[root@haproxy2 ~]# ls /etc/vsftpd/

ftpusers  user_list  vsftpd.conf  vsftpd_conf_migrate.sh

[root@haproxy2 ~]# head -1 /etc/vsftpd/ftpusers   #黑名单：拒绝用户清单

# Users that are not allowed to login via ftp

[root@haproxy2 ~]# head -6 /etc/vsftpd/user_list   #白名单：允许用户清单，添加的新用户需要追加到此文件中

# vsftpd userlist

# If userlist_deny=NO, only allow users in this file

# If userlist_deny=YES (default), never allow users in this file, and

# do not even prompt for a password.
# Note that the default vsftpd pam config also checks /etc/vsftpd/ftpusers
# for users that are denied.

[root@haproxy2 ~]# echo myftp >> /etc/vsftpd/user_list 

[root@haproxy2 ~]# grep userlist /etc/vsftpd/vsftpd.conf

userlist_enable=YES

[root@haproxy2 ~]# echo userlist_deny=NO >> /etc/vsftpd/vsftpd.conf

[root@haproxy2 ~]# grep -n userlist /etc/vsftpd/vsftpd.conf

126:userlist_enable=YES

127:userlist_deny=NO

[root@haproxy2 ~]# useradd -m myftp -d /home/myftp -s /sbin/nologin

[root@haproxy2 ~]# echo myftp | passwd myftp --stdin

Changing password for user myftp.

passwd: all authentication tokens updated successfully.

[root@haproxy2 ~]# chmod -R 755 /home/myftp #权限很关键，nologin默认700的权限，ftp登陆后会无法上传文件

[root@haproxy2 ~]# vi /etc/vsftpd/vsftpd.conf   #修改ftp目录

128:anon_root=/home/myftp 
129:local_root=/home/myftp

[root@haproxy2 ~]# grep -nE 'local_root |anon_root|chroot_' /etc/vsftpd/vsftpd.conf  #以下视需要而选择是否配置
95:# directory. If chroot_local_user is YES, then this list becomes a list of 
100:#chroot_local_user=YES 
101:#chroot_list_enable=YES 
103:#chroot_list_file=/etc/vsftpd/chroot_list  
[root@haproxy2 ~]# grep -nE 'local_root|anon_root|chroot_' /etc/vsftpd/vsftpd.conf #设置local_root切换默认目录，要切换目录必须开放chroot_list 
95:# directory. If chroot_local_user is YES, then this list becomes a list of 
100:chroot_local_user=YES 
101:chroot_list_enable=YES 
103:chroot_list_file=/etc/vsftpd/chroot_list

[root@haproxy2 ~]# echo myftp >> /etc/vsftpd/chroot_list

[root@haproxy2 ~]# cat /etc/pam.d/vsftpd

#%PAM-1.0

session optional pam_keyinit.so force revoke

auth required pam_listfile.so item=user sense=deny file=/etc/vsftpd/ftpusers onerr=succeed

auth required pam_shells.so

auth include password-auth

account include password-auth

session required pam_loginuid.so

session include password-auth

[root@haproxy2 ~]# sed -i 's/pam_shells/pam_nologin/' /etc/pam.d/vsftpd

[root@haproxy2 ~]# systemctl restart vsftpd

ftp> pwd  #ftp的主目录

257 "/"

ftp> !pwd  #登陆ftp前所在的本地目录

/root

ftp>