vsftpd服务及实现ftps

gfdg

一.vsftpd服务
  1.测试环境

   物理主机: win8

   虚拟主机: rhel 5.8

   网络模式: 桥接

   安装方式采用本地配置的yum源安装vsftpd

   关闭selinux

   2.安装vsftpd

   yum -y install vsftpd

  3.启动vsftpd服务

   service vsftpd start

  4.将vsftpd服务加入服务列表

   chkconfig --add vsftpd

  5.开机自动启动

   chkconfig --level 345 vsftpd on

  6.vsftpd服务共享目录

   /var/ftp/pub

  7.确保防火墙已经关闭

   service iptables stop

  8.在window上访问共享目录（命令行里）

   ftp 192.168.x.x

   输入用户名 anonymous

   密码为空

   访问的目录是/var/ftp

  9.用系统用户登录访问的是系统用户的家目录

  10.让anonymous用户能上传文件到ftp服务器

    a.在/var/ftp目录下创建upload目录

      #mkdir upload

    b.让ftp用户对于upload目录有读写执行权限

      #setfacl -m u:ftp:rwx /var/ftp/upload

    c.修改/var/vsftpd/vsftpd.conf文件

     anon_upload_enable=YES   //打开这一项

    d.是否能够创建目录

     anon_mkdir_write_enable=YES

    e.是否能够删除目录

     anon_other_write_enable=YES

    f.开启传输日志功能

     xferlog_file=/var/log/vsftpd.log

  11.将系统用户禁锢在自己的家目录

    a.开启这两项

     chroot_list_enable=YES

     chroot_list_file=/etc/vsftpd/chroot_list

    b.创建一个文件，用来存放禁锢家目录的用户

     touch /etc/vsftpd/chroot_list

     内容为:

       hadoop

    c.使用如下选项将会禁锢所有的用户家目录

     chroot_local_user = YES

  12.实现ftps功能

    a.自建CA

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75

[iyunv@RedHat-5 CA]# mkdir certs newcerts crl [iyunv@RedHat-5 CA]# ls -a .  ..  certs  crl  newcerts  private [iyunv@RedHat-5 CA]# touch index.txt [iyunv@RedHat-5 CA]# echo 01 > serial [iyunv@RedHat-5 CA]# (umask 077;openssl genrsa -out private/cakey.pem 2048; ) Generating RSA private key, 2048 bit long modulus ................................+++ ............................................................................................................................................+++ e is 65537 (0x10001) [iyunv@RedHat-5 CA]# openssl req -new -x509 -key private/cakey.pem -out cacert.pem -days 3650 You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [GB]:CN State or Province Name (full name) [Berkshire]:HB Locality Name (eg, city) [Newbury]:WUHAN Organization Name (eg, company) [My Company Ltd]:COLLEGE Organizational Unit Name (eg, section) []:Tech Common Name (eg, your name or your server's hostname) []:ca.luochen.com Email Address []: [iyunv@RedHat-5 CA]# mkdir /etc/vsftpd/ssl [iyunv@RedHat-5 CA]# cd /etc/vsftpd/ssl/ [iyunv@RedHat-5 ssl]# ls -a .  .. [iyunv@RedHat-5 ssl]# (umask 077;openssl genrsa -out vsftpd.key 2048; ) Generating RSA private key, 2048 bit long modulus ..+++ ......................................................................+++ e is 65537 (0x10001) [iyunv@RedHat-5 ssl]# openssl req -new -key vsftpd.key -out vsftpd.csr You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [GB]:CN       State or Province Name (full name) [Berkshire]:HB Locality Name (eg, city) [Newbury]:WUHAN Organization Name (eg, company) [My Company Ltd]:COLLEGE Organizational Unit Name (eg, section) []:Tech Common Name (eg, your name or your server's hostname) []:ftp.luochen.com Email Address []: Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []: An optional company name []: [iyunv@RedHat-5 ssl]# openssl req -new -key vsftpd.key -out vsftpd.csr You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [GB]:CN State or Province Name (full name) [Berkshire]:HB Locality Name (eg, city) [Newbury]:WUHAN Organization Name (eg, company) [My Company Ltd]:COLLEGE Organizational Unit Name (eg, section) []:Tech Common Name (eg, your name or your server's hostname) []:ftp.luochen.com Email Address []: Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []: An optional company name []: [iyunv@RedHat-5 ssl]# vim /etc/pki/tls/openssl.cnf

    dir = /etc/pki/CA     # Where everything is kept

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33

[iyunv@RedHat-5 ssl]# openssl ca -in vsftpd.csr -out vsftpd.crt Using configuration from /etc/pki/tls/openssl.cnf Check that the request matches the signature Signature ok Certificate Details:         Serial Number: 1 (0x1)         Validity             Not Before: Sep 11 13:30:06 2015 GMT             Not After : Sep 10 13:30:06 2016 GMT         Subject:             countryName               = CN             stateOrProvinceName       = HB             organizationName          = COLLEGE             organizationalUnitName    = Tech             commonName                = ftp.luochen.com         X509v3 extensions:             X509v3 Basic Constraints:                 CA:FALSE             Netscape Comment:                 OpenSSL Generated Certificate             X509v3 Subject Key Identifier:                 C8:10:B2:72:C2:30:B7:A9:DC:90:02:ED:F8:B3:50:C9:DF:A5:E5:CB             X509v3 Authority Key Identifier:                 keyid:49:69:11:6D:A0:A4:F5:25:3F:E8:A0:67:FC:B1:6C:27:31:40:A2:FD Certificate is to be certified until Sep 10 13:30:06 2016 GMT (365 days) Sign the certificate? [y/n]:y 1 out of 1 certificate requests certified, commit? [y/n]y Write out database with 1 new entries Data Base Updated [iyunv@RedHat-5 ssl]#

