网络文件共享服务之虚拟用户小实验

Posted 千纸赫H

tags:

篇首语:本文由小常识网(cha138.com)小编为大家整理,主要介绍了网络文件共享服务之虚拟用户小实验相关的知识,希望对你有一定的参考价值。

实验一、实现基于文件验证的vsftpd虚拟用户

实验工具:主机centos7  测试机centos6

步骤如下:

1、创建用户数据库文件

[[email protected] ~]# cd /etc/vsftpd/
[[email protected] /etc/vsftpd]# vim vusers.txt  (创建一个存储用户及密码的文本)
 hehe
 123456
 haha
 234567
 xixi
 345678
[[email protected] /etc/vsftpd]# db_load -T -t hash -f vusers.txt vusers.db  (转换文本格式)
[[email protected] /etc/vsftpd]# ll -l vusers.db 
-rw-r--r--. 1 root root 12288 Oct 26 17:36 vusers.db
[[email protected] /etc/vsftpd]# chmod 600 vusers.db (为了账户安全,权限设严谨一点)
[[email protected] /etc/vsftpd]# ll -l vusers.db 
-rw-------. 1 root root 12288 Oct 26 17:36 vusers.db

2、创建用户和访问FTP目录

[[email protected] /etc/vsftpd]# useradd -d /var/ftproot -s /sbin/nologin vuser (haha、hehe、xixi映射为vuser账号)
[[email protected] /etc/vsftpd]# chmod +rs /var/ftproot/
[[email protected] /etc/vsftpd]# chmod -w /var/ftproot/
[[email protected] /etc/vsftpd]# mkdir /var/ftproot/upload
[[email protected] /etc/vsftpd]# setfacl -m u:vuser:rwx /var/ftproot/upload/  (给用户vuser读写执行权限)

3、创建pam配置文件

[[email protected] /etc/vsftpd]# vim /etc/pam.d/vsftpd.db
   auth required pam_userdb.so db=/etc/vsftpd/vusers  (实名验证需要.so文件,此文件路径存放于db变量里,pam_userdb.so模块用来验证用户身份)
   account required pam_userdb.so db=/etc/vsftpd/vusers   (账号有效性也是通过此模块验证)

4、指定pam配置文件

[[email protected] /etc/vsftpd]# vim vsftpd.conf
   guest_enable=yes   (启用映射)
   guest_username=vuser  (指定映射用户名)
   pam_service_name=vsftpd.db

5、虚拟用户建立独立的配置文件

[[email protected] /etc/vsftpd]# mkdir vusers.d
[[email protected] /etc/vsftpd]# vim vsftpd.conf
  user_config_dir=/etc/vsftpd/vusers.d (设置每个用户加上独立的权限,用户的独立文件存放于此路径)
[[email protected] /etc/vsftpd/vusers.d]# vim hehe
  anon_upload_enable=yes  (允许上传)
  anon_mkdir_write_enable=yes  (允许新建文件夹)
  anon_other_write_enable=yes
[[email protected] /etc/vsftpd/vusers.d]# vim haha
  local_root=/ftproot (登录目录改变为指定的目录)

6、重启服务

[[email protected] /etc/vsftpd/vusers.d]# systemctl restart vsftpd

7、测试

  ①hehe用户进行测试

[[email protected] ~]# ftp 192.168.152.167
Connected to 192.168.152.167 (192.168.152.167).
220 (vsFTPd 3.0.2)
Name (192.168.152.167:root): hehe
331 Please specify the password.
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls
227 Entering Passive Mode (192,168,152,167,22,251).
150 Here comes the directory listing.
drwxrwsr-x 2 0 1016 20 Oct 26 11:46 upload
226 Directory send OK.
ftp> cd upload
250 Directory successfully changed.
ftp> put f1.awk 
local: f1.awk remote: f1.awk
227 Entering Passive Mode (192,168,152,167,58,155).
150 Ok to send data.
226 Transfer complete.
41 bytes sent in 7.6e-05 secs (539.47 Kbytes/sec)
ftp> exit
221 Goodbye.

