Vsftpd基于MySQL实现用户认证

Posted 2021-10-21

VSFTP简介

VSFTP是一个基于GPL发布的类Unix系统上使用的FTP服务器软件，它的全称是Very Secure FTP。

软件安装

yum install vsftpd mariadb-server mariadb-devel pam-devel -y

wget  http://prdownloads.sourceforge.net/pam-mysql/pam_mysql-0.7RC1.tar.gz

tar xf pam_mysql-0.7RC1.tar.gz 

cd pam_mysql-0.7RC1

./configure --with-pam=/usr --with-mysql=/usr --with-pam-mods-dir=/usr/lib64/security

make -j 4 && make install

配置数据库

配置my.cnf

vim /etc/my.cnf
[mysqld]
innodb_file_per_table = 1
skip_name_resolve=1
log_bin=mysql-bin

启动mariadb

systemctl start mariadb.service
systemctl enable mariadb.service

建立数据用户授权

mysql
grant all on vsftpd.* to ‘vsftpd‘@‘l27.0.0.1‘ identified by ‘vsftpd‘;
grant all on vsftpd.* to ‘vsftpd‘@‘localhost‘ identified by ‘vsftpd‘;

建数据库

mysql -uvsftpd -pvsftpd -hlocalhost
create database vsftpd;

建立表

use vsftpd;
create table users(id int unsigned not null auto_increment primary key, name varchar(100) not null,password char(48) not null,unique key(name));
desc users;

建FTP登录授权账号

insert into users (name,password) values (‘ftp1‘,password(‘ftp1‘)), (‘ftp2‘,password(‘ftp2‘));

配置Vsftp

创建系统用户vuser

mkdir -pv /ftproot
useradd  -d /ftproot/vuser vuser

创建目录授权

mkdir -pv /ftproot/vuser/{pub,upload}
chmod a-w  /ftproot/vuser

配置vsftpd.vusers

vim /etc/pam.d/vsftpd.vusers
auth required /usr/lib64/security/pam_mysql.so user=vsftpd passwd=vsftpd host=localhost db=vsftpd table=users usercolumn=name passwdcolumn=password crypt=2
account required /usr/lib64/security/pam_mysql.so user=vsftpd passwd=vsftpd host=localhost db=vsftpd table=users usercolumn=name passwdcolumn=password crypt=2

crypt=0：表示口令使用明文方式保存在数据库中
crypt=1：表示口令使用UNIX的DES加密方式加密后保存在数据库中
crypt=2：表示口令使用MySQL的password()函数加密后保存在数据库中
crypt=3：表示口令使用MD5散列值的方式保存在数据库中

配置vsftpd.conf

cp /etc/vsftpd/vsftpd.conf{,.back}
vim /etc/vsftpd/vsftpd.conf                           
guest_enable=YES                             #开启虚拟用户
guest_username=vuser                      #FTP虚拟用户对应的系统用户,需要创建系统用户
pam_service_name=vsftpd.vusers     #PAM认证文件   这里是手动建立的pam认证文件名
user_config_dir=/etc/vsftpd/vusers_config/

虚拟用户权限

chown vuser.vuser /ftproot/vuser/upload
mkdir -pv /etc/vsftpd/vusers_config
touch /etc/vsftpd/vusers_config/{ftp1,ftp2}

vim /etc/vsftpd/vusers_config/ftp1
anon_upload_enable=YES

vim /etc/vsftpd/vusers_config/ftp2
anon_upload_enable=YES
anon_mkdir_write_enable=YES

启动vsftpd服务

systemctl start vsftpd.service
systemctl enable vsftpd.service

登录验证
ftp1

ftp 10.120.123.11
220 (vsFTPd 3.0.2)
Name (10.120.123.11:root): ftp1
331 Please specify the password.
Password:
230 Login successful.
ftp> cd upload
250 Directory successfully changed.
ftp> lcd /etc
Local directory now /etc
ftp> put issue
local: issue remote: issue

ftp> ls
227 Entering Passive Mode (10,120,123,11,130,37).
150 Here comes the directory listing.
-rw-------    1 1000     1000           23 Apr 20 08:24 issue
-rw-------    1 1000     1000      3157504 Apr 20 08:23 putty-64bit-0.71-installer.msi
226 Directory send OK.
ftp> mkdir 123
550 Permission denied.
ftp> rm issue
550 Permission denied.

ftp2

ftp 10.120.123.11
Connected to 10.120.123.11 (10.120.123.11).
220 (vsFTPd 3.0.2)
Name (10.120.123.11:root): ftp2
331 Please specify the password.
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> cd upload
250 Directory successfully changed.
ftp> put fstab
local: fstab remote: fstab
227 Entering Passive Mode (10,120,123,11,36,210).
150 Ok to send data.
226 Transfer complete.
465 bytes sent in 7e-05 secs (6642.86 Kbytes/sec)
ftp> mkdir ftp2
257 "/upload/jerry" created
ftp> ls
227 Entering Passive Mode (10,120,123,11,27,190).
150 Here comes the directory listing.
-rw-------    1 1000     1000          465 Apr 20 08:29 fstab
-rw-------    1 1000     1000           23 Apr 20 08:24 issue
drwx------    2 1000     1000            6 Apr 20 08:30 ftp2
-rw-------    1 1000     1000      3157504 Apr 20 08:23 putty-64bit-0.71-installer.msi
226 Directory send OK.

配置防火墙

加载模块p_conntrack_ftp、ip_nat_ftp

vim /etc/sysconfig/iptables-config
IPTABLES_MODULES="ip_conntrack_ftp"
IPTABLES_MODULES="ip_nat_ftp

vim /etc/sysconfig/iptables
-A INPUT -p tcp -m state --state NEW -m tcp --dport 21 -j ACCEPT

启动防火墙

systemctl restart iptables.service