vsftpd基于pam_mysql的虚拟用户认证
VSFTPD： very secure ftp非常安全的FTP服务器软件，因为FTP是非常古老的软件，而且还是基于明文传输的，没有任何加密技术，所以就产生了vsftpd.
基于tcp链接的，监听在21端口上。
程序配置文件：
/etc/vsftpd/vsftpd.conf
1
2
3
4
5
# service vsftpd start
Starting vsftpd for vsftpd:
# netstat -ntlp
Active Internet connections (only servers)
tcp 0 0 0.0.0.0:21 0.0.0.0:* LISTEN 42268/vsftpd
ftp的用户有三种：
1、匿名用户：映射至某个固定的系统用户： ftp vsftp
2、本地用户：也就是系统用户，root，daemon
3、虚拟用户：基于某种认证方式登录的匿名用户，认证方式有：nsswtich(名称服务转换)、pam(插入式认证模块)
实验：通过pam_mysql来连接mysql，获取mysql上的用户账号密码，登录ftp
1、安装pam_mysql驱动
1
2
3
4
5
6
7
8
# yum -y install pam-devel mysql-devel
# tar -xf pam_mysql-0.7RC1.tar.gz
# cdpam_mysql-0.7RC1
# ./configure --with-mysql=/usr --with-pam=/usr
# make && make install
# cd /lib/security/
# ls
pam_mysql.lapam_mysql.so //生成pam连接mysql驱动
2、授权账号，创建用户表，让pam读取表里的账号密码
1
2
3
4
5
6
7
8
9
10
11
12
13
14
mysql> grant all on pam.* to 'pamuser'@localhost identified by "123456";
Query OK, 0 rows affected (0.03 sec)
mysql> create table pamuser(id intnot null primary key, name char(30) not null, password char(48) binarynot null);
Query OK, 0 rows affected (0.01 sec
mysql> desc pamuser
-> ;
+----------+----------+------+-----+---------+-------+
| Field | Type | Null | Key | Default | Extra |
+----------+----------+------+-----+---------+-------+
| id | int(11)| NO | PRI | NULL | |
| name | char(30) | NO | | NULL | |
| password | char(48) | NO | | NULL | |
+----------+----------+------+-----+---------+-------+
3 rows in set (0.00 sec)
3、给表中插入数据，包括账号密码
1
2
3
4
5
6
7
8
9
10
11
12
mysql> insert into pamuser(id,name,password) values (1,'tom',password("magedu"));
Query OK, 1 row affected (0.00 sec)
mysql> insert into pamuser(id,name,password) values (2,'jerry',password("jerry"));
Query OK, 1 row affected (0.00 sec)
mysql> select * from pamuser;
+----+-------+-------------------------------------------+
| id | name| password |
+----+-------+-------------------------------------------+
|2 | jerry | *09FB9E6E2AA0750E9D8A8D22B6AA8D86C85BF3D0 |
|1 | tom | *6B8CCC83799A26CD19D7AD9AEEADBCD30D8A8664 |
+----+-------+-------------------------------------------+
2 rows in set (0.00 sec)
4、创建映射用户
1
2
3
# useradd -s /nologin -d /ftproot vuser
# id vuser
uid=501(vuser) gid=501(vuser) groups=501(vuser)
5、编辑配置文件，指明虚拟用户访问时对应的映射用户
1
2
3
# vim /etc/vsftpd/vsftpd.conf
guest_enable=YES
guest_username=vuser //添加这两个语句
6、编写虚拟用户认证的文件
1
2
3
# vim /etc/pam.d/vsftpd.conf
auth required /lib/security/pam_mysql.so user=pamuser passwd=123456 host=localhost db=pam table=pamuser usercolumn=name passwdcolumn=password crypt=2
account required /lib/security/pam_mysql.so user=pamuser passwd=123456 host=localhost db=pam table=pamuser usercolumn=name passwdcolumn=password crypt=2
7、修改vsftpd的配置文件
1
2
3
4
5
# vim /etc/vsftpd/vsftpd.conf
pam_service_name=vsftpd.conf //把vsftpd修改为vsftpd.conf
anon_upload_enable=YES //允许匿名用户上传
anon_mkdir_write_enable=YES //允许匿名用户创建文件
anon_other_write_enable=YES //允许匿名用户删除及重命名操作
8、重启vsftpd服务，验证虚拟用户能否登录ftp
1
2
3
4
5
6
7
8
9
10
11
12
13
# ftp 172.18.250.76
Connected to 172.18.250.76 (172.18.250.76).
