vsftpd+ldap认证
一、环境系统 CentOS 6.4x64最小化安装
IP 192.168.3.19
二、安装ldap
1
2
# yum install openldap openldap-* -y
# yum install nscd nss-pam-ldapd nss-* pcre pcre-* -y
配置ldap
1
2
3
4
5
6
7
8
9
10
11
# cd /etc/openldap/
# cp /usr/share/openldap-servers/slapd.conf.obsolete slapd.conf
# cp slapd.conf slapd.conf_`date +%Y%m%d`.bak
# ll
total 32
drwxr-xr-x. 2 root root 4096 Jul 14 09:48 certs
-rw-r--r--. 1 root root282 Jul 14 09:40 ldap.conf
drwxr-xr-x2 root root 4096 Jul 14 09:48 schema
-rw-r--r--1 root root 4635 Jul 14 09:49 slapd.conf
-rw-r--r--1 root root 4635 Jul 14 09:49 slapd.conf_20150714.bak
drwx------3 ldap ldap 4096 Jul 14 09:48 slapd.d
设置ldap管理员密码
1
2
3
4
5
# slappasswd -s weyee
{SSHA}+lnTFVa2PrStKgqt4SNFk4pl7Vo7QFUr
# slappasswd -s weyee|sed -e "s#{SSHA}#rootpw\t{SSHA}#g" >>/etc/openldap/slapd.conf
# tail -1 /etc/openldap/slapd.conf
rootpw{SSHA}d+rLMyEPKqcBroWW0vvazZ1+DRY2UmsP
修改dc配置
1
2
3
4
5
# vim /etc/openldap/slapd.conf
#以下参数大概在114行
database bdb #使用bdb数据库
suffix "dc=test,dc=org" #定义dc，指定搜索的域
rootdn "cn=admin,dc=test,dc=org" #定义管理员的dn，使用这个dn能登陆openldap
优化ldap配置参数
1
2
3
4
# vim /etc/openldap/slapd.conf
loglevel 296 #定义日志级别
cachesize 1000 #换成条目数
checkpoint 2048 10 #表示内存中达到2048k或者10分钟，执行一次checkpoint，即写入数据文件的操作
配置相关权限
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
# vim /etc/openldap/slapd.conf
#删除默认权限，将下面的内容都删除
database config
access to *
by dn.exact="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" manage
by * none
# enable server status monitoring (cn=monitor)
database monitor
access to *
by dn.exact="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" read
by dn.exact="cn=Manager,dc=my-domain,dc=com" read
by * none
#添加新的权限(这是2.3的权限设置方式)
access to *
by self write
by anonymous auth
by * read
配置syslog记录ldap的服务日志
1
2
3
4
5
6
7
8
9
10
# cp /etc/rsyslog.conf /etc/rsyslog.conf_`date +%Y%m%d`.bak
#往配置文件中增加如下内容
# tail -1 /etc/rsyslog.conf
local4.* /var/log/ldap.log
#重启rsyslog服务
# /etc/init.d/rsyslog restart
Shutting down system logger:
Starting system logger:
配置ldap数据库路径
1
2
3
4
5
6
7
8
9
10
11
12
13
#创建数据文件
# cp /usr/share/openldap-servers/DB_CONFIG.example /var/lib/ldap/DB_CONFIG
# chown ldap.ldap /var/lib/ldap/DB_CONFIG
# chmod 700 /var/lib/ldap/
# ll /var/lib/ldap/
total 4
-rw-r--r-- 1 ldap ldap 845 Jul 14 09:58 DB_CONFIG
# egrep -v "\#|^$" /var/lib/ldap/DB_CONFIG
set_cachesize 0 268435456 1
set_lg_regionmax 262144
set_lg_bsize 2097152
# slaptest -u #检查配置文件是否正常
config file testing succeeded
启动ldap服务
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
# /etc/init.d/slapd start
Starting slapd:
# ps aux |grep ldap
ldap 17000.01.6 490532 16592 ? Ssl10:00 0:00 /usr/sbin/slapd -hldap:/// ldapi:/// -u ldap
root 17060.00.0 103240 868 pts/0 S+ 10:00 0:00 grep ldap
# netstat -tunlp |grep slapd
tcp 0 0 0.0.0.0:389 0.0.0.0:* LISTEN 1700/slapd
