vsftpd+pam+mysql
一、安裝所需要程序
- 1、事先安裝好開發環境和mysql數據庫;
- # yum -y install mysql-server mysql-devel
- # yum -y groupinstall "Development Tools" "Development Libraries"
- 2.安裝pam_mysql-0.7RC1
- [root@localhost ~]# tar xf pam_mysql-0.7RC1.tar.gz
- [root@localhost ~]# cd pam_mysql-0.7RC1
- [root@localhost pam_mysql-0.7RC1]# ./configure --with-mysql=/usr --with-openssl
- [root@localhost pam_mysql-0.7RC1]# make
- [root@localhost pam_mysql-0.7RC1]# make install
- 編譯選項解釋:
- --with-mysql=/usr #mysql的安裝路徑
- --with-openssl #表示連接mysql數據庫時,可以實現加密的方式通信(可用可不用)
- 3.安裝vsftpd
- # yum -y install vsftpd
二、創建虛擬用戶賬號
1.準備數據庫及相關表
首先請確保mysql服務已經正常啓動。而後,按需要建立存儲虛擬用戶的數據庫即可,這裏將其創建爲vsftpd數據庫。
mysql> create database vsftpd;
mysql> grant select on vsftpd.* to vsftpd@localhost identified by 'vsftpd';
mysql> grant select on vsftpd.* to [email protected] identified by 'vsftpd';
mysql> flush privileges;
mysql> use vsftpd;
mysql> create table users (
-> id int AUTO_INCREMENT NOT NULL,
-> name char(20) binary NOT NULL,
-> password char(48) binary NOT NULL,
-> primary key(id)
-> );
2、添加測試的虛擬用戶
根據需要添加所需要的用戶,需要說明的是,這裏將其密碼採用明文格式存儲,原因是pam_mysql的password()函數與MySQL的password()函數可能會有所不同。
mysql> insert into users(name,password) values('tom','redhat');
mysql> insert into users(name,password) values('jerry','redhat');
詳細操作過程:
- [root@localhost pam_mysql-0.7RC1]# mysql
- Welcome to the MySQL monitor. Commands end with ; or \g.
- Your MySQL connection id is 4
- Server version: 5.0.77 Source distribution
- Type 'help;' or '\h' for help. Type '\c' to clear the buffer.
- mysql> create database vsftpd;
- Query OK, 1 row affected (0.12 sec)
- mysql> use vsftpd;
- Database changed
- mysql> create table users (id int AUTO_INCREMENT NOT NULL,name char(20) binary NOT NULL,password char(48) binary NOT NULL,primary key(id));
- Query OK, 0 rows affected (0.08 sec)
- mysql> desc users;
- +----------+----------+------+-----+---------+----------------+
- | Field | Type | Null | Key | Default | Extra |
- +----------+----------+------+-----+---------+----------------+
- | id | int(11) | NO | PRI | NULL | auto_increment |
- | name | char(20) | NO | | NULL | |
- | password | char(48) | NO | | NULL | |
- +----------+----------+------+-----+---------+----------------+
- 3 rows in set (0.03 sec)
- mysql> grant select on vsftpd.* to vsftpd@localhost identified by 'vsftpd';
- Query OK, 0 rows affected (0.04 sec)
- mysql> grant select on vsftpd.* to [email protected] identified by 'vsftpd';
- Query OK, 0 rows affected (0.00 sec)
- mysql> flush privileges;
- Query OK, 0 rows affected (0.00 sec)
- mysql> insert into users(name,password) values('tom','redhat'),('jerry','redhat')
- -> ;
- Query OK, 2 rows affected (0.01 sec)
- Records: 2 Duplicates: 0 Warnings: 0
- mysql> select * from users;
- +----+-------+----------+
- | id | name | password |
- +----+-------+----------+
- | 1 | tom | redhat |
- | 2 | jerry | redhat |
- +----+-------+----------+
- 2 rows in set (0.00 sec)
- mysql> \q
- Bye
- [root@localhost pam_mysql-0.7RC1]#
三、配置vsftpd
- 1.建立pam認證所需文件
- #vi /etc/pam.d/vsftpd.mysql
- 添加如下兩行
