[关闭]
@yanglt7 2019-02-22T10:27:57.000000Z 字数 9847 阅读 992

vsftpd + PAM + MySQL + 内外网 + 磁盘配额 配置全过程

网管

一、前期准备

1. 需要安装的工具

  1. [root@ylt001 ~]# yum -y install net-tools vim wget

2. 网络配置

1）修改 IP

  1. [root@ylt001 ~]# ifconfig
  2. # 查看当前ip详细信息
  3. [root@ylt001 ~]# ip addr del 10.86.1.xx/24 dev ens160
  4. # 删除原来的ip
  5. [root@ylt001 ~]# ip addr add 10.86.1.xx/24 dev ens160
  6. # 新配置的ip
  7. [root@ylt001 ~]# systemctl restart network
  8. # 重启网络服务
  9. [root@ylt001 ~]# ifconfig
  10. # 检查是否修改成功

2）修改外网配置文件

  1. [root@ylt001 ~]# cd /etc/sysconfig/network-scripts/
  2. [root@ylt001 ~]# cat ifcfg-ens192
  3. TYPE="Ethernet"
  4. BOOTPROTO="static"
  5. NM_CONTROLLED=yes
  6. IPV6INIT="yes"
  7. DEVICE="ens192"
  8. ONBOOT="yes"
  9. IPADDR=202.116.83.xx
  10. NETMASK=255.255.255.0
  11. GATEWAY=202.116.83.1

3）修改内网配置文件

  1. [root@ylt001 ~]# cat ifcfg-ens160
  2. TYPE="Ethernet"
  3. BOOTPROTO="static"
  4. NM_CONTROLLED=yes
  5. IPV6INIT="yes"
  6. DEVICE="ens160"
  7. ONBOOT="yes"
  8. IPADDR=10.86.1.xx
  9. NETMASK=255.255.255.0

4）配置 DNS

  1. [root@ylt001 ~]# cat /etc/resolv.conf
  2. # Generated by NetworkManager
  3. nameserver 8.8.8.8
  4. nameserver 8.8.4.4

5）重启并检查网络服务

  1. [root@ylt001 ~]# systemctl restart network
  2. [root@ylt001 ~]# ifconfig
  3. [root@ylt001 ~]# ip link show

二、安装 vsftpd

  1. [root@ylt001 ~]# yum install -y vsftpd

三、MariaDB 的安装与配置

1. 安装 mariadb

  1. [root@ylt001 ~]# yum install -y mariadb mariadb-devel mariadb-server
  2. [root@ylt001 ~]# systemctl enable mariadb
  3. # 设置开机自启
  4. [root@ylt001 ~]# systemctl restart mariadb
  5. # 重启 mariadb
  6. [root@ylt001 ~]# netstat -npl|grep 3306
  7. # 查看是否开启

2. 为 root 账户设置密码

  1. [root@ylt001 ~]# mysql_secure_installation          
  2. # 该命令会执行以下几个设置：
  3. # a)为root用户设置密码Y (默认密码)
  4. # b)删除匿名账号Y
  5. # c)取消root用户远程登录Y
  6. # d)删除test库和对test库的访问权限Y
  7. # e)刷新授权表使修改生效Y

3. 建立一个数据库并设置相应权限

  1. [root@ylt001 ~]# mysql -u root -p
  2. MariaDB [(none)]> create database ftpdb;
  3. MariaDB [(none)]> use ftpdb;
  4. MariaDB [(none)]> create table user(name varchar(20),passwd varchar(48));
  5. MariaDB [(none)]> insert into user(name,passwd) values ("ylt",password("passwd"));
  6. MariaDB [(none)]> select * from user;
  7. MariaDB [(none)]> grant select on ftpdb.user to ftpuser@localhost identified by "passwd";
  8. MariaDB [(none)]> flush privileges;
  9. MariaDB [(none)]> exit;

