vsftp-安全