vsftpd+pam+mysql實現虛擬使用者存取控制

標籤：vsftp ftp lftp

1、安裝mysql資料庫及開發環境

# yum -y install mysql-server mysql-devel

2、安裝pam_mysql-0.7RC1

# tar xf pam_mysql-0.7RC1.tar.gz 

# cd pam_mysql-0.7RC1

# ./configure --with-mysql=/usr --with-openssl

# make

# make install

# 啟動mysql

# service mysqld start

3、建立資料庫、表及虛擬使用者

mysqladmin -uroot password ‘redhat‘

mysql -uroot -p

mysql> create database vsftpd;

mysql> use vsftpd;

mysql> create table users( id smallint auto_increment not null , name char(20) binary not null, password char(48) binary not null, primary key(id));

mysql> desc users;

mysql> insert into users (name,password) value (‘tom‘,password(‘redhat‘)),(‘jerry‘,password(‘redhat‘));

mysql> grant select on vsftpd.* to [email protected] identified by ‘vsftpd‘;

mysql> grant select on vsftpd.* to [email protected] identified by ‘vsftpd‘;

mysql> select * from users;

mysql> flush privileges;

4、安裝vsftpd

# yum install vsftpd lftp ftp

5、配置pam認證所需檔案

# vim /etc/pam.d/vsftpd.mysql

auth required /lib/security/pam_mysql.so user=vsftpd passwd=vsftpd host=localhost db=vsftpd table=users usercolumn=name passwdcolumn=password crypt=2

account required /lib/security/pam_mysql.so user=vsftpd passwd=vsftpd host=localhost db=vsftpd table=users usercolumn=name passwdcolumn=password crypt=2

# 註：pam_mysql-0.7RC1源碼目錄下的README有介紹crypt的幾種機制

6、建立虛擬使用者映射的系統使用者及對應的目錄

# useradd -s /sbin/nologin -d /data/ftproot vuser

# chmod go+rx /data/ftproot/

7、配置vsftpd

# vim /etc/vsftpd/vsftpd.conf

anonymous_enable=YES

local_enable=YES

write_enable=YES

anon_upload_enable=NO

anon_mkdir_write_enable=NO

chroot_local_user=YES

pam_service_name=vsftpd.mysql        # 確保該檔案名稱正確

guest_enable=YES

guest_username=vuser

8、啟動vsftpd

# service vsftpd start

# chkconfig vsftpd on

9、測試vsftpd

# ftp localhost

Trying ::1...

ftp: connect to address ::1Connection refused

Trying 127.0.0.1...

Connected to localhost (127.0.0.1).

220 (vsFTPd 2.2.2)

Name (localhost:root): tom

331 Please specify the password.

Password:

230 Login successful.

Remote system type is UNIX.

Using binary mode to transfer files.

ftp> pwd

ftp> lcd /tmp

ftp> get issue

ftp> put inittab

local: inittab remote: inittab

227 Entering Passive Mode (127,0,0,1,27,53).

550 Permission denied.

ftp> bye

10、配置虛擬使用者具有不同的存取權限

    vsftpd可以在設定檔目錄中為每個使用者提供單獨的設定檔以定義其ftp服務存取權限，每個虛擬使用者的設定檔名同虛擬使用者的使用者名稱。設定檔目錄可以是任意未使用目錄，只需要在vsftpd.conf指定其路徑及名稱即可。

# 配置vsftpd虛擬使用者使用的設定檔目錄

# vim /etc/vsftpd/vsftpd.conf

user_config_dir=/etc/vsftpd/vuser/

# 建立所需目錄及設定檔

# mkdir /etc/vsftpd/vuser/

# cd /etc/vsftpd/vuser/

# touch tom jerry

# 配置對應虛擬使用者權限

# vim tom

anon_upload_enable=NO

# vim jerry

anon_upload_enable=YES

anon_mkdir_write_enable=YES

anon_other_write_enable=YES

# 重啟vsftpd

# service vsftpd restart

# 測試vsftpd

# ftp localhost

Trying ::1...

ftp: connect to address ::1Connection refused

Trying 127.0.0.1...

Connected to localhost (127.0.0.1).

220 (vsFTPd 2.2.2)

Name (localhost:root): jerry

331 Please specify the password.

Password:

230 Login successful.

Remote system type is UNIX.

Using binary mode to transfer files.

ftp> put inittab 

local: inittab remote: inittab

227 Entering Passive Mode (127,0,0,1,73,116).

150 Ok to send data.

226 Transfer complete.

884 bytes sent in 2.2e-05 secs (40181.82 Kbytes/sec)

ftp> ls

227 Entering Passive Mode (127,0,0,1,71,165).

150 Here comes the directory listing.

-rw-------    1 500      500           884 May 22 13:00 inittab

-rw-r--r--    1 0        0              75 May 22 12:55 issue

226 Directory send OK.

ftp> bye

### 配置vsftpd支援openssl安全通訊 ###

# 配置產生CA認證

# cd /etc/pki/CA

# (umask 077; openssl genrsa -out private/cakey.pem 2048)

# vim ../tls/openssl.cnf

countryName_default= CN

stateOrProvinceName_default= GuangDong

localityName_default= GuangZhou

0.organizationName_default= Test

organizationalUnitName_default= Tech

dir= /etc/pki/CA

# openssl req -new -x509 -key private/cakey.pem -out cacert.pem -days 3656

# mkdir certs crl newcerts

# touch index.txt

# echo 01 > serial

# mkdir -p /etc/vsftpd/ssl

# cd /etc/vsftpd/ssl/

# (umask 077;openssl genrsa -out vsftpd.key 2048)

# openssl req -new -key vsftpd.key -out vsftpd.csr

# openssl ca -in vsftpd.csr -out vsftpd.crt -days 3656

# 配置vsftpd支援ssl認證

# vim /etc/vsftpd/vsftpd.conf

ssl_enable=YES

ssl_tlsv1=YES

ssl_sslv2=NO

ssl_sslv3=YES

allow_anon_ssl=NO

force_local_data_ssl=YES

force_local_logins_ssl=YES

rsa_cert_file=/etc/vsftpd/ssl/vsftpd.crt

rsa_private_key_file=/etc/vsftpd/ssl/vsftpd.key

# 重啟vsftpd

# service vsftpd restart

# 測試

# ftp localhost

Trying ::1...

ftp: connect to address ::1Connection refused

Trying 127.0.0.1...

Connected to localhost (127.0.0.1).

220 (vsFTPd 2.2.2)

Name (localhost:root): tom

530 Non-anonymous sessions must use encryption.

Login failed.

# 顯示以上資訊則表明OK，因Linux的ftp命令不支援ssl串連，固可用其它ftp用戶端工具（例如filezilla）串連測試，並使用tcpdump工具抓包查看。

vsftpd+pam+mysql實現虛擬使用者存取控制