Show Table of Contents
21.2.2.6.9. Security Options
The following lists directives that can be used to improve
vsftpd security.
isolate_network— If enabled,vsftpduses theCLONE_NEWNETcontainer flag to isolate the unprivileged protocol handler processes, so that they cannot arbitrarily callconnect()and instead have to ask the privileged process for sockets (theport_promiscuousoption must be disabled).The default value isYES.isolate— If enabled,vsftpduses theCLONE_NEWPIDandCLONE_NEWIPCcontainer flags to isolate processes to their IPC and PID namespaces to prevent them from interacting with each other.The default value isYES.ssl_enable— Enablesvsftpd's support forSSL(includingTLS). SSL is used both for authentication and subsequent data transfers. Note that all otherSSL-related options are only applicable ifssl_enableis set toYES.The default value isNO.allow_anon_ssl— Specifies whether anonymous users should be allowed to use securedSSLconnections.The default value isNO.require_cert— If enabled, allSSLclient connections are required to present a client certificate.The default value isNO.
Where did the comment section go?
Red Hat's documentation publication system recently went through an upgrade to enable speedier, more mobile-friendly content. We decided to re-evaluate our commenting platform to ensure that it meets your expectations and serves as an optimal feedback mechanism. During this redesign, we invite your input on providing feedback on Red Hat documentation via the discussion platform.