ftp +ssl 安装配置及linux 端登录

安装ftp

两种方式建立Vsftpd虚拟用户

 

我们登录FTP有三种方式，匿名登录、本地用户登录和虚拟用户登录。

匿名登录：在登录FTP时使用默认的用户名，一般是ftp或anonymous。

本地用户登录：使用系统用户登录，在/etc/passwd中。

虚拟用户登录：这是FTP专有用户，有两种方式实现虚拟用户，本地数据文件和数据库服务器。

FTP虚拟用户是FTP服务器的专有用户，使用虚拟用户登录FTP，只能访问FTP服务器提供的资源，大大增强了系统的安全。

 

1. 准备工作：

安装vsftpd服务：

yum -y install vsftpd

 

mkdir /opt/app/ftp

 

useradd ftp -d /opt/app/ftp

 

chown -R ftp.ftp /opt/app/ftp

 

 

# pwd

/etc/vsftpd

 

# ll

total 52

-rw-------. 1 root root 132 Nov 6 13:24 ftpusers

-rw-------. 1 root root 369 Nov 6 13:23 user_list

-rwxr-xr-x. 1 root root 12288 Nov 6 11:40 vftpuser.db

-rw-r--r--. 1 root root 54 Nov 6 10:02 vftpuser.txt

-rw-r--r--. 1 root root 5580 Nov 6 14:04 vsftpd.conf

-rw-------. 1 root root 5030 Nov 6 11:37 vsftpd.conf.bak

-rwxr--r--. 1 root root 338 Aug 3 2017 vsftpd_conf_migrate.sh

-rw-r--r--. 1 root root 5580 Nov 6 14:05 vsftpd.conf.ori

drwxr-xr-x. 2 root root 43 Nov 6 14:10 vuser_conf

[root@localhost vsftpd]#

2、编辑配置文件

下面的配置文件启用了ssl

#cat   /etc/vsftpd/vsftpd.conf

 

# Example config file /etc/vsftpd/vsftpd.conf

#

# The default compiled in settings are fairly paranoid. This sample file

# loosens things up a bit, to make the ftp daemon more usable.

# Please see vsftpd.conf.5 for all compiled in defaults.

#

# READ THIS: This example file is NOT an exhaustive list of vsftpd options.

# Please read the vsftpd.conf.5 manual page to get a full idea of vsftpd's

# capabilities.

#

# Allow anonymous FTP? (Beware - allowed by default if you comment this out).

anonymous_enable=NO

#

# Uncomment this to allow local users to log in.

# When SELinux is enforcing check for SE bool ftp_home_dir

local_enable=YES

#

# Uncomment this to enable any form of FTP write command.

write_enable=YES

#

# Default umask for local users is 077. You may wish to change this to 022,

# if your users expect that (022 is used by most other ftpd's)

local_umask=022

#

# Uncomment this to allow the anonymous FTP user to upload files. This only

# has an effect if the above global write enable is activated. Also, you will

# obviously need to create a directory writable by the FTP user.

# When SELinux is enforcing check for SE bool allow_ftpd_anon_write, allow_ftpd_full_access

#anon_upload_enable=YES

#

# Uncomment this if you want the anonymous FTP user to be able to create

# new directories.

#anon_mkdir_write_enable=YES

#

# Activate directory messages - messages given to remote users when they

# go into a certain directory.

dirmessage_enable=YES

#

# Activate logging of uploads/downloads.

xferlog_enable=YES

#

# Make sure PORT transfer connections originate from port 20 (ftp-data).

connect_from_port_20=YES

#

# If you want, you can arrange for uploaded anonymous files to be owned by

# a different user. Note! Using "root" for uploaded files is not

# recommended!

#chown_uploads=YES

#chown_username=whoever

#

# You may override where the log file goes if you like. The default is shown

# below.

xferlog_file=/var/log/xferlog

#

# If you want, you can have your log file in standard ftpd xferlog format.

# Note that the default log file location is /var/log/xferlog in this case.

xferlog_std_format=YES

#

# You may change the default value for timing out an idle session.

#idle_session_timeout=600

#

# You may change the default value for timing out a data connection.

#data_connection_timeout=120

#

# It is recommended that you define on your system a unique user which the

# ftp server can use as a totally isolated and unprivileged user.

#nopriv_user=ftpsecure

#

# Enable this and the server will recognise asynchronous ABOR requests. Not

# recommended for security (the code is non-trivial). Not enabling it,

# however, may confuse older FTP clients.

#async_abor_enable=YES

#

# By default the server will pretend to allow ASCII mode but in fact ignore

# the request. Turn on the below options to have the server actually do ASCII

# mangling on files when in ASCII mode.

# Beware that on some FTP servers, ASCII support allows a denial of service

# attack (DoS) via the command "SIZE /big/file" in ASCII mode. vsftpd

# predicted this attack and has always been safe, reporting the size of the

# raw file.

# ASCII mangling is a horrible feature of the protocol.

#ascii_upload_enable=YES

#ascii_download_enable=YES

#

# You may fully customise the login banner string:

#ftpd_banner=Welcome to blah FTP service.