- auth required /lib/security/pam_mysql.so user=vsftpd passwd=www.magedu.com host=localhost db=vsftpd table=users usercolumn=name passwdcolumn=password crypt=0
- account required /lib/security/pam_mysql.so user=vsftpd passwd=www.magedu.com host=localhost db=vsftpd table=users usercolumn=name passwdcolumn=password crypt=0
- 2.修改vsftpd的配置文件,使其適應mysql認證
- 建立虛擬用戶映射的系統用戶及對應的目錄
- #useradd -s /sbin/nologin -d /var/ftproot vuser
- #chmod go+rx /var/ftproot
- 請確保/etc/vsftpd/vsftpd.conf中已經啓用了以下選項
- anonymous_enable=YES
- local_enable=YES
- write_enable=YES
- anon_upload_enable=NO
- anon_mkdir_write_enable=NO
- chroot_local_user=YES
- 而後添加以下選項
- guest_enable=YES #是否允許來賓賬號訪問
- guest_username=vuser #把來賓賬號映射爲vuser
- 並確保pam_service_name選項的值如下所示
- pam_service_name=vsftpd.mysql
虛擬用戶登錄成功
四、啓動vsftpd服務
# service vsftpd start
# chkconfig vsftpd on
五、配置虛擬用戶具有不同的訪問權限
- vsftpd可以在配置文件目錄中爲每個用戶提供單獨的配置文件以定義其ftp服務訪問權限,每個虛擬用戶的配置文件名同虛擬用戶的用戶名。配置文件目錄可以是任意未使用目錄,只需要在vsftpd.conf指定其路徑及名稱即可。
- 1、配置vsftpd爲虛擬用戶使用配置文件目錄
- # vim /etc/vsftpd/vsftpd.conf
- 添加如下選項
- user_config_dir=/etc/vsftpd/vusers
- 2、創建所需要目錄,併爲虛擬用戶提供配置文件
- # mkdir /etc/vsftpd/vusers/
- # cd /etc/vsftpd/vusers/
- # touch tom jerry
- 3、配置虛擬用戶的訪問權限
- 虛擬用戶對vsftpd服務的訪問權限是通過匿名用戶的相關指令進行的。比如,如果需要讓tom用戶具有上傳文件的權限,可以修改/etc/vsftpd/vusers/tom文件,在裏面添加如下選項即可。
- anon_upload_enable=YES
- anon_mkdir_write_enable=YES
- anon_other_write_enable=YES
在tom問件裏配置如下內容,可以使tom用戶上傳下載和刪除文件,jerry用戶沒配置tom用戶可以上傳和刪除等權限
jerry用戶沒有權限:
- [root@localhost vusers]# ftp 172.16.25.11
- Connected to 172.16.25.11.
- 220 (vsFTPd 2.0.5)
- 530 Please login with USER and PASS.
- 530 Please login with USER and PASS.
- KERBEROS_V4 rejected as an authentication type
- Name (172.16.25.11:root): tom
- 331 Please specify the password.
- Password:
- 230 Login successful.
- Remote system type is UNIX.
- Using binary mode to transfer files.
- ftp> ls
- 227 Entering Passive Mode (172,16,25,11,78,168)
- 150 Here comes the directory listing.
- 226 Directory send OK.
- ftp> lcd /etc
- Local directory now /etc
- ftp> put inittab
- local: inittab remote: inittab
- 227 Entering Passive Mode (172,16,25,11,96,175)
- 150 Ok to send data.
- 226 File receive OK.
- 1666 bytes sent in 0.00068 seconds (2.4e+03 Kbytes/s)
- ftp> ls
- 227 Entering Passive Mode (172,16,25,11,193,191)
- 150 Here comes the directory listing.
- -rw------- 1 502 502 1666 Apr 14 11:00 inittab
- 226 Directory send OK.
- ftp> delete inittab
- 250 Delete operation successful.
- ftp> ls
- 227 Entering Passive Mode (172,16,25,11,113,4)
- 150 Here comes the directory listing.
- 226 Directory send OK.
這就是基於pam的虛擬用戶認證,大家都來試試吧!
- [root@localhost vusers]# ftp 172.16.25.11
- Connected to 172.16.25.11.
- 220 (vsFTPd 2.0.5)
- 530 Please login with USER and PASS.
- 530 Please login with USER and PASS.
- KERBEROS_V4 rejected as an authentication type
- Name (172.16.25.11:root): jerry
- 331 Please specify the password.
- Password:
- 230 Login successful.
- Remote system type is UNIX.
- Using binary mode to transfer files.
- ftp> lcd /etc
- Local directory now /etc
- ftp> put inittab
- local: inittab remote: inittab
- 227 Entering Passive Mode (172,16,25,11,78,3)
- 550 Permission denied.
- ftp>