CENTOS6.5安装配置VSFTP虚拟用户权限分配PAM验证

    安装VSFTP

    yum install vsftpd

    安装PAM服务

    yum install pam

    安装DB4部件包

    yum install db4

    建立Vsftpd服务的宿主用户

    useradd vsftpd -s /sbin/nologin

    建立Vsftpd虚拟宿主用户

    useradd virtusers -s /sbin/nologin

    备份编辑Vsftp配置文件

    cp /etc/vsftpd/vsftpd.conf /etc/vsftpd/vsftpd.conf.bak
    nano /etc/vsftpd/vsftpd.conf

    配置文件vsftpd.conf内容

    # The default compiled in settings are fairly paranoid. This sample file
    # loosens things up a bit, to make the ftp daemon more usable.
    # Please see vsftpd.conf.5 for all compiled in defaults.
    #
    # READ THIS: This example file is NOT an exhaustive list of vsftpd options.
    # Please read the vsftpd.conf.5 manual page to get a full idea of vsftpd's
    # capabilities.
    #
    # Allow anonymous FTP? (Beware - allowed by default if you comment this out).
    anonymous_enable=NO
    #
    # Uncomment this to allow local users to log in.
    local_enable=YES
    #
    # Uncomment this to enable any form of FTP write command.
    write_enable=YES
    #
    # Default umask for local users is 077. You may wish to change this to 022,
    # if your users expect that (022 is used by most other ftpd's)
    local_umask=022
    #
    # Uncomment this to allow the anonymous FTP user to upload files. This only
    # has an effect if the above global write enable is activated. Also, you will
    # obviously need to create a directory writable by the FTP user.
    #anon_upload_enable=NO
    #
    # Uncomment this if you want the anonymous FTP user to be able to create
    # new directories.
    anon_mkdir_write_enable=NO
    #
    # Activate directory messages - messages given to remote users when they
    # go into a certain directory.
    dirmessage_enable=YES
    #
    # The target log file can be vsftpd_log_file or xferlog_file.
    # This depends on setting xferlog_std_format parameter
    xferlog_enable=YES
    #
    # Make sure PORT transfer connections originate from port 20 (ftp-data).
    connect_from_port_20=YES
    #
    # If you want, you can arrange for uploaded anonymous files to be owned by
    # a different user. Note! Using "root" for uploaded files is not
    # recommended!
    chown_uploads=NO
    #chown_username=whoever
    #
    # The name of log file when xferlog_enable=YES and xferlog_std_format=YES
    # WARNING - changing this filename affects /etc/logrotate.d/vsftpd.log
    xferlog_file=/var/log/xferlog
    #
    # Switches between logging into vsftpd_log_file and xferlog_file files.
    # NO writes to vsftpd_log_file, YES to xferlog_file
    xferlog_std_format=YES
    #
    # You may change the default value for timing out an idle session.
    #idle_session_timeout=600
    #
    # You may change the default value for timing out a data connection.
    #data_connection_timeout=120
    #
    # It is recommended that you define on your system a unique user which the
    # ftp server can use as a totally isolated and unprivileged user.
    nopriv_user=vsftpd
    #
    # Enable this and the server will recognise asynchronous ABOR requests. Not
    # recommended for security (the code is non-trivial). Not enabling it,
    # however, may confuse older FTP clients.
    async_abor_enable=YES
    #
    # By default the server will pretend to allow ASCII mode but in fact ignore
    # the request. Turn on the below options to have the server actually do ASCII
    # mangling on files when in ASCII mode.
    # Beware that on some FTP servers, ASCII support allows a denial of service
    # attack (DoS) via the command "SIZE /big/file" in ASCII mode. vsftpd
    # predicted this attack and has always been safe, reporting the size of the
    # raw file.
    # ASCII mangling is a horrible feature of the protocol.
    ascii_upload_enable=YES
    ascii_download_enable=YES
    #
    # You may fully customise the login banner string:
    ftpd_banner=Welcome to RainMan FTP service ^_^
    #
    # You may specify a file of disallowed anonymous e-mail addresses. Apparently
    # useful for combatting certain DoS attacks.
    #deny_email_enable=YES
    # (default follows)
    #banned_email_file=/etc/vsftpd/banned_emails
    #
    # You may specify an explicit list of local users to chroot() to their home
    # directory. If chroot_local_user is YES, then this list becomes a list of
    # users to NOT chroot().
    chroot_local_user=YES
    chroot_list_enable=NO
    # (default follows)
    #chroot_list_file=/etc/vsftpd/chroot_list
    #
    # You may activate the "-R" option to the builtin ls. This is disabled by
    # default to avoid remote users being able to cause excessive I/O on large
    # sites. However, some broken FTP clients such as "ncftp" and "mirror" assume
    # the presence of the "-R" option, so there is a strong case for enabling it.
    ls_recurse_enable=NO
    #
    # When "listen" directive is enabled, vsftpd runs in standalone mode and
    # listens on IPv4 sockets. This directive cannot be used in conjunction
    # with the listen_ipv6 directive.
    listen=YES
    #
    # This directive enables listening on IPv6 sockets. To listen on IPv4 and IPv6
    # sockets, you must run two copies of vsftpd with two configuration files.
    # Make sure, that one of the listen options is commented !!
    #listen_ipv6=YES

    pam_service_name=vsftpd
    userlist_enable=YES
    tcp_wrappers=YES

    guest_enable=YES
    guest_username=virtusers
    virtual_use_local_privs=YES
    user_config_dir=/etc/vsftpd/vconf