#

# You may specify a file of disallowed anonymous e-mail addresses. Apparently

# useful for combatting certain DoS attacks.

#deny_email_enable=YES

# (default follows)

#banned_email_file=/etc/vsftpd/banned_emails

#

# You may specify an explicit list of local users to chroot() to their home

# directory. If chroot_local_user is YES, then this list becomes a list of

# users to NOT chroot().

# (Warning! chroot'ing can be very dangerous. If using chroot, make sure that

# the user does not have write access to the top level directory within the

# chroot)

chroot_local_user=YES

#chroot_list_enable=YES

# (default follows)

#chroot_list_file=/etc/vsftpd/chroot_list

#

# You may activate the "-R" option to the builtin ls. This is disabled by

# default to avoid remote users being able to cause excessive I/O on large

# sites. However, some broken FTP clients such as "ncftp" and "mirror" assume

# the presence of the "-R" option, so there is a strong case for enabling it.

#ls_recurse_enable=YES

#

# When "listen" directive is enabled, vsftpd runs in standalone mode and

# listens on IPv4 sockets. This directive cannot be used in conjunction

# with the listen_ipv6 directive.

listen=NO

#

# This directive enables listening on IPv6 sockets. By default, listening

# on the IPv6 "any" address (::) will accept connections from both IPv6

# and IPv4 clients. It is not necessary to listen on *both* IPv4 and IPv6

# sockets. If you want that (perhaps because you want to listen on specific

# addresses) then you must run two copies of vsftpd with two configuration

# files.

# Make sure, that one of the listen options is commented !!

listen_ipv6=YES

allow_writeable_chroot=YES

pam_service_name=vsftpd

userlist_enable=YES

tcp_wrappers=YES

guest_enable=YES

#guest_enable=YES  

guest_username=ftp

user_config_dir=/etc/vsftpd/vuser_conf

##############

#ssl_enable=YES      

#ssl_enable=YES

#allow_anon_ssl=NO                             

#force_local_logins_ssl=YES                  

#force_local_data_ssl=YES                    

#####

#ssl_tlsv1=YES

ssl_sslv2=YES

#ssl_sslv3=NO

#ssl_ciphers=HIGH

#require_ssl_reuse=NO

rsa_cert_file=/etc/ssl/cert/vsftpd.pem

#####

pasv_min_port=9000

pasv_max_port=9010

#loacl_root=/opt/app/ftp

pasv_promiscuous=YES

#ssl_enable=YES      

ssl_enable=YES

rsa_cert_file=/etc/ssl/certs/vsftpd.pem

allow_anon_ssl=NO

force_local_data_ssl=YES

force_local_logins_ssl=YES

ssl_tlsv1=YES

ssl_sslv2=NO

ssl_sslv3=NO

require_ssl_reuse=NO

ssl_ciphers=HIGH

                                                                              

 

3、创建用户文件vftpuser.txt

 

[root@CentOS5 /]#vi /etc/vsftpd/vftpuser.txt

添加虚拟用户名和密码，一行用户名，一行密码，以此类推。奇数行为用户名，偶数行为密码。

bobyuan #用户名

123456 #密码

markwang #用户名

123456 #密码

 

将刚添加的vftpuser.txt虚拟用户口令文件转换成系统识别的口令认证文件。

首先查看系统有没有安装生成口令认证文件所需的软件db4-utils。

#rpm –qa |grep db4-utils

#rpm –ivh db4-utils-4.3.29-9.fc6.i386.rpm

 

生成数据库配置文件：

db_load -T -t hash -f /etc/vsftpd/vftpuser.txt /etc/vsftpd/vftpuser.db

 

4、创建用户自定义权限文件，

# pwd

/etc/vsftpd

[root@localhost vsftpd]# mkdir vuser_conf

 

 

 

# cd vuser_conf/

[root@localhost vuser_conf]# ll

total 8

-rw-r--r--. 1 root root 184 Nov 6 14:06 admin

-rw-r--r--. 1 root root 191 Nov 6 14:09 test

[root@localhost vuser_conf]#

[root@localhost vuser_conf]#

 

# cat admin

local_root=/opt/app/ftp

write_enable=YES

download_enable=YES

anon_world_readable_only=NO

anon_upload_enable=YES

anon_mkdir_write_enable=YES

anon_other_write_enable=YES

local_umask=022

 

5、编辑pam 文件

[root@localhost vsftpd]# vim /etc/pam.d/vsftpd

#%PAM-1.0

auth required /lib64/security/pam_userdb.so db=/etc/vsftpd/vftpuser

account required /lib64/security/pam_userdb.so db=/etc/vsftpd/vftpuser

[root@localhost vsftpd]#

 

6、重启服务，使用filezilla 登录，进行测试。

 

systemctl restart vsftpd

 

设置vsftpd 开机自启动：

[root@ftp ~]# systemctl enable vsftpd

[root@ftp ~]#

 

 

 

7.登录软件

Filezilla ，Windows客户端的登录软件。

 

 

 

 

Linux 服务器登录:

#cat  loginftp.sh

#!/bin/bash

## cyx

###  2018-11-12

 

lftp -e 'set ssl:verify-certificate false' -u admin,admin -p 9046 58.132.201.194

 

#sh  loginftp.sh

 

# sh loginftp.sh

lftp [email protected]:~> ls

drwx------    2 1000     1000           10 Nov 08 11:47 test

-rw-------    1 1000     1000        14066 Nov 07 08:23 userparameter_mysql.conf

-rw-------    1 1000     1000          148 Nov 12 02:03 zabbix-tomcat.conf

lftp [email protected]:/>