Vsftpd Virtual User creation in two ways

You can use either of the following methods to create a Vsftpd Virtual User: Anonymous logon, local user logon, and virtual user logon. Anonymous logon: use the default user name when logging on to FTP, usually ftp or anonymous. Local user logon: use a system user to log on to/etc/passwd .... Vsftpd Virtual User creation in two ways
 
There are three methods to log on to FTP: Anonymous logon, local user logon, and virtual user logon.
Anonymous logon: use the default user name when logging on to FTP, usually ftp or anonymous.
Local user logon: use a system user to log on to/etc/passwd.
Virtual user logon: this is an FTP private user. There are two methods to achieve virtual users, local data files and database servers.
The FTP virtual user is a private user of the FTP server. when a virtual user logs on to FTP, he can only access the resources provided by the FTP server, greatly enhancing the system security.
 
In this experiment, the Linux system is CentOS 5 update2.
 
I. local data file mode
1. add a virtual user password file
[Root @ CentOS5/] # vi/etc/vsftpd/vftpuser.txt
Add the virtual user name and password, one line of user name, one line of password, and so on. An odd behavior username and an even behavior password.
Bobyuan # User name
123456 # Password
Markwang # User name
123456 # Password
 
2. generate a virtual user password authentication file
Convert the vftpuser.txt virtual user password file to a password authentication file recognized by the system.
First check whether the system has installed the software db4-utils required to generate the password authentication file.
[Root @ CentOS5/] # rpm-qa | grep db4-utils
[Root @ CentOS5/] # rpm-ivh db4-utils-4.3.29-9.fc6.i386.rpm
The following uses the db_load command to generate a virtual user password authentication file.
[Root @ CentOS5/] # db_load-T-t hash-f/etc/vsftpd/vftpuser.txt/etc/vsftpd/vftpuser. db
 
3. edit the PAM authentication file for vsftpd
In the/etc/pam. d Directory,
[Root @ CentOS5/] # vi/etc/pam. d/vsftpd
Comment out all the other ones and add the following two lines:
Auth required/lib/security/pam_userdb.so db =/etc/vsftpd/vftpuser
Account required/lib/security/pam_userdb.so db =/etc/vsftpd/vftpuser
 
4. create a local ing user and set the home directory permissions
All FTP virtual users need one system user, which does not need a password.
[Root @ CentOS5/] # useradd-d/home/vftpsite-s/sbin/nologin vftpuser
[Root @ CentOS5/] # chmod 700/home/vftpsite
 
5. configure vsftpd. conf (set Virtual User configuration items)
[Root @ CentOS5/] # vi/etc/vsftpd. conf
Guest_enable = YES # enable a Virtual User
Guest_username = vftpuser # system user corresponding to the FTP Virtual User
Pam_service_name = vsftpd # PAM authentication file
 
6. restart the vsftpd service.
[Root @ CentOS5/] # service vsftpd restart
 
7. test Virtual User login to FTP
C: \ User \ Administrator> ftp 192.168.120.240
Connect to 192.168.120.240.
220 Welcome to bob ftp server
User (192.168.120.240 (none): markwang
331 Please specify the password.
Password:
230 Login successful.
 
II. database server (MySQL)
1. install MySQL
I am using a Tar package installed MySQL, version: mysql-6.0.8-alpha.tar.gz
For more information about the installation method, see my other article "deploy LAMP + Discuz! 7.0 ".
 
2. create a local ing user and set the home directory permissions
[Root @ CentOS5/] # useradd-d/home/vftpsite-s/sbin/nologin vftpuser
[Root @ CentOS5/] # chmod 700/home/vftpsite
 
3. configure vsftpd. conf (set Virtual User configuration items)
[Root @ CentOS5/] # vi/etc/vsftpd. conf
Guest_enable = YES # enable a Virtual User
Guest_username = vftpuser # system user corresponding to the FTP Virtual User
Pam_service_name = vsftpd # PAM authentication file
 
4. create a user password database in MySQL
[Root @ CentOS5/] # mysql-u root-p
Mysql> create database vftpuser; # create a virtual user database named vftpuser
Mysql> use vftpuser; # enter the vftpuser database
 
Mysql> create table users (name char (16) binary, passwd char (16) binary); # create a virtual user password table named users
 