  ②xixi用户进行测试

[[email protected] ~]# ftp 192.168.152.167
Connected to 192.168.152.167 (192.168.152.167).
220 (vsFTPd 3.0.2)
Name (192.168.152.167:root): xixi
331 Please specify the password.
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls
227 Entering Passive Mode (192,168,152,167,191,50).
150 Here comes the directory listing.
drwxrwsr-x 2 0 1016 20 Oct 26 11:46 upload
226 Directory send OK.
ftp> cd upload
250 Directory successfully changed.
ftp> put f1.awk 
local: f1.awk remote: f1.awk
227 Entering Passive Mode (192,168,152,167,191,205).
550 Permission denied. (因为xixi没有建立独立的配置文件,所以拒绝,默认不能上传)
ftp> exit
221 Goodbye.

实验二、实现基于MYSQL验证的vsftpd虚拟用户

实验说明:本实验在两台centos主机上实现,一台做为FTP服务器,一台做数据库服务器

工具:主机 centos7(mairadb server)  主机 centos6(ftp server) 主机Centos6-1(测试机)

步骤如下:

1、安装实验所需包

 ①Centos7:安装数据库包

[[email protected] ~]# yum install mariadb-server (安装)
[[email protected] ~]# systemctl start mariadb  (启动服务)
②Centos6:安装vsftpd和pam_mysql
[[email protected] ~]# yum install vsftpd
[[email protected] ~]# yum install pam_mysql(centos7不支持pam-mysql模块,需要编译安装)

2、在数据库服务器(centos7)上创建虚拟用户账号

   ①建立存储虚拟用户数据库和连接的数据库用户

[[email protected] ~]# mysql_secure_installation  (为了安全,设密码)
[[email protected] ~]# mysql -uroot -p (登录并创建虚拟账号)
Enter password: 
Welcome to the MariaDB monitor.  Commands end with ; or \g.
Your MariaDB connection id is 3
Server version: 5.5.52-MariaDB MariaDB Server

Copyright (c) 2000, 2016, Oracle, MariaDB Corporation Ab and others.

Type help; or \h for help. Type \c to clear the current input statement.

MariaDB [(none)]> creat database vsftpd;  (创建数据库)
ERROR 1064 (42000): You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near creat database vsftpd at line 1
MariaDB [(none)]> create database vsftpd;
Query OK, 1 row affected (0.00 sec)
②准备相关表
MariaDB [(none)]
> use vsftpd; (使用数据库) Database changed MariaDB [vsftpd]> create table ftpusers (name char(30),pass char(50)); (创建数据表) Query OK, 0 rows affected (0.01 sec)
③添加虚拟用户
MariaDB [vsftpd]
> insert ftpusers values(‘hehe‘,password(‘123456‘)),(‘haha‘,password(‘234567‘)); (设用户) Query OK, 2 rows affected (0.01 sec) Records: 2 Duplicates: 0 Warnings: 0 MariaDB [vsftpd]> grant select on vsftpd.ftpusers to ‘ftp‘@‘192.168.152.166‘ identified by ‘123456‘; Query OK, 0 rows affected (0.00 sec) (授予ftp用户查询权限)
MariaDB [vsftpd]> select * from ftpusers; +------+-------------------------------------------+ | name | pass | +------+-------------------------------------------+ | hehe | *6BB4837EB74329105EE4568DDA7DC67ED2CA2AD9 | | haha | *FD408300A2CBA95D1FCBB97C4E21D38D4B7E446D | +------+-------------------------------------------+ 2 rows in set (0.00 sec) MariaDB [vsftpd]>

