Set up an FTP server in Linux (2)

Article Title: Setting up an FTP server in Linux (2 ). Linux is a technology channel of the IT lab in China. Includes basic categories such as desktop applications, Linux system management, kernel research, embedded systems, and open source.
Create accounts without shell for FTP site users
First, create a new user that is allowed to connect to the ftp server. Because a "chroot" environment is required, this account is different from a normal user account and cannot be restricted by access. "Chroot" makes the user feel like he is already at the top of the file system.
Step 1
Use the following command to create a user in the "/etc/passwd" file. Repeat this step for each new user who is allowed to access the ftp server.
[Root @ deep] # mkdir/home/ftp
[Root @ deep] # useradd-d/home/ftp/ftpadmin/-s/dev/null ftpadmin>/dev/null 2> & 1
[Root @ deep] # passwd ftpadmin
Changing password for user ftpadmin
New UNIX password:
Retype new UNIX password:
Passwd: all authentication tokens updated successfully
Step 2
Edit the "/etc/shells" file and add an empty shell, for example, null. This fake shell can restrict users' access to the ftp server.
[Root @ deep] # vi/etc/shells
　　
/Bin/bash
/Bin/sh
/Bin/ash
/Bin/bsh
/Bin/tcsh
/Bin/csh
/Dev/null? This is our added no existent shell
Step 3
Edit the "/etc/passwd" file and manually add "/. /"separates the"/home/ftp "directory from the"/ftpadmin "directory. The user" ftpadmin "will be automatically transferred to the (chdir)"/ftpadming "directory. Repeat this step for every added ftp user in the passwd file.
Edit the "passwd" file (vi/etc/passwd) and change the following line:
Ftpadmin: x: 502: 502:/home/ftp/ftpadmin/:/dev/null
Changed:
Ftpadmin: x: 502: 502:/home/ftp/./ftpadmin/:/dev/null
The account is "ftpadmin". The Home Directory of this account is somewhat strange. The first part "/home/ftp/" indicates the root directory when "chroot" is used. The "/ftpadmin" separated by dots indicates that the directory is automatically transferred when you log on to the ftp server. The empty shell "/dev/null" does not allow "ftpadmin" to log on as a normal user. After these changes, the "ftpadmin" user uses a pseudo shell instead of a real shell, which restricts access to the ftp server. Create a "chroot" User Environment
Create a simple root file system that contains enough files, such as binary programs and password files. When a user logs on, Unix can change the root file system (chroot ). Note that if the "-- enable-ls" parameter is added as above during compilation, "/home/ftp/bin" and "/home/ftp/lib" two directories can not, because the WU-FTP will use their own "ls ". But let's introduce the old method, that is, copy "/bin/ls" to the "/home/ftp/bin" Directory ("/bin" after chroot, copy the relevant Runtime Library to the "/home/ftp/lib" directory.
Step 1
Create all the directories required to change the chrooted environment:
[Root @ deep] # mkdir/home/ftp/dev
[Root @ deep] # mkdir/home/ftp/etc
[Root @ deep] # mkdir/home/ftp/bin (require only if you are not using the "-- enable-ls" option)
[Root @ deep] # mkdir/home/ftp/lib (require only if you are not using the "-- enable-ls" option)
Step 2
Set the permission of the new directory to 0511:
[Root @ deep] # chmod 0511/home/ftp/dev
[Root @ deep] # chmod 0511/home/ftp/etc
[Root @ deep] # chmod 0511/home/ftp/bin (require only if you are not using the "-- enable-ls" option)
[Root @ deep] # chmod 0511/home/ftp/lib (require only if you are not using the "-- enable-ls" option)
The above "chmod" commands set the "dev", "etc", "bin", and "lib" directories after chrooted to "root" readable and executable, the user group and all users are executable.
Step 3
Copy the "/bin/ls" file to the "/home/ftp/bin" directory, and change the "ls" permission to 0111 (if the user is not running, change the file ).
[Root @ deep] # cp/bin/ls/home/ftp/bin (require only if you are not using the "-- enable-ls" option)
[Root @ deep] # chmod 0111/bin/ls/home/ftp/bin/ls (require only if you are not using the "-- enable-ls" option)
Step 4
Find the shared library required by the "ls" program:
[Root @ deep] # ldd/bin/ls (require only if you are not using the "-- enable-ls" option)
Libc. so.6 =>/lib/libc. so.6 (0x00125000)
/Lib/ld-linux.so.2 =>/lib/ld-linux.so.2 (0x00110000)
Copy the Shared Library to the "/home/ftp/lib" directory:
[Root @ deep] # cp/lib/libc. so.6/home/ftp/lib/(require only if you are not using the "-- enable-ls" option)
[Root @ deep] # cp/lib/ld-linux.so.2/home/ftp/lib/(require only if you are not using the "-- enable-ls" option)
Note: If you want to use the Linux "ls" program instead of the "ls" provided by WU-ftpd (the "-- enable-ls" parameter is added during compilation ), steps 3 and 4 are required.
　　
Step 5
Create the "/home/ftp/dev/null" file:
[Root @ deep] # mknod/home/ftp/dev/null c 1 3
[Root @ deep] # chmod 666/home/ftp/dev/null
　　
Step 6
Copy the "group" and "passwd" files to the "/home/ftp/etc" directory, and then change the two files.
[Root @ deep] # cp/etc/passwd/home/ftp/etc/
[Root @ deep] # cp/etc/group/home/ftp/etc/
Edit the passwd file (vi/home/ftp/etc/passwd) and delete all other items except "root" and users who are allowed to use ftp. This is important for changing the environment of the root file system. The changed "passwd" file will be like the following:
Root: x: 0: 0: root:/dev/null
Ftpadmin: x: 502: 502:/ftpadmin/:/dev/null
Edit the "group" file (vi/home/ftp/etc/group) and delete all other items except "root" and users who are allowed to use ftp. The changed "group" file will be like the following:
Root: x: 0: root
Ftpadmin: x: 502:
Configuration
You can download the "floppy. tgz" file here: http://pages.infinit.net/lotus1/doc/opti/floppy.tgz. After unlocking the "floppy. tgz" file, you can find the configuration files of all the software we introduced in this book in the corresponding directory. In this way, there is no need to manually generate these files, or copy and paste them into the configuration file. Whether you are planning to generate a configuration file or copy a ready-made configuration file, you must learn to modify the configuration file and copy the configuration file to the correct directory. The following is a detailed description.
To run the FTP server, you must create or copy the following files to the corresponding directory:
Copy the "ftpaccess" file to the "/etc" directory.
Copy the "ftpusers" file to the "/etc" directory.
Copy the "ftphosts" file to the "/etc" directory.
Copy the "ftpgroups" file to the "/etc" directory.
Copy the "ftpconversion" file to the "/etc" directory.
Copy the "ftp" file to the "/etc/pam. d" directory.
Copy the "ftpd" file to the "/etc/logrotate. d" directory.
　　
You can decompress "floppy. tgz", find the file listed above, copy it to the corresponding directory, or paste it directly from the book by copying and pasting it.