220 (vsFTPd 2.2.2)
Name (172.18.250.76:root): tom
331 Please specify the password.
Password:
230 Login successful. //ok，能登录
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls
227 Entering Passive Mode (172,18,250,76,115,157).
150 Here comes the directory listing.
226 Transfer done (but failed to open directory). //这不能显示vuser的家目录，只要修改权限就行
修改vuser的家目录的权限，并修改家目录下的子目录，让匿名用户能在此目录下创建上传
1
2
# chmod go+rx ftproot/
# chown vuser upload/
再次测试登录。。
1
2
3
4
5
ftp> ls
227 Entering Passive Mode (172,18,250,76,69,54).
150 Here comes the directory listing.
drwxr-xr-x 2 501 0 4096 Apr 18 05:32 upload
226 Directory send OK.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
ftp> cd upload
250 Directory successfully changed.
ftp> mkdir tom.txt //能创建
257 "/upload/tom.txt" created
ftp> lcd /etc //切换到Linux主机上的etc目录
Local directory now /etc
ftp> put fstab //能上传
local: fstab remote: fstab
227 Entering Passive Mode (172,18,250,76,222,184).
150 Ok to send data.
226 Transfer complete.
805 bytes sent in 0.00111 secs (726.53 Kbytes/sec)
# ftp 172.18.250.76
Connected to 172.18.250.76 (172.18.250.76).
220 (vsFTPd 2.2.2)
Name (172.18.250.76:root): jerry //jerry登录也没问题
331 Please specify the password.
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls
227 Entering Passive Mode (172,18,250,76,234,145).
150 Here comes the directory listing.
drwxr-xr-x 3 501 0 4096 Apr 18 08:53 upload
226 Directory send OK.
如果希望tom能有上传功能，jerry没有，怎么办
思路： 禁止所有匿名用户上传功能，只单独开放tom能上传
1
2
3
4
5
6
7
8
# vim /etc/vsftpd/vsftpd.conf
#anon_upload_enable=YES
user_config_dir=/etc/vsftpd/vsftpd.conf.d/ //让服务去读取这里定义的权限
# cd /etc/vsftpd/
# mkdir vsftpd.conf.d
# cd vsftpd.conf.d/
# vim tom
anon_upload_enable=YES
在测试下。。。。
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
# ftp 172.18.250.76
Connected to 172.18.250.76 (172.18.250.76).
220 (vsFTPd 2.2.2)
Name (172.18.250.76:root): tom
331 Please specify the password.
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> cd upload
250 Directory successfully changed.
ftp> ls
227 Entering Passive Mode (172,18,250,76,233,150).
150 Here comes the directory listing.
-rw------- 1 501 501 805 Apr 18 08:53 fstab
drwx------ 2 501 501 4096 Apr 18 08:53 tom.txt
226 Directory send OK.
ftp> lcd /etc
Local directory now /etc
ftp> put issue //tom上传文件
local: issue remote: issue
227 Entering Passive Mode (172,18,250,76,158,39).
150 Ok to send data.
226 Transfer complete.
47 bytes sent in 0.000309 secs (152.10 Kbytes/sec) //上传文件OK
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
# ftp 172.18.250.76
Connected to 172.18.250.76 (172.18.250.76).
220 (vsFTPd 2.2.2)
Name (172.18.250.76:root): jerry
331 Please specify the password.
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> cd upload
250 Directory successfully changed.
ftp> lcd /etc
Local directory now /etc
ftp> put issue //jerry上传文件
local: issue remote: issue
227 Entering Passive Mode (172,18,250,76,24,97).
550 Permission denied. //上传文件失败，被拒绝
除了定义上传之外，还可以定义创建，删除，重命名等权限，方法和上面上传的方法一样。
页:
[1]