一.vsftpd服务
1.测试环境
物理主机: win8
虚拟主机: rhel 5.8
网络模式: 桥接
安装方式采用本地配置的yum源安装vsftpd
关闭selinux
2.安装vsftpd
# yum -y install vsftpd
3.启动vsftpd服务
# service vsftpd start
4.将vsftpd服务加入服务列表
# chkconfig --add vsftpd
5.开机自动启动
# chkconfig --level 345 vsftpd on
6.vsftpd服务共享目录
/var/ftp/pub
7.确保防火墙已经关闭
# service iptables stop
8.在window上访问共享目录（命令行里）
ftp 192.168.x.x
输入用户名 anonymous
密码为空
访问的目录是/var/ftp
9.用系统用户登录访问的是系统用户的家目录
10.让anonymous用户能上传文件到ftp服务器
a.在/var/ftp目录下创建upload目录
# mkdir upload
b.让ftp用户对于upload目录有读写执行权限
# setfacl -m u:ftp:rwx /var/ftp/upload
c.修改/var/vsftpd/vsftpd.conf文件
anon_upload_enable=YES //打开这一项
d.是否能够创建目录
anon_mkdir_write_enable=YES
e.是否能够删除目录
anon_other_write_enable=YES
f.开启传输日志功能
xferlog_file=/var/log/vsftpd.log
11.将系统用户禁锢在自己的家目录
a.开启这两项
chroot_list_enable=YES
chroot_list_file=/etc/vsftpd/chroot_list
b.创建一个文件，用来存放禁锢家目录的用户
# touch /etc/vsftpd/chroot_list
内容为:
hadoop
c.使用如下选项将会禁锢所有的用户家目录
chroot_local_user = YES
12.实现ftps功能
a.自建CA
[root@RedHat-5 CA]# mkdir certs newcerts crl [root@RedHat-5 CA]# ls -a . .. certs crl newcerts private [root@RedHat-5 CA]# touch index.txt [root@RedHat-5 CA]# echo 01 > serial [root@RedHat-5 CA]# (umask 077;openssl genrsa -out private/cakey.pem 2048; ) Generating RSA private key, 2048 bit long modulus ................................+++ ............................................................................................................................................+++ e is 65537 (0x10001) [root@RedHat-5 CA]# openssl req -new -x509 -key private/cakey.pem -out cacert.pem -days 3650 You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [GB]:CN State or Province Name (full name) [Berkshire]:HB Locality Name (eg, city) [Newbury]:WUHAN Organization Name (eg, company) [My Company Ltd]:COLLEGE Organizational Unit Name (eg, section) []:Tech Common Name (eg, your name or your server's hostname) []:ca.luochen.com Email Address []: [root@RedHat-5 CA]# mkdir /etc/vsftpd/ssl [root@RedHat-5 CA]# cd /etc/vsftpd/ssl/ [root@RedHat-5 ssl]# ls -a . .. [root@RedHat-5 ssl]# (umask 077;openssl genrsa -out vsftpd.key 2048; ) Generating RSA private key, 2048 bit long modulus ..+++ ......................................................................+++ e is 65537 (0x10001) [root@RedHat-5 ssl]# openssl req -new -key vsftpd.key -out vsftpd.csr You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [GB]:CN State or Province Name (full name) [Berkshire]:HB Locality Name (eg, city) [Newbury]:WUHAN Organization Name (eg, company) [My Company Ltd]:COLLEGE Organizational Unit Name (eg, section) []:Tech Common Name (eg, your name or your server's hostname) []:ftp.luochen.com Email Address []: Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []: An optional company name []: [root@RedHat-5 ssl]# openssl req -new -key vsftpd.key -out vsftpd.csr You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [GB]:CN State or Province Name (full name) [Berkshire]:HB Locality Name (eg, city) [Newbury]:WUHAN Organization Name (eg, company) [My Company Ltd]:COLLEGE Organizational Unit Name (eg, section) []:Tech Common Name (eg, your name or your server's hostname) []:ftp.luochen.com Email Address []: Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []: An optional company name []: [root@RedHat-5 ssl]# vim /etc/pki/tls/openssl.cnf
dir = /etc/pki/CA # Where everything is kept