四、配置 PAM 认证

1. 安装 pam pam-devel openssl-devel

  1. [root@ylt001 ~]# yum install -y automake pam pam-devel openssl-devel

2. 编译安装 pam_mysql 包

  1. [root@ylt001 ~]# cd /application
  2. [root@ylt001 application]# wget http://prdownloads.sourceforge.net/pam-mysql/pam_mysql-0.7RC1.tar.gz
  3. [root@ylt001 application]# tar -xzvf pam_mysql-0.7RC1.tar.gz
  4. [root@ylt001 application]# cd pam_mysql-0.7RC1/
  5. [root@ylt001 application]# ./configure --with-mysql=/usr --with-openssl=/usr --with-pam=/usr --with-pam-mods-dir=/lib64/security
  6. [root@ylt001 application]# make && make install
  7. [root@ylt001 application]# ls /lib64/security/ | grep mysql
  8. #pam_mysql.la
  9. #pam_mysql.so

3. 建立 PAM 认证信息

  1. [root@ylt001 ~]# vi /etc/pam.d/vsftpd
  2. # 注释其他内容，写入如下两行：
  4. auth required /lib64/security/pam_mysql.so user=ftpuser passwd=passwd host=localhost db=ftpdb table=user usercolumn=name passwdcolumn=passwd crypt=2
  6. account required /lib64/security/pam_mysql.so user=ftpuser passwd=passwd host=localhost db=ftpdb table=user usercolumn=name passwdcolumn=passwd crypt=2
  8. #crypt=0: 明文密码
  9. #crypt=1: 使用crpyt()函数加密
  10. #crypt=2: 使用MYSQL中的password()函数加密
  11. #crypt=3：使用md5的散列方式

五、建立本地虚拟用户

  1. [root@ylt001 ~]# useradd -s /sbin/nologin ftpuser
  2. [root@ylt001 ~]# cd /home
  3. [root@ylt001 home]# ll
  4. ftpuser

六、修改配置文件

1. 前期准备

  1. [root@ylt001 ~]# touch /var/log/xferlog
  2. [root@ylt001 ~]# mkdir /etc/vsftpd/vsftpd_user_conf
  3. [root@ylt001 ~]# touch chroot_list

