and their home directory /var/chroot_env/home/ssh_userAfter=network.target syslog.target sshd.service dbus.service udev.service netdev.target remote-fs.target rsyslog.service timesyncd.service timezonedata.service systemd-tmpfiles-setup.service systemd-sysusers.device systemd-networkd-wait-online.service systemd-resolved.service systemd-logind.socket systemd-journald.socket systemd-udevd.socket systemd-randomfile.socket systemd-nscd.socket systemd-cups-restart.socket cups-filter.socket cups-stateless-udev.socket dbus-daemon.socket dbus-session.socket dbus-x11-user.socket libvirtd.socket libvirtd-systemd.socket systemd-libvirtd-systemd.socket libvirtd-vcpuacct.socket libvirtd-guestagent.socket libvirtd-storagebus.socket libvirtd-lxcbrctlhelper.socket libvirtd-lxcdumperhelper.socket libvirtd-lxcproxyhelper.socket libvirtd-lxcviewerhelper.socket libvirtd-libvirtd-systemd.socket libvirtd-qemuguestagent.socket libvirtd-spicehelper.socket libvirtd-spiceportalhelper.socket systemd-networkmanager-wait-online.service systemd-resolve@20-25 networkManagerWaitOnline=true waitfor=network.target dbus.service udev.service timesyncd.service timezonedata.service systemd-tmpfiles-setup.service systemd-sysusers.device systemd-networkd-wait-online.service systemd-resolved.service systemd-logind.socket systemd-journald.socket systemd-udevd.socket systemd-randomfile.socket systemd-nscd.socket systemd-cups-restart.socket cups-filter.socket cups-stateless-udev.socket dbus-daemon.socket dbus-session.socket dbus-x11-user.socket libvirtd.socket libvirtd-systemd.socket systemd-libvirtd-systemd.socket libvirtd-vcpuacct.socket libvirtd-guestagent.socket libvirtd-storagebus.socket libvirtd-lxcbrctlhelper.socket libvirtd-lxcdumperhelper.socket libvirtd-lxcproxyhelper.socket libvirtd-lxcviewerhelper.socket libvirtd-libvirtd-systemd.socket libvirtd-qemuguestagent.socket libvirtd-spicehelper.socket libvirtd-spiceportalhelper.socket systemd-networkmanager@20 service=networkManager waitfor=networkManager service=defaults waitfor=networkManager service=firewallD waitfor=networkManager service=ufw waitfor=systemd-timesyncd service=timesync waitfor=timesync service=systemd-tmpfiles service=syslog service=rsyslog service=sysstat service=kerneloopiei service=cronie service=anacron service=rtkit service=htop service=gnomepowertop service=gnomecalendario service=mateweather service=nautilus service=gnometodo service=gnomemaps service=gnometerminal service=gnomecontrolcenter service=gnomesoftware service=gnomeshell extension=$HOME/gnomeshell extension=$HOME/gnomeshell extension=$HOME/gnomeshell extension=$HOME/gnomeshell extension=$HOME/gnomeshell extension=$HOME/gnomeshell extension=$HOME/gnomeshell extension=$HOME/gnomeshell extension=$HOME/gnomeshell extension=$HOME/gnomeshell extension=$HOME/gnomeshell extension=$HOME/gnomeshell extension=$HOME/gnomeshell extension=$HOME/gnomeshell extension=$HOME/gnomeshell extension=$HOME/gnomeshell extension=$HOME/gnomeshell extension=$HOME/gnomeshell extension=$HOME/gnomeshell extension=$HOME/gnomeshell extension=$HOME/gnomeshell extension=$HOME/gnomeshell extension=$HOME/gnomeshell extension=$HOME/gnomeshell extension=$HOME/gnomeshell extension=$HOME/gnomeshell extension=$HOME/gnomeshell extension=$HOME/gnomeshell extension=$HOME/gnomeshell extension=$HOME/gnomeshell extension=$HOMEextension=$HOMEextension=$HOMEextension=$EXTENSIONcommand="/usr/bin/chroot --userspec=ssh_user:ssh_users --directory=%h %i" execReload=yes restart=on-failure status=restarted delaySec=5 startLimitIntervalSec=5 startLimitBurst=3 type=simple unit=chroot stateful user=%i group=%i environment="PATH=%PATH%,LANG=%LANG%",NOEXECPROMPT HOME=%~ envFile="/etc/environment" timeoutStartSec=90 timeoutStopSec=60 restartSec=5 startLimitIntervalSec ofServiceType="simple" enabledCountMax="3" enabledCountMin="1" enabledCountIncrement="1" disabled="disabled"CountMax="3" disabledCountMin="1" disabled="disabled"CountIncrement="1">ExecStart=<ExecStart>%i</ExecStart>Restart=always</Service>```