    建立Vsftpd的日志文件,并更该属主为Vsftpd的服务宿主用户(这一步可以放在修改配置表前面)

    touch /var/log/vsftpd.log
    chown vsftpd.vsftpd /var/log/vsftpd.log

    建立虚拟用户配置文件存放路径

    mkdir /etc/vsftpd/vconf/

    制作虚拟用户数据库文件

    touch /etc/vsftpd/virtusers

    编辑虚拟用户名单文件

    nano /etc/vsftpd/virtusers

    输入内容奇数行用户名,偶数行密码

    username
    123456

    生成虚拟用户数据文件

    db_load -T -t hash -f /etc/vsftpd/virtusers /etc/vsftpd/virtusers.db

    查看生成的虚拟用户数据文件

    ll /etc/vsftpd/virtusers.db

    备份编辑Vsftp的PAM验证配置文件

    cp /etc/pam.d/vsftpd /etc/pam.d/vsftpd.backup
    nano /etc/pam.d/vsftpd

    把原内容用#注释了,增加2行内容

    auth required /lib64/security/pam_userdb.so db=/etc/vsftpd/virtusers
    account required /lib64/security/pam_userdb.so db=/etc/vsftpd/virtusers

    建立虚拟用户的主路径

    mkdir /home/ftp/

    建立测试用户的FTP用户目录

    mkdir /home/ftp/userfile

    创建虚拟用户配置文件(文件名和要用户名相同)

    nano /etc/vsftpd/vconf/username

    虚拟用户username配置文件模板(使用时删除#和汉字说明)

    local_root=/home/ftp/userfile #虚拟用户路径
    idle_session_timeout=600
    data_connection_timeout=120
    max_clients=10
    max_per_ip=5
    local_max_rate=50000
    local_umask=022
    cmds_allowed=ABOR,CWD,LIST,MDTM,PASS,PASV,PORT,PWD,QUIT,RETR,SITE,SIZE,STOR,TYPE,USER,ACCT,APPE,CDUP,HELP,MODE,NOOP,REIN,STAT,STOU,STRU,SYST #只能上传和下载,不能删除、建立目录、重命名
    #cmds_allowed=ABOR,CWD,LIST,MKD,MDTM,PASS,PASV,PORT,PWD,QUIT,RETR,SITE,SIZE,STOR,TYPE,USER,ACCT,APPE,CDUP,HELP,MODE,NOOP,REIN,STAT,STOU,STRU,SYST,RNFR,RNTO,RMD,DELE #能上传、下载、删除、建立目录、重命名

    更改虚拟用户的主目录的属主为虚拟宿主用户

    chown -R virtusers.virtusers /home/ftp

    查看权限

    ll /home/ftp

    启动VSFTP服务

    service vsftpd start
    chkconfig vsftpd on
    chkconfig --list vsftpd

    新加FTP用户

    nano /etc/vsftpd/virtusers
    db_load -T -t hash -f /etc/vsftpd/virtusers /etc/vsftpd/virtusers.db
    回看之前步骤配置文件
    service vsftpd restart

    虚拟用户权限说明参照表

    ABOR - abort a file transfer 关闭一个文件的传输
    CWD - change working directory 改变目录
    DELE - delete a remote file 删除远端文件(即ftp服务器上的文件)
    LIST - list remote files 显示出远端文件
    MDTM - return the modification time of a file 返回一个文件的改变时间
    MKD - make a remote directory 创建远端目录
    NLST - name list of remote directory 远端目录名称列表
    PASS - send password 发送密码
    PASV - enter passive mode 被动模式
    PORT - open a data port 打开数据端口
    PWD - print working directory 显示路径
    QUIT - terminate the connection 中断连接,退出服务器
    RETR - retrieve a remote file 恢复一个远端文件
    RMD - remove a remote directory 删除远端目录
    RNFR - rename from 重命名到
    RNTO - rename to 给...重命名
    SITE - site-specific commands
    SIZE - return the size of a file 返回文件大小
    STOR - store a file on the remote host 在远端主机存储一个文件
    TYPE - set transfer type 改变传输类型(acsii,bin)
    USER - send username 发送用户名

    转载请注明:RAIN MAN » CENTOS6.5安装配置VSFTP虚拟用户权限分配PAM验证

    喜欢 4
标签: , ,

还没有人抢沙发呢~