tcp 0 0 :::389 :::* LISTEN 1700/slapd
#添加到开机自启动
# chkconfigslapd on
#查看日志文件
# tail /var/log/ldap.log
Jul 14 10:00:11 test slapd: @(#) $OpenLDAP: slapd 2.4.39 (Oct 15 2014 09:51:43) $#012#011mockbuild@c6b8.bsys.dev.centos.org:/builddir/build/BUILD/openldap-2.4.39/openldap-2.4.39/build-servers/servers/slapd
查询一下ldap的内容
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
# ldapsearch -LLL -W -x -H ldap://test.org -D "cn=admin,dc=test,dc=org" -b "dc=test,dc=org" "(udi=*)"
Enter LDAP Password:
ldap_bind: Invalid credentials (49) #这里报错
#解决如下，删除默认2.4的配置文件，重新生成2.3的配置文件
# rm -rf /etc/openldap/slapd.d/*
# slaptest -f /etc/openldap/slapd.conf -F /etc/openldap/slapd.d/
55a46df9 bdb_monitor_db_open: monitoring disabled; configure monitor database to enable
config file testing succeeded
# ll /etc/openldap/slapd.d/
total 8
drwxr-x--- 3 root root 4096 Jul 14 10:03 cn=config
-rw------- 1 root root 1302 Jul 14 10:03 cn=config.ldif
#修改权限
# chown -R ldap.ldap /etc/openldap/slapd.d/
#重启服务
# /etc/init.d/slapd restart
Stopping slapd:
Starting slapd:
#再次查询ldap内容
# ldapsearch -LLL -W -x -H ldap://test.org -D "cn=admin,dc=test,dc=org" -b "dc=test,dc=org" "(udi=*)"
Enter LDAP Password: #密码是上文中的weyee
No such object (32) #ldap中还没有任何数据
创建一个系统用户user1，设置密码user1
1
2
3
4
5
6
7
8
# useradd user1
# passwd user1
Changing password for user user1.
New password:
BAD PASSWORD: it is too short
BAD PASSWORD: is too simple
Retype new password:
passwd: all authentication tokens updated successfully.
安装migrationtools
1
# yum install migrationtools -y
编辑migrationtool的配置文件/usr/share/migrationtools/migrate_common.ph
1
2
3
4
5
6
# vim /usr/share/migrationtools/migrate_common.ph
# Default DNS domain
$DEFAULT_MAIL_DOMAIN = "test.org";
# Default base
$DEFAULT_BASE = "dc=test,dc=org";
下面利用pl脚本将/etc/passwd 和/etc/shadow生成LDAP能读懂的文件格式，保存在/tmp/下
1
2
3
# /usr/share/migrationtools/migrate_base.pl >/tmp/base.ldif
# /usr/share/migrationtools/migrate_passwd.pl /etc/passwd >/tmp/passwd.ldif
# /usr/share/migrationtools/migrate_passwd.pl /etc/group >/tmp/group.ldif
下面就要把这三个文件导入到LDAP，这样LDAP的数据库里就有了我们想要的用户
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
#导入base
# ldapadd -x -D "cn=admin,dc=test,dc=org" -W -f /tmp/base.ldif
Enter LDAP Password:
adding new entry "dc=test,dc=org"
adding new entry "ou=Hosts,dc=test,dc=org"
adding new entry "ou=Rpc,dc=test,dc=org"
adding new entry "ou=Services,dc=test,dc=org"
adding new entry "nisMapName=netgroup.byuser,dc=test,dc=org"
adding new entry "ou=Mounts,dc=test,dc=org"
adding new entry "ou=Networks,dc=test,dc=org"
adding new entry "ou=People,dc=test,dc=org"
adding new entry "ou=Group,dc=test,dc=org"
adding new entry "ou=Netgroup,dc=test,dc=org"
adding new entry "ou=Protocols,dc=test,dc=org"
adding new entry "ou=Aliases,dc=test,dc=org"
adding new entry "nisMapName=netgroup.byhost,dc=test,dc=org"
