vsftpd服务及实现ftps
一.vsftpd服务1.测试环境
物理主机: win8
虚拟主机: rhel 5.8 网络模式: 桥接 安装方式采用本地配置的yum源安装vsftpd 关闭selinux 2.安装vsftpd
yum -y install vsftpd3.启动vsftpd服务 service vsftpd start4.将vsftpd服务加入服务列表 chkconfig --add vsftpd5.开机自动启动 chkconfig --level 345 vsftpd on6.vsftpd服务共享目录 /var/ftp/pub7.确保防火墙已经关闭 service iptables stop8.在window上访问共享目录（命令行里） ftp 192.168.x.x 输入用户名 anonymous 密码为空 访问的目录是/var/ftp9.用系统用户登录访问的是系统用户的家目录10.让anonymous用户能上传文件到ftp服务器 a.在/var/ftp目录下创建upload目录 #mkdir upload b.让ftp用户对于upload目录有读写执行权限 #setfacl -m u:ftp:rwx /var/ftp/upload c.修改/var/vsftpd/vsftpd.conf文件 anon_upload_enable=YES //打开这一项 d.是否能够创建目录 anon_mkdir_write_enable=YES e.是否能够删除目录 anon_other_write_enable=YES f.开启传输日志功能 xferlog_file=/var/log/vsftpd.log11.将系统用户禁锢在自己的家目录 a.开启这两项 chroot_list_enable=YES chroot_list_file=/etc/vsftpd/chroot_list
b.创建一个文件，用来存放禁锢家目录的用户 touch /etc/vsftpd/chroot_list 内容为: hadoop c.使用如下选项将会禁锢所有的用户家目录 chroot_local_user = YES12.实现ftps功能 a.自建CA
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
# mkdir certs newcerts crl
# ls -a
...certscrlnewcertsprivate
# touch index.txt
# echo 01 > serial
# (umask 077;openssl genrsa -out private/cakey.pem 2048; )
Generating RSA private key, 2048 bit long modulus
................................+++
............................................................................................................................................+++
e is 65537 (0x10001)
# openssl req -new -x509 -key private/cakey.pem -out cacert.pem -days 3650
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) :CN
State or Province Name (full name) :HB
Locality Name (eg, city) :WUHAN
Organization Name (eg, company) :COLLEGE
Organizational Unit Name (eg, section) []:Tech
Common Name (eg, your name or your server's hostname) []:ca.luochen.com
Email Address []:
# mkdir /etc/vsftpd/ssl
# cd /etc/vsftpd/ssl/
# ls -a
...
# (umask 077;openssl genrsa -out vsftpd.key 2048; )
Generating RSA private key, 2048 bit long modulus
..+++
......................................................................+++
e is 65537 (0x10001)
# openssl req -new -key vsftpd.key -out vsftpd.csr
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) :CN
State or Province Name (full name) :HB
Locality Name (eg, city) :WUHAN
Organization Name (eg, company) :COLLEGE
Organizational Unit Name (eg, section) []:Tech
Common Name (eg, your name or your server's hostname) []:ftp.luochen.com
Email Address []:
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
# openssl req -new -key vsftpd.key -out vsftpd.csr
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) :CN
State or Province Name (full name) :HB
Locality Name (eg, city) :WUHAN
Organization Name (eg, company) :COLLEGE
Organizational Unit Name (eg, section) []:Tech
Common Name (eg, your name or your server's hostname) []:ftp.luochen.com
Email Address []:
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
# vim /etc/pki/tls/openssl.cnf
dir = /etc/pki/CA # Where everything is kept
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
# openssl ca -in vsftpd.csr -out vsftpd.crt
Using configuration from /etc/pki/tls/openssl.cnf
Check that the request matches the signature
Signature ok
Certificate Details:
Serial Number: 1 (0x1)
Validity
Not Before: Sep 11 13:30:06 2015 GMT
Not After : Sep 10 13:30:06 2016 GMT
Subject:
countryName = CN
stateOrProvinceName = HB