[root@RedHat-5 ssl]# openssl ca -in vsftpd.csr -out vsftpd.crt Using configuration from /etc/pki/tls/openssl.cnf Check that the request matches the signature Signature ok Certificate Details: Serial Number: 1 (0x1) Validity Not Before: Sep 11 13:30:06 2015 GMT Not After : Sep 10 13:30:06 2016 GMT Subject: countryName = CN stateOrProvinceName = HB organizationName = COLLEGE organizationalUnitName = Tech commonName = ftp.luochen.com X509v3 extensions: X509v3 Basic Constraints: CA:FALSE Netscape Comment: OpenSSL Generated Certificate X509v3 Subject Key Identifier: C8:10:B2:72:C2:30:B7:A9:DC:90:02:ED:F8:B3:50:C9:DF:A5:E5:CB X509v3 Authority Key Identifier: keyid:49:69:11:6D:A0:A4:F5:25:3F:E8:A0:67:FC:B1:6C:27:31:40:A2:FD Certificate is to be certified until Sep 10 13:30:06 2016 GMT (365 days) Sign the certificate? [y/n]:y 1 out of 1 certificate requests certified, commit? [y/n]y Write out database with 1 new entries Data Base Updated [root@RedHat-5 ssl]#
b.为ftp服务添加ssl功能，修改/etc/vsftpd/vsftpd.conf文件
# ssl service
ssl_enable=YES
ssl_sslv3=YES
ssl_tlsv1=YES
allow_anon_ssl=NO
force_local_data_ssl=YES
force_local_logins_ssl=YES
rsa_cert_file=/etc/vsftpd/ssl/vsftpd.crt
rsa_private_key_file=/etc/vsftpd/ssl/vsftpd.key
c.用ftp客户端工具连接ftp服务器（FlashFXP）
13.建立虚拟用户
一、安装所需要程序
1、事先安装好开发环境和mysql数据库;
# yum -y install mysql-server mysql-devel
# yum -y groupinstall "Development Tools" "Development Libraries"
2.安装pam_mysql-0.7RC1
# tar zxvf pam_mysql-0.7RC1.tar.gz
# cd pam_mysql-0.7RC1
# ./configure --with-mysql=/usr --with-openssl
# make
# make install
二、创建虚拟用户账号
1.准备数据库及相关表
首先请确保mysql服务已经正常启动。而后，按需要建立存储虚拟用户的数据库即可，这里将其创建为vsftpd数据库。
mysql> create database vsftpd;
mysql> grant select on vsftpd.* to vsftpd@localhost identified by 'www.luochen.com';
mysql> grant select on vsftpd.* to vsftpd@127.0.0.1 identified by 'www.luochen.com';
mysql> flush privileges;
mysql> use vsftpd;
mysql> create table users (
-> id int AUTO_INCREMENT NOT NULL,
-> name char(20) binary NOT NULL,
-> password char(48) binary NOT NULL,
-> primary key(id)
-> );
2、添加测试的虚拟用户
根据需要添加所需要的用户，需要说明的是，这里将其密码采用明文格式存储，原因是pam_mysql的password()函数与MySQL的password()函数可能会有所不同。
mysql> insert into users(name,password) values('tom','luochen');
mysql> insert into users(name,password) values('jerry','luochen');
三、配置vsftpd
1.建立pam认证所需文件
# vim /etc/pam.d/vsftpd.mysql
添加如下两行
auth required /usr/lib/security/pam_mysql.so user=vsftpd passwd=www.luochen.com host=localhost db=vsftpd table=users usercolumn=name passwdcolumn=password crypt=0
account required /usr/lib/security/pam_mysql.so user=vsftpd passwd=www.luochen.com host=localhost db=vsftpd table=users usercolumn=name passwdcolumn=password crypt=0
2.修改vsftpd的配置文件，使其适应mysql认证
建立虚拟用户映射的系统用户及对应的目录
# useradd -s /sbin/nologin -d /var/ftproot vuser
# chmod go+rx /var/ftproot
请确保/etc/vsftpd.conf中已经启用了以下选项
anonymous_enable=YES
local_enable=YES
write_enable=YES
anon_upload_enable=NO
anon_mkdir_write_enable=NO
chroot_local_user=YES
而后添加以下选项
guest_enable=YES
guest_username=vuser
并确保pam_service_name选项的值如下所示
pam_service_name=vsftpd.mysql
四、启动vsftpd服务
# service vsftpd start
# chkconfig vsftpd on
查看端口开启情况
# netstat -tnlp |grep :21
tcp 0 0 0.0.0.0:21 0.0.0.0:* LISTEN 23286/vsftpd
使用虚拟用户登录,验正配置结果，以下为本机的命令方式测试，你也可以在其它Win Box上用IE或者FTP客户端工具登录验正
# ftp localhost
五、配置虚拟用户具有不同的访问权限
vsftpd可以在配置文件目录中为每个用户提供单独的配置文件以定义其ftp服务访问权限，每个虚拟用户的配置文件名同虚拟用户的用户名。配置文件目录可以是任意未使用目录，只需要在vsftpd.conf指定其路径及名称即可。
1、配置vsftpd为虚拟用户使用配置文件目录
# vim vsftpd.conf
添加如下选项
user_config_dir=/etc/vsftpd/vusers_dir
2、创建所需要目录，并为虚拟用户提供配置文件
# mkdir /etc/vsftpd/vusers_dir/
# cd /etc/vsftpd/vusers_dir/
# touch tom jerry
3、配置虚拟用户的访问权限
虚拟用户对vsftpd服务的访问权限是通过匿名用户的相关指令进行的。比如，如果需要让tom用户具有上传文件的权限，可以修改/etc/vsftpd/vusers/tom文件，在里面添加如下选项即可。
anon_upload_enable=YES