#导入passwd
# ldapadd -x -D "cn=admin,dc=test,dc=org" -W -f /tmp/passwd.ldif
Enter LDAP Password:
adding new entry "uid=root,ou=People,dc=test,dc=org"
adding new entry "uid=bin,ou=People,dc=test,dc=org"
adding new entry "uid=daemon,ou=People,dc=test,dc=org"
adding new entry "uid=adm,ou=People,dc=test,dc=org"
adding new entry "uid=lp,ou=People,dc=test,dc=org"
adding new entry "uid=sync,ou=People,dc=test,dc=org"
adding new entry "uid=shutdown,ou=People,dc=test,dc=org"
adding new entry "uid=halt,ou=People,dc=test,dc=org"
adding new entry "uid=mail,ou=People,dc=test,dc=org"
adding new entry "uid=uucp,ou=People,dc=test,dc=org"
adding new entry "uid=operator,ou=People,dc=test,dc=org"
adding new entry "uid=games,ou=People,dc=test,dc=org"
adding new entry "uid=gopher,ou=People,dc=test,dc=org"
adding new entry "uid=ftp,ou=People,dc=test,dc=org"
adding new entry "uid=nobody,ou=People,dc=test,dc=org"
adding new entry "uid=dbus,ou=People,dc=test,dc=org"
adding new entry "uid=vcsa,ou=People,dc=test,dc=org"
adding new entry "uid=abrt,ou=People,dc=test,dc=org"
adding new entry "uid=haldaemon,ou=People,dc=test,dc=org"
adding new entry "uid=ntp,ou=People,dc=test,dc=org"
adding new entry "uid=saslauth,ou=People,dc=test,dc=org"
adding new entry "uid=postfix,ou=People,dc=test,dc=org"
adding new entry "uid=sshd,ou=People,dc=test,dc=org"
adding new entry "uid=tcpdump,ou=People,dc=test,dc=org"
adding new entry "uid=ldap,ou=People,dc=test,dc=org"
adding new entry "uid=nscd,ou=People,dc=test,dc=org"
adding new entry "uid=nslcd,ou=People,dc=test,dc=org"
adding new entry "uid=user1,ou=People,dc=test,dc=org"
#导入group
# ldapadd -x -D "cn=admin,dc=test,dc=org" -W -f /tmp/group.ldif
再次查询ldap的内容
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
# ldapsearch -LLL -w weyee -x -H ldap://test.org -D "cn=admin,dc=test,dc=org" -b "dc=test,dc=org" "(uid=user1)"
dn: uid=user1,ou=People,dc=test,dc=org
uid: user1
cn: user1
objectClass: account
objectClass: posixAccount
objectClass: top
objectClass: shadowAccount
userPassword:: e2NyeXB0fSQxJEovVFNOUFhVJHdmWXhyN3MzdTNVa0NVN0h0WHlHVDA=
shadowLastChange: 16630
shadowMin: 0
shadowMax: 99999
shadowWarning: 7
loginShell: /bin/bash
uidNumber: 500
gidNumber: 500
homeDirectory: /home/user1
安装配置ldap客户端phpladpadmin
1
2
# rpm -ivh http://mirrors.ukfast.co.uk/sites/dl.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-8.noarch.rpm
# yum install phpldapadmin -y
配置Apache's phpLDAPadmin的配置文件
1
2
3
4
5
6
7
8
# vim /etc/httpd/conf.d/phpldapadmin.conf
<Directory /usr/share/phpldapadmin/htdocs>
Order Allow,Deny
Allow from all
Allow from 127.0.0.1
Allow from ::1
Allow from 192.168.3.0
</Directory>
禁用自动登录
1
2
3
# vim /etc/phpldapadmin/config.php
#(line 398)
//$servers->setValue('login','attr','uid');
启动httpd服务
1
2
# service httpd start
Starting httpd:
通过web界面访问ldap地址是http://192.168.3.19/ldapadmin/
三、安装配置vsftp
1
# yum install vsftpd -y
修改pam_ldap配置文件
1
2
3
4
5
6
7
8
9
10
11
12
13
# vim /etc/pam_ldap.conf
host 192.168.3.19
# The distinguished name of the search base.
base dc=test,dc=org
#uri ldap://192.168.3.19
binddn cn=admin,dc=test,dc=org
bindpw weyee
#修改文件/etc/pam.d/vsftpd.vu
# vim /etc/pam.d/vsftpd.vu
auth required pam_ldap.so
account required pam_ldap.so
编辑vsftpd配置文件
1
2
3
4
5
6
7
8
9
# vim /etc/vsftpd/vsftpd.conf
nonymous_enable=NO #不允许匿名用户访问
anon_upload_enable=YES
anon_mkdir_write_enable=YES #开启这项和上一项才能上传文件和文件夹
chroot_local_user=YES
guest_enable=YES #设定启用虚拟用户功能
guest_username=ftp #指定虚拟用户的宿主用户
pam_service_name=vsftpd.vu #设定PAM服务下Vsftpd的验证配置文件名。
local_root=/data
启动vsftpd服务
1
2
3
4
# /etc/init.d/vsftpd start
Starting vsftpd for vsftpd:
# yum install ftp -y
# chown -R ftp.ftp /data/
测试，在ldap中创建用户ldapftp，设置密码ldapftp
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
#查看ldapftp用户
# ldapsearch -LLL -w weyee -x -H ldap://test.org -D "cn=admin,dc=test,dc=org" -b "dc=test,dc=org" "(uid=ldapftp)"
dn: uid=ldapftp,ou=People,dc=test,dc=org
objectClass: posixAccount
objectClass: top
objectClass: inetOrgPerson
gidNumber: 0
givenName: ldapftp
sn: ldapftp
uid: ldapftp
homeDirectory: /home/ldapftp
cn: ldapftp
uidNumber: 5355
userPassword:: e1NIQX1XZnNSS0U1dlVhR0xma0lINlFqU0F2VDJqU1U9
# id ldapftp
id: ldapftp: No such user
#从上面的结果能看出ldapftp用户只有ldap数据库中才有
#测试访问ftp
# ftp 127.0.0.1
Connected to 127.0.0.1 (127.0.0.1).
220 (vsFTPd 2.2.2)
Name (127.0.0.1:root): ldapftp #输入用户ldapftp
331 Please specify the password.
Password:
230 Login successful. #这里显示登陆成功
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls
227 Entering Passive Mode (127,0,0,1,151,90).
150 Here comes the directory listing.
-rw-r--r-- 1 0 0 0 Jul 14 03:05 1.txt
-rw-r--r-- 1 0 0 0 Jul 14 03:05 2.txt
drwx------ 2 14 50 4096 Jul 14 03:07 新文件夹
226 Directory send OK.
我们再次创建一个ldap用户test，密码test
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
# id test
id: test: No such user
# ldapsearch -LLL -w weyee -x -H ldap://test.org -D "cn=admin,dc=test,dc=org" -b "dc=test,dc=org" "(uid=test)"
dn: uid=test,ou=People,dc=test,dc=org
objectClass: posixAccount
objectClass: top
objectClass: inetOrgPerson
gidNumber: 0
givenName: test
sn: test
uid: test
homeDirectory: /home/test
cn: test
uidNumber: 41881
userPassword:: e1NIQX1xVXFQNWN5eG02WWNUQWh6MDVIcGg1Z3Z1OU09
#上面结果表明test用户只存在于ldap中
#用test访问ftp
# ftp 127.0.0.1
Connected to 127.0.0.1 (127.0.0.1).
220 (vsFTPd 2.2.2)
Name (127.0.0.1:root): test
331 Please specify the password.
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls
227 Entering Passive Mode (127,0,0,1,208,151).
150 Here comes the directory listing.
-rw-r--r-- 1 0 0 0 Jul 14 03:05 1.txt
-rw-r--r-- 1 0 0 0 Jul 14 03:05 2.txt
drwx------ 2 14 50 4096 Jul 14 03:07 新文件夹
226 Directory send OK.
到这里vsftpd+ldap的配置已完成
页:
[1]