Use SRP to establish a Secure Linux FTP Server (2) (1)

2. Use the eps pam module for password verification
1) first back up the/etc/pam. d/system-auth file
2) modify the/etc/pam. d/system-auth file in the following format:

auth required /lib/security/pam_unix.so likeauth nullok md5 shadowauth sufficient /lib/security/pam_eps_auth.soauth required /lib/security/pam_deny.soaccount sufficient /lib/security/pam_unix.soaccount required /lib/security/pam_deny.sopassword required /lib/security/pam_cracklib.so retry=3password required /lib/security/pam_eps_passwd.sopassword sufficient /lib/security/pam_unix.so nullok use_authtok md5 shadowpassword required /lib/security/pam_deny.sosession required /lib/security/pam_limits.sosession required /lib/security/pam_unix.so

Note that the first line in bold indicates that the PAM eps_auth module can meet the authentication requirements. The second line in bold indicates that the pam_eps_passwd.so module of PAM is used for password management.
3) convert the standard password to the EPS format
4) The pam_eps_passwd.so module of the/etc/pam. d/system-auth configuration file writes the password verification string of the EPS version to the/etc/tpasswd file. Modify the/etc/pam. dpasswd file in the following format:

auth required /lib/security/pam_stack.so service=system-authaccount required /lib/security/pam_stack.so service=system-authpassword required /lib/security/pam_stack.so service=system-auth

4. Start the FTP server in the SRP version
1) Go to the SRP source code FTP subdirectory and create FTP server files and FTP client files respectively:

#cd /usr/src/redhat/SOURCES/srp-2.2.1/ftp#make；make install

2) create a super Access Program/etc/xinetd. d/srp-ftpd with the following content:

service ftp{socket_type = streamwait = nouser = rootserver = /usr/local/sbin/ftpdlog_on_success += DURATION USERIDlog_on_failure += USERIDnice = 10disable = no}

3) use the command to start xinetd again.

#killall -USR1 xinetd

4) create a/etc/pam. d/telnet file with the following content:

#%PAM-1.0auth required /lib/security/pam_listfile.so item=usersense=deny file=/etc/ftpusers onerr=succeedauth required /lib/security/pam_stack.so service=srp-ftpauth required /lib/security/pam_shells.soaccount required /lib/security/pam_stack.so service=srp-ftpsession required /lib/security/pam_stack.so service=srp-ftp