vsftp
利用 pam_mysql 模块可以实现基于MySQL的FTP虚拟用户功能
项目网站：https://sourceforge.net/projects/pam-mysql/
环境准备
本实验在两台主机上实现
一台做为FTP服务器,CentOS 7
一台做MySQL 数据库服务器
下载vsftp
[root@expr01 ~]# yum -y install vsftpd
下载数据库mariadb
[root@mysql-server ~]# yum -y install mariadb-server
[root@mysql-server ~]# systemctl enable --now mariadb.service
[root@mysql-server ~]# mysql
MariaDB [(none)]> select password("centos");
+-------------------------------------------+
| password("centos") |
+-------------------------------------------+
| *128977E278358FF80A246B5046F51043A2B1FCED |
+-------------------------------------------+
1 row in set (0.00 sec)
在数据库服务上配置数据库支持vsftpd服务
## 建立存储虚拟用户数据库和表
MariaDB [(none)]> CREATE DATABASE vsftpd;
MariaDB [(none)]> USE vsftpd;
MariaDB [vsftpd]> CREATE TABLE users (
id INT AUTO_INCREMENT NOT NULL PRIMARY KEY,
name CHAR(50) BINARY NOT NULL,
password CHAR(48) BINARY NOT NULL
);
## 添加虚拟用户，为了安全应该使用PASSWORD函数加密其密码后存储
MariaDB [vsftpd]> INSERT INTO users(name,password) values('ftp_stj',password('1q2w3e'));
MariaDB [vsftpd]> INSERT INTO users(name,password) values('ftp_stangj',password('1q2w3e4r'));
## 查看相应信息
MariaDB [vsftpd]> select * from vsftpd.users;
+----+------------+-------------------------------------------+
| id | name | password |
+----+------------+-------------------------------------------+
| 1 | ftp_stj | *712B69033BB2C08B8E1243774687F3DE968DBBF4 |
| 2 | ftp_stangj | *DB469070DB0AD0CA0B93040D166D7FC4713D6961 |
+----+------------+-------------------------------------------+
2 rows in set (0.00 sec)
## 授权用户
MariaDB [(none)]> GRANT SELECT ON vsftpd.* TO vsftpd@'%' IDENTIFIED BY 'qawsed';
MariaDB [vsftpd]> FLUSH PRIVILEGES;
pam-mysql源码进行编译
[root@expr01 ~]# yum -y install vsftpd gcc gcc-c++ make mariadb-devel pam-devel
[root@expr01 ~]# cd /usr/local/src/
[root@expr01 src]# ls
pam_mysql-0.7RC1.tar.gz
[root@expr01 src]# tar xf pam_mysql-0.7RC1.tar.gz
[root@expr01 src]# cd pam_mysql-0.7RC1/
[root@expr01 pam_mysql-0.7RC1]# ./configure --with-pam-mods-dir=/lib64/security
[root@expr01 pam_mysql-0.7RC1]# make install
[root@expr01 pam_mysql-0.7RC1]# ls -lt /lib64/security/pam_mysql.*
-rwxr-xr-x 1 root root 882 Feb 4 17:04 /lib64/security/pam_mysql.la
-rwxr-xr-x 1 root root 141720 Feb 4 17:04 /lib64/security/pam_mysql.so
在FTP服务器上建立pam认证所需文件
[root@expr01 ~]# vi /etc/pam.d/vsftpd.mysql
auth required pam_mysql.so user=vsftpd passwd=qawsed host=192.168.139.32 db=vsftpd table=users usercolumn=name passwdcolumn=password crypt=2
account required pam_mysql.so user=vsftpd passwd=magedu host=192.168.139.32 db=vsftpd table=users usercolumn=name passwdcolumn=password crypt=2
建立相应用户和修改vsftpd配置文件
[root@expr01 ~]# useradd -s /sbin/nologin -d /data/ftproot -r vuser
[root@expr01 ~]# mkdir -pv /data/ftproot/upload
[root@expr01 ~]# setfacl -m u:vuser:rwx /data/ftproot/upload
##确保/etc/vsftpd/vsftpd.conf中已经启用了以下选项
[root@expr01 ~]# vim /etc/vsftpd/vsftpd.conf
# 修改下面这一行信息，指向新的pam
pam_service_name=vsftpd.mysql
#添加下面两项
guest_enable=YES
guest_username=vuser
##启动vsftpd服务
[root@expr01 ~]# systemctl restart vsftpd
验证虚拟用户登录
[root@localhost ~]# ftp 192.168.139.31
Connected to 192.168.139.31 (192.168.139.31).
220 (vsFTPd 3.0.2)
Name (192.168.139.31:root): ftp_stj # 用户ftp_stj
331 Please specify the password.
Password: # 密码1q2w3e
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls # 显示文件信息
227 Entering Passive Mode (192,168,139,31,181,59).
150 Here comes the directory listing.
drwxrwxr-x 2 0 0 6 Feb 04 09:13 upload
226 Directory send OK.
[root@localhost ~]# ftp 192.168.139.31
Connected to 192.168.139.31 (192.168.139.31).
220 (vsFTPd 3.0.2)
Name (192.168.139.31:root): ftp_stangj # 用户ftp_stangj
331 Please specify the password.
Password: # 密码1q2w3e4r
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls # 显示文件信息
227 Entering Passive Mode (192,168,139,31,159,118).
150 Here comes the directory listing.
drwxrwxr-x 2 0 0 6 Feb 04 09:13 upload
实现不同虚拟用户有不同的权限
[root@expr01 ~]# vim /etc/vsftpd/vsftpd.conf
# 添加如下选项
user_config_dir=/etc/vsftpd/conf.d/
`创建自定义加载虚拟用户权限文件`
[root@expr01 ~]# mkdir /etc/vsftpd/conf.d/
[root@expr01 ~]# vim /etc/vsftpd/conf.d/ftp_stj
anon_upload_enable=YES
anon_mkdir_write_enable=YES
anon_other_write_enable=YES
#登录目录改变至指定的目录
#local_root=/data/ftproot/ftp_stj
[root@expr01 ~]# vim /etc/vsftpd/conf.d/ftp_stangj
anon_upload_enable=YES
anon_mkdir_write_enable=YES
anon_other_write_enable=YES
#登录目录改变至指定的目录
#local_root=/data/ftproot/ftp_stangj
验证权限
-
我这里验证一个虚拟用户即可
[root@localhost ~]# ftp 192.168.139.31
Connected to 192.168.139.31 (192.168.139.31).
220 (vsFTPd 3.0.2)
Name (192.168.139.31:root): ftp_stj # 登录ftp_stj
331 Please specify the password.
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls
227 Entering Passive Mode (192,168,139,31,163,133).
150 Here comes the directory listing.
drwxrwxr-x 2 0 0 6 Feb 04 09:13 upload
226 Directory send OK.
ftp> cd upload
250 Directory successfully changed.
ftp> put anaconda-ks.cfg # 上传文件
local: anaconda-ks.cfg remote: anaconda-ks.cfg
227 Entering Passive Mode (192,168,139,31,100,80).
150 Ok to send data.
226 Transfer complete.
1717 bytes sent in 0.000232 secs (7400.86 Kbytes/sec)
ftp> mkdir aaa1 # 创建目录
257 "/upload/aaa1" created
ftp> ls
227 Entering Passive Mode (192,168,139,31,124,122).
150 Here comes the directory listing.
drwx------ 2 998 996 6 Feb 04 13:33 aaa1
-rw------- 1 998 996 1717 Feb 04 13:30 anaconda-ks.cfg
文章评论