organizationName = COLLEGE
organizationalUnitName = Tech
commonName = ftp.luochen.com
X509v3 extensions:
X509v3 Basic Constraints:
CA:FALSE
Netscape Comment:
OpenSSL Generated Certificate
X509v3 Subject Key Identifier:
C8:10:B2:72:C2:30:B7:A9:DC:90:02:ED:F8:B3:50:C9:DF:A5:E5:CB
X509v3 Authority Key Identifier:
keyid:49:69:11:6D:A0:A4:F5:25:3F:E8:A0:67:FC:B1:6C:27:31:40:A2:FD
Certificate is to be certified until Sep 10 13:30:06 2016 GMT (365 days)
Sign the certificate? :y
1 out of 1 certificate requests certified, commit? y
Write out database with 1 new entries
Data Base Updated
#
b.为ftp服务添加ssl功能，修改/etc/vsftpd/vsftpd.conf文件
#ssl service
ssl_enable=YES
ssl_sslv3=YES
ssl_tlsv1=YES
allow_anon_ssl=NO
force_local_data_ssl=YES
force_local_logins_ssl=YES
rsa_cert_file=/etc/vsftpd/ssl/vsftpd.crt
rsa_private_key_file=/etc/vsftpd/ssl/vsftpd.key
c.用ftp客户端工具连接ftp服务器（FlashFXP）
13.建立虚拟用户
一、安装所需要程序
1、事先安装好开发环境和mysql数据库;
# yum -y install mysql-server mysql-devel
# yum -y groupinstall "Development Tools" "Development Libraries"
2.安装pam_mysql-0.7RC1
# tar zxvfpam_mysql-0.7RC1.tar.gz
# cdpam_mysql-0.7RC1
# ./configure --with-mysql=/usr --with-openssl
# make
# make install
二、创建虚拟用户账号
1.准备数据库及相关表
首先请确保mysql服务已经正常启动。而后，按需要建立存储虚拟用户的数据库即可，这里将其创建为vsftpd数据库。
mysql> create database vsftpd;
mysql> grant select on vsftpd.* to vsftpd@localhost identified by 'www.luochen.com';
mysql> grant select on vsftpd.* to vsftpd@127.0.0.1 identified by 'www.luochen.com';
mysql> flush privileges;
mysql> use vsftpd;
mysql> create table users (
-> id int AUTO_INCREMENT NOT NULL,
-> name char(20) binary NOT NULL,
-> password char(48) binary NOT NULL,
-> primary key(id)
-> );
2、添加测试的虚拟用户
根据需要添加所需要的用户，需要说明的是，这里将其密码采用明文格式存储，原因是pam_mysql的password()函数与MySQL的password()函数可能会有所不同。
mysql> insert into users(name,password) values('tom','luochen');
mysql> insert into users(name,password) values('jerry','luochen');
三、配置vsftpd
1.建立pam认证所需文件
#vi /etc/pam.d/vsftpd.mysql
添加如下两行
auth required /usr/lib/security/pam_mysql.so user=vsftpd passwd=www.luochen.com host=localhost db=vsftpd table=users usercolumn=name passwdcolumn=password crypt=0
account required /usr/lib/security/pam_mysql.so user=vsftpd passwd=www.luochen.com host=localhost db=vsftpd table=users usercolumn=name passwdcolumn=password crypt=0
2.修改vsftpd的配置文件，使其适应mysql认证
建立虚拟用户映射的系统用户及对应的目录
#useradd -s /sbin/nologin -d /var/ftproot vuser
#chmod go+rx /var/ftproot
请确保/etc/vsftpd.conf中已经启用了以下选项
anonymous_enable=YES
local_enable=YES
write_enable=YES
anon_upload_enable=NO
anon_mkdir_write_enable=NO
chroot_local_user=YES
而后添加以下选项
guest_enable=YES
guest_username=vuser
并确保pam_service_name选项的值如下所示
pam_service_name=vsftpd.mysql
四、启动vsftpd服务
# service vsftpd start
# chkconfig vsftpd on
查看端口开启情况
# netstat -tnlp |grep :21
tcp 0 0 0.0.0.0:21 0.0.0.0:* LISTEN 23286/vsftpd
使用虚拟用户登录,验正配置结果，以下为本机的命令方式测试，你也可以在其它Win Box上用IE或者FTP客户端工具登录验正
# ftp localhost
五、配置虚拟用户具有不同的访问权限
vsftpd可以在配置文件目录中为每个用户提供单独的配置文件以定义其ftp服务访问权限，每个虚拟用户的配置文件名同虚拟用户的用户名。配置文件目录可以是任意未使用目录，只需要在vsftpd.conf指定其路径及名称即可。
1、配置vsftpd为虚拟用户使用配置文件目录
# vim vsftpd.conf
添加如下选项
user_config_dir=/etc/vsftpd/vusers_dir
2、创建所需要目录，并为虚拟用户提供配置文件
# mkdir /etc/vsftpd/vusers_dir/
# cd /etc/vsftpd/vusers_dir/
# touch tom jerry
3、配置虚拟用户的访问权限
虚拟用户对vsftpd服务的访问权限是通过匿名用户的相关指令进行的。比如，如果需要让tom用户具有上传文件的权限，可以修改/etc/vsftpd/vusers/tom文件，在里面添加如下选项即可。
anon_upload_enable=YES
页:
[1]