  b.为ftp服务添加ssl功能，修改/etc/vsftpd/vsftpd.conf文件   
   #ssl service
      ssl_enable=YES
      ssl_sslv3=YES
      ssl_tlsv1=YES
      allow_anon_ssl=NO
      force_local_data_ssl=YES
      force_local_logins_ssl=YES
      rsa_cert_file=/etc/vsftpd/ssl/vsftpd.crt
      rsa_private_key_file=/etc/vsftpd/ssl/vsftpd.key
  c.用ftp客户端工具连接ftp服务器（FlashFXP）
           
  13.建立虚拟用户
   一、安装所需要程序   
     1、事先安装好开发环境和mysql数据库;
        # yum -y install mysql-server mysql-devel

        # yum -y groupinstall "Development Tools" "Development Libraries"
     2.安装pam_mysql-0.7RC1

        # tar zxvf  pam_mysql-0.7RC1.tar.gz

        # cd  pam_mysql-0.7RC1
        # ./configure --with-mysql=/usr --with-openssl
        # make
        # make install
   二、创建虚拟用户账号
     1.准备数据库及相关表

       首先请确保mysql服务已经正常启动。而后，按需要建立存储虚拟用户的数据库即可，这里将其创建为vsftpd数据库。

mysql> create database vsftpd;

mysql> grant select on vsftpd.* to vsftpd@localhost identified by 'www.luochen.com';

mysql> grant select on vsftpd.* to vsftpd@127.0.0.1 identified by 'www.luochen.com';
mysql> flush privileges;

mysql> use vsftpd;
mysql> create table users (
    -> id int AUTO_INCREMENT NOT NULL,
    -> name char(20) binary NOT NULL,
    -> password char(48) binary NOT NULL,
    -> primary key(id)
    -> );

    2、添加测试的虚拟用户
      根据需要添加所需要的用户，需要说明的是，这里将其密码采用明文格式存储，原因是pam_mysql的password()函数与MySQL的password()函数可能会有所不同。

mysql> insert into users(name,password) values('tom','luochen');
mysql> insert into users(name,password) values('jerry','luochen');

  三、配置vsftpd
    1.建立pam认证所需文件
      #vi /etc/pam.d/vsftpd.mysql

    添加如下两行
auth required /usr/lib/security/pam_mysql.so user=vsftpd passwd=www.luochen.com host=localhost db=vsftpd table=users usercolumn=name passwdcolumn=password crypt=0
account required /usr/lib/security/pam_mysql.so user=vsftpd passwd=www.luochen.com host=localhost db=vsftpd table=users usercolumn=name passwdcolumn=password crypt=0
    2.修改vsftpd的配置文件，使其适应mysql认证

      建立虚拟用户映射的系统用户及对应的目录

      #useradd -s /sbin/nologin -d /var/ftproot vuser
      #chmod go+rx /var/ftproot
     请确保/etc/vsftpd.conf中已经启用了以下选项

       anonymous_enable=YES
       local_enable=YES
       write_enable=YES
       anon_upload_enable=NO
       anon_mkdir_write_enable=NO
       chroot_local_user=YES
     而后添加以下选项

       guest_enable=YES
       guest_username=vuser
     并确保pam_service_name选项的值如下所示

       pam_service_name=vsftpd.mysql
   四、启动vsftpd服务
      # service vsftpd start

      # chkconfig vsftpd on
     查看端口开启情况

      # netstat -tnlp |grep :21

tcp    0   0 0.0.0.0:21       0.0.0.0:*         LISTEN     23286/vsftpd

     使用虚拟用户登录,验正配置结果，以下为本机的命令方式测试，你也可以在其它Win Box上用IE或者FTP客户端工具登录验正
     # ftp localhost

   五、配置虚拟用户具有不同的访问权限

     vsftpd可以在配置文件目录中为每个用户提供单独的配置文件以定义其ftp服务访问权限，每个虚拟用户的配置文件名同虚拟用户的用户名。配置文件目录可以是任意未使用目录，只需要在vsftpd.conf指定其路径及名称即可。


     1、配置vsftpd为虚拟用户使用配置文件目录
        # vim vsftpd.conf

      添加如下选项
        user_config_dir=/etc/vsftpd/vusers_dir
      2、创建所需要目录，并为虚拟用户提供配置文件

        # mkdir /etc/vsftpd/vusers_dir/

        # cd /etc/vsftpd/vusers_dir/
        # touch tom jerry
      3、配置虚拟用户的访问权限

        虚拟用户对vsftpd服务的访问权限是通过匿名用户的相关指令进行的。比如，如果需要让tom用户具有上传文件的权限，可以修改/etc/vsftpd/vusers/tom文件，在里面添加如下选项即可。

        anon_upload_enable=YES