3、在FTP服务器(centos6)上配置vsftp服务

  ①在FTP服务器上建立pam认证所需文件

[[email protected]os6 ~]# cd /etc/pam.d/
[[email protected] /etc/pam.d]# vim vsftpd.mysql
auth required pam_mysql.so user=ftp passwd=123456 host=192.168.152.166 db=vsftpd table=ftpusers usercolumn=name passwdcolumn=pass crypt=2
account required pam_mysql.so user=ftp passwd=123456 host=192.168.152.166 db=vsftpd table=ftpusers usercolumn=name passwdcolumn=pass crypt=2
crypt是一种加密方式,2表示使用mysql password()函数加密

  ②建立相应用户和修改vsftpd配置文件,使其适应mysql认证建立虚拟用户映射的系统用户及对应的目录

[[email protected] /etc/pam.d]# useradd -d /app/ftpdir -r -m ftpuser (创建用户)
[[email protected] /etc/pam.d]# ll -d /app/ftpdir/
drwx------. 4 ftpuser ftpuser 4096 Oct 26 21:33 /app/ftpdir/
[[email protected] /etc/pam.d]# chmod -w /app/ftpdir/  (减去写权限)
[[email protected] /etc/pam.d]# vim /etc/vsftpd/vsftpd.conf
      pam_service_name=vsftpd.mysql  (修改此行,原系统用户无法登录)
      guest_enable=yes  
      guest_username=ftpuser  
      user_config_dir=/etc/vsftpd/conf.d/
[[email protected] ~]# mkdir /etc/vsftpd/conf.d  (创建配置文件中指定的目录)
[[email protected] ~]# cd /etc/vsftpd/conf.d/
[[email protected] /etc/vsftpd/conf.d]# vim hehe  (修改hehe用户配置)
     anon_upload_enable=yes  (允许匿名用户上传)
[[email protected] /etc/vsftpd/conf.d]# vim haha
    local_root=/app/hahadir
[[email protected] /etc/vsftpd/conf.d]# mkdir /app/hehedir
[[email protected] /etc/vsftpd/conf.d]# chmod 555 /app/hehedir/
[[email protected] /etc/vsftpd/conf.d]# mkdir /app/hehedir/upload
[[email protected] /etc/vsftpd/conf.d]# chown ftpuser /app/hehedir/upload/
[[email protected] /etc/vsftpd/conf.d]# mkdir /app/hahadir
[[email protected] /etc/vsftpd/conf.d]# chmod 555 /app/hahadir/

4、启动vsftpd服务

[[email protected] /etc/vsftpd/conf.d]# service vsftpd start
Starting vsftpd for vsftpd:                                [  OK  ]
[[email protected] /etc/vsftpd/conf.d]# chkconfig vsftpd on
[[email protected] /etc/vsftpd/conf.d]# ss -ntl |grep :21
LISTEN     0      32                        *:21                       *:*    

5、测试

[[email protected] ~]# ftp 192.168.152.166
Connected to 192.168.152.166 (192.168.152.166).
220 (vsFTPd 2.2.2)
Name (192.168.152.166:root): hehe
331 Please specify the password.
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls
227 Entering Passive Mode (192,168,152,166,186,189).
150 Here comes the directory listing.
drwxr-xr-x    2 0        0            4096 Sep 28 01:12 pub
226 Directory send OK.
ftp> 

 好啦,实验完成,大家有什么问题的话可以提交评论哦~

以上是关于网络文件共享服务之虚拟用户小实验的主要内容,如果未能解决你的问题,请参考以下文章

NFS共享存储服务

RK3568开发笔记:RK3568虚拟机基础环境搭建之更新源安装网络工具串口调试网络连接文件传输安装vscode和samba共享服务

samba服务用虚拟用户名访问共享文件夹

企业级NFS网络文件共享服务

RK3568开发笔记:RK3568虚拟机基础环境搭建之更新源安装网络工具串口调试网络连接文件传输安装vscode和samba共享服务

永恒之蓝漏洞利用