2. 修改 vsftpd.conf

  1. [root@ylt001 ~]# cat /etc/vsftpd/vsftpd.conf
  2. # Example config file /etc/vsftpd/vsftpd.conf
  3. #
  4. # The default compiled in settings are fairly paranoid. This sample file
  5. # loosens things up a bit, to make the ftp daemon more usable.
  6. # Please see vsftpd.conf.5 for all compiled in defaults.
  7. #
  8. # READ THIS: This example file is NOT an exhaustive list of vsftpd options.
  9. # Please read the vsftpd.conf.5 manual page to get a full idea of vsftpd's
  10. # capabilities.
  11. #
  12. # Allow anonymous FTP? (Beware - allowed by default if you comment this out).
  13. anonymous_enable=NO
  14. #
  15. # Uncomment this to allow local users to log in.
  16. # When SELinux is enforcing check for SE bool ftp_home_dir
  17. local_enable=YES
  18. #
  19. # Uncomment this to enable any form of FTP write command.
  20. write_enable=YES
  21. #
  22. # Default umask for local users is 077. You may wish to change this to 022,
  23. # if your users expect that (022 is used by most other ftpd's)
  24. local_umask=022
  25. #
  26. # Uncomment this to allow the anonymous FTP user to upload files. This only
  27. # has an effect if the above global write enable is activated. Also, you will
  28. # obviously need to create a directory writable by the FTP user.
  29. # When SELinux is enforcing check for SE bool allow_ftpd_anon_write, allow_ftpd_full_access
  30. anon_upload_enable=YES
  31. #
  32. # Uncomment this if you want the anonymous FTP user to be able to create
  33. # new directories.
  34. anon_mkdir_write_enable=YES
  35. #
  36. # Activate directory messages - messages given to remote users when they
  37. # go into a certain directory.
  38. #dirmessage_enable=YES
  39. #
  40. # Activate logging of uploads/downloads.
  41. #xferlog_enable=YES
  42. #
  43. # Make sure PORT transfer connections originate from port 20 (ftp-data).
  44. connect_from_port_20=YES
  45. #
  46. # If you want, you can arrange for uploaded anonymous files to be owned by
  47. # a different user. Note! Using "root" for uploaded files is not
  48. # recommended!
  49. chown_uploads=YES
  50. chown_username=ftpuser
  51. #
  52. # You may override where the log file goes if you like. The default is shown
  53. # below.
  54. #xferlog_file=/var/log/xferlog
  55. #
  56. # If you want, you can have your log file in standard ftpd xferlog format.
  57. # Note that the default log file location is /var/log/xferlog in this case.
  58. xferlog_std_format=YES
  59. #
  60. # You may change the default value for timing out an idle session.
  61. idle_session_timeout=600
  62. #
  63. # You may change the default value for timing out a data connection.
  64. data_connection_timeout=120
  65. #
  66. # It is recommended that you define on your system a unique user which the
  67. # ftp server can use as a totally isolated and unprivileged user.
  68. #nopriv_user=ftpsecure
  69. #
  70. # Enable this and the server will recognise asynchronous ABOR requests. Not
  71. # recommended for security (the code is non-trivial). Not enabling it,
  72. # however, may confuse older FTP clients.
  73. #async_abor_enable=YES
  74. #
  75. # By default the server will pretend to allow ASCII mode but in fact ignore
  76. # the request. Turn on the below options to have the server actually do ASCII
  77. # mangling on files when in ASCII mode.
  78. # Beware that on some FTP servers, ASCII support allows a denial of service
  79. # attack (DoS) via the command "SIZE /big/file" in ASCII mode. vsftpd
  80. # predicted this attack and has always been safe, reporting the size of the
  81. # raw file.
  82. # ASCII mangling is a horrible feature of the protocol.
  83. ascii_upload_enable=YES
  84. ascii_download_enable=YES
  85. #
  86. # You may fully customise the login banner string:
  87. ftpd_banner=Welcome to FTP service.
  88. #
  89. # You may specify a file of disallowed anonymous e-mail addresses. Apparently
  90. # useful for combatting certain DoS attacks.
  91. #deny_email_enable=YES
  92. # (default follows)
  93. #banned_email_file=/etc/vsftpd/banned_emails
  94. #
  95. # You may specify an explicit list of local users to chroot() to their home
  96. # directory. If chroot_local_user is YES, then this list becomes a list of
  97. # users to NOT chroot().
  98. # (Warning! chroot'ing can be very dangerous. If using chroot, make sure that
  99. # the user does not have write access to the top level directory within the
  100. # chroot)
  101. #chroot_local_user=NO
  102. chroot_list_enable=YES
  103. # (default follows)
  104. chroot_list_file=/etc/vsftpd/chroot_list
  105. #
  106. # You may activate the "-R" option to the builtin ls. This is disabled by
  107. # default to avoid remote users being able to cause excessive I/O on large
  108. # sites. However, some broken FTP clients such as "ncftp" and "mirror" assume
  109. # the presence of the "-R" option, so there is a strong case for enabling it.
  110. #ls_recurse_enable=YES
  111. #
  112. # When "listen" directive is enabled, vsftpd runs in standalone mode and
  113. # listens on IPv4 sockets. This directive cannot be used in conjunction
  114. # with the listen_ipv6 directive.
  115. listen=YES
  116. #
  117. # This directive enables listening on IPv6 sockets. By default, listening
  118. # on the IPv6 "any" address (::) will accept connections from both IPv6
  119. # and IPv4 clients. It is not necessary to listen on *both* IPv4 and IPv6
  120. # sockets. If you want that (perhaps because you want to listen on specific
  121. # addresses) then you must run two copies of vsftpd with two configuration
  122. # files.
  123. # Make sure, that one of the listen options is commented !!
  124. listen_ipv6=NO
  126. pam_service_name=vsftpd
  127. userlist_enable=YES
  128. tcp_wrappers=YES
  129. allow_writeable_chroot=YES
  131. anon_other_write_enable=NO
  132. anon_world_readable_only=NO
  133. delete_failed_uploads=TRUE
  134. dirlist_enable=YES
  136. anon_max_rate=1048576
  137. local_max_rate=1048576
  138. anon_umask=022
  139. max_login_fails=3
  141. max_per_ip=10
  142. pasv_enable=YES
  143. pasv_min_port=24500
  144. pasv_max_port=24500
  145. listen_address=192.168.2.xx
  146. guest_enable=YES
  147. virtual_use_local_privs=YES
  148. guest_username=ftpuser
  149. user_config_dir=/etc/vsftpd/vsftpd_user_conf

3. 启动 vsftpd 服务

  1. [root@ylt001 ~]# systemctl enable vsftpd  
  2. [root@ylt001 ~]# systemctl start vsftpd

4. 配置用户独立的配置文件

  1. [root@ylt001 ~]# touch /etc/vsftpd/vsftpd_user_conf/ylt.conf

1）可读、可上传、可下载、可删除、可建目录

  1. [root@ylt001 ~]# cat /etc/vsftpd/vsftpd_user_conf/ylt.conf
  2. write_enable=YES
  3. download_enable=YES
  4. local_root=/home/ftpuser/ylt

2）可读、不可上传、可下载、不可删除、不可创建目录

  1. [root@ylt001 ~]# cat /etc/vsftpd/vsftpd_user_conf/ylt.conf
  2. write_enable=NO
  3. download_enable=NO
  4. local_root=/home/ftpuser/ylt

5. 开启 ftp 服务端口

  1. [root@ylt001 ~]# firewall-cmd --zone=public --add-port=21/tcp --permanent
  2. [root@ylt001 ~]# firewall-cmd --zone=public --add-port=20/tcp --permanent
  3. [root@ylt001 ~]# firewall-cmd --zone=public --add-port=24500/tcp --permanent
  4. [root@ylt001 ~]# firewall-cmd --reload

七、实现文件夹配额

1. 磁盘分割

  1. [root@ylt001 ~]# gdisk /dev/sdb
  2. [root@ylt001 ~]# mkfs.xfs /dev/sdb1

2. 磁盘挂载

  1. [root@ylt001 ~]# mount -o prjquota /dev/sdb1 /home/ftpuser
  2. # dev/sdb 是未挂载的 partition

3. 设置磁盘自动挂载

  1. [root@ylt001 ~]# vi /etc/fstab
  2. #添加:
  3. UUID=27a9bc94-36a7-4cd6-aa68-5ea38c944529 /home/ftpuser  xfs  defaults 0 0

4. 创建用户的家目录

  1. [root@ylt001 ~]# cd /home/ftpuser
  2. [root@ylt001 ftpuser]# mkdir ylt
  3. [root@ylt001 ftpuser]# chmod 777 ylt

5. 文件夹配额

  1. [root@ylt001 ~]# xfs_quota -x -c report /home/ftpuser
  2. # 列出所有的 Project ID 以及对应的配额使用情况
  3. [root@ylt001 ~]# mkdir /ftpuser/ylt
  4. # 创建需要配额的用户目录(其实之前已经创建好了)
  5. [root@ylt001 ~]# xfs_quota -x -c 'project -s -p /home/ftpuser/ylt 1'
  6. # 为文件夹分配 ProjectID 1
  7. [root@ylt001 ~]# xfs_quota -x -c 'limit -p bhard=100m 1' /home/ftpuser
  8. # 限制 Project 1 的配额为100MB
  9. [root@ylt001 ~]# dd if=/dev/zero of=/home/ftpuser/ylt/test bs=1M count=101
  10. # 检测配额是否生效
  11. [root@ylt001 ~]# xfs_quota -x -c report /home/ftpuser
  12. [root@ylt001 ~]# xfs_quota -c 'quota -p 1' /home/ftpuser
  13. # 查询某个 project 的配额使用情况

八、关闭SELINUX

  1. [root@ylt001 ~]# vi /etc/selinux/config
  2. #将 SELINUX=XXX -->XXX 代表级别改为SELINUX=disabled
  3. [root@ylt001 ~]# init 6
  4. # 重启系统

九、文件目录权限设置

  1. # 用户家目录的最低权限为
  2. [root@ylt001 ~]# chmod 755 /home/ftpuser
  3. chmod 777 /home/ftpuser/ylt
  5. # 以下两个配置文件的最低权限为
  6. chmod 700 vsftpd.conf
  7. chmod 700 vsftpd_user_conf
添加新批注
在作者公开此批注前，只有你和作者可见。
回复批注