Mysql> insert into users (name, passwd) values ('bobyuany', password ('123 '));
Mysql> insert into users (name, passwd) values ('markwang', password ('123 '));
# Create two virtual users, bobyuan and markwang
Note: The virtual user passwords I add in this way are encrypted by MySQL, and the encrypted password pam-mysql cannot be identified (MySQL and pam-mysql have some compatibility issues ), therefore, this experiment uses plaintext to save the password.
Add a plaintext password:
Method 1: add a single user
Mysql> insert into users (name, passwd) values ('bobyuany', '123 ');
Mysql> insert into users (name, passwd) values ('markwang', '123 ');
Method 2: Add users in batches
Create a new vftpuser.txt file
[Root @ CentOS5/] # vi vftpuser.txt
Add the user name and password. Note that the field data must be separated by a Tab key.
Bobyua 111
Markwang111
Mysql> use vftpuser;
Mysql> load data local infile "/vftpuser.txt" into table users;
Mysql> flush privileges;
 
Mysql> grant select on vftpuser. users to vftpuser @ localhost identified by '000000'; # authorize the vftpuser account to read the user table of the vftpuser database
 
5. verify that step 1 is set successfully.
[Root @ CentOS5/] # mysql-u vftpuser-p
Mysql> show databases;
Mysql> use vftpuser;
Mysql> show tables;
Mysql> select * from users;
Mysql> quit
For example:
6. Compile the PAM authentication module of MySQL.
Check whether the PAM module of MySQL is in the/lib/security Directory.
 
 
If not, download the pam-mysql installation (http://sourceforge.net/projects/pam-mysql ),
My download is pam_mysql-0.7rc1.tar.gz.
[Root @ CentOS5/] # cd/usr/local/src
[Root @ CentOS5 src] # tar-zxvf pam_mysql-0.7RC1.tar.gz
[Root @ CentOS5 src] # cd pam_mysql-0.7RC1
[Root @ CentOS5 pam_mysql-0.7RC1] #./configure -- with-mysql =/usr/local/mysql/-- with-pam-MoD-dir =/lib/security/
[Root @ CentOS5 pam_mysql-0.7RC1] # make
[Root @ CentOS5 pam_mysql-0.7RC1] # make install
 
7. edit the PAM authentication file for vsftpd
In the/etc/pam. d Directory,
[Root @ CentOS5/] # vi/etc/pam. d/vsftpd
Comment out all the other ones and add the following two lines:
Auth required pam_mysql.so user = vftpuser passwd = 111111 host = localhost db = vftpuser table = users usercolumn = name passwdcolumn = passwd crypt = 0
Account required pam_mysql.so user = vftpuser passwd = 111111 host = localhost db = vftpuser table = users usercolumn = name passwdcolumn = passwd crypt = 0
Crypt = 0: indicates that the password is saved in the database in plaintext.
Crypt = 1: indicates that the password is encrypted using the unix des encryption method and saved in the database.
Crypt = 2: indicates that the password is encrypted using the MySQL password () function and saved in the database.
Crypt = 3: indicates that the password is saved in the database using the MD5 hash value.
 
8. restart the vsftpd service.
[Root @ CentOS5/] # service vsftpd restart
 
9. test Virtual User login to FTP
C: \ User \ Administrator> ftp 192.168.120.240
Connected to 192.168.120.240.
220 Welcome to bob ftp server
User (192.168.120.240 :( none): bobyuan
331 Please specify the password.
Password:
230 Login successful.
Ftp> quit
221 Goodbye.
 
3. Virtual User advanced settings
1. virtual_use_local_privs parameter
When virtual_use_local_privs = YES, the virtual user and the local user have the same permissions;
When virtual_use_local_privs = NO, the virtual user and anonymous user have the same permissions. the default value is NO.
 
When virtual_use_local_privs = YES and write_enable = YES, the virtual user has the write permission (upload, download, delete, and rename ).
 
When virtual_use_local_privs = NO, write_enable = YES, anon_world_readable_only = YES,
When anon_upload_enable = YES, a virtual user cannot browse directories, but can only upload files without other permissions.
 
When virtual_use_local_privs = NO, write_enable = YES, anon_world_readable_only = NO,
When anon_upload_enable = NO, a virtual user can only download files and has NO other permissions.
 
When virtual_use_local_privs = NO, write_enable = YES, anon_world_readable_only = NO,
When anon_upload_enable = YES, a virtual user can only upload and download files without other permissions.
 
When virtual_use_local_privs = NO, write_enable = YES, anon_world_readable_only = NO,
When anon_mkdir_write_enable = YES, a virtual user can only download files and create folders without other permissions.
 
When virtual_use_local_privs = NO, write_enable = YES, anon_world_readable_only = NO,
When anon_other_write_enable = YES, a virtual user can only download, delete, and rename files, and has no other permissions.
 
2. create a configuration file for each virtual user
[Root @ CentOS5/] # vi/etc/vsftpd. conf
Add:
User_config_dir =/etc/vsftpd/vsftpd_user_conf
[Root @ CentOS5/] # mkdir/etc/vsftpd/vsftpd_user_conf
Edit the configuration file of bobyuan
[Root @ CentOS5/] # vi/etc/vsftpd/vsftpd_user_conf/bobyuan
Add:
Anon_world_readable_only = NO # Open the download permission for bobyuan (only download allowed ). Note that this field cannot be written as YES. otherwise, bobyuan cannot list files and directories.
Edit the markwang configuration file
[Root @ CentOS5/] # vi/etc/vsftpd/vsftpd_user_conf/markwang
Add:
Write_enable = YES # grant markwang write permission
Anon_world_readable_only = NO # Open markwang's download permission
Anon_upload_enable = YES # enable the upload permission of markwang
Anon_mkdir_write_enable = YES # enable markwang to create a directory
Anon_other_write_enable = YES # enable markwang to delete and rename
 
IV. Virtual User configuration file (experiment)
1. unified configuration for all virtual users
[Root @ CentOS5/] # vi/etc/vsftpd. conf
Write_enable = YES
Anonymous_enable = NO
Local_enable = YES
Guest_enable = YES
Guest_username = vftpuser
Virtual_use_local_privs = NO
Pam_service_name = vsftpd
Anon_world_readable_only = NO # downloadable
Anon_upload_enable = NO (default) # cannot Upload
Anon_mkdir_write_enable = NO (default) # folder cannot be created
Anon_other_write_enable = NO (default) # files cannot be deleted or renamed
Ftpd_banner = Welcome to bob ftp server
Xferlog_enable = YES
Xferlog_file =/var/log/vsftpd. log
Xferlog_std_format = YES
Ascii_upload_enable = YES
Ascii_download_enable = YES
Tcp_wrappers = NO
Setproctitle_enable = YES
Listen_port = 21
Connect_from_port_20 = YES
Idle_session_timeout = 600
Data _ connection_timeout = 120
Max_clients = 0
Max_per_ip = 3
Local_max_rate = 512000
 
2. Each virtual user uses its own configuration
[Root @ CentOS5/] # vi/etc/vsftpd. conf
Write_enable = YES
Anonymous_enable = NO
Local_enable = YES
Guest_enable = YES
Guest_username = vftpuser
Virtual_use_local_privs = NO
Pam_service_name = vsftpd
User_config_dir =/etc/vsftpd/vsftpd_user_conf
Ftpd_banner = Welcome to bob ftp server
Xferlog_enable = YES
Xferlog_file =/var/log/vsftpd. log
Xferlog_std_format = YES
Ascii_upload_enable = YES
Ascii_download_enable = YES
Tcp_wrappers = NO
Setproctitle_enable = YES
Listen_port = 21
Connect_from_port_20 = YES
Idle_session_timeout = 600
Data _ connection_timeout = 120
Max_clients = 0
Max_per_ip = 3
Local_max_rate = 512000
 
[Root @ CentOS5/] # mkdir/etc/vsftpd/vsftpd_user_conf
Edit the configuration file of bobyuan (anonymous FTP user)
[Root @ CentOS5/] # vi/etc/vsftpd/vsftpd_user_conf/bobyuan
Anon_world_readable_only = NO
Edit the configuration file of ftpadmin (FTP anonymous administrator)
[Root @ CentOS5/] # vi/etc/vsftpd/vsftpd_user_conf/ftpadmin
Anon_world_readable_only = NO
Anon_upload_enable = YES
Anon_mkdir_write_enable = YES
Anon_other_write_enable = YES
 
For another article about using MySQL to implement virtual users, refer to "Vsftpd FTP server-Virtual User (mysql) and local user verification ".
 
This article is from the "Da Lang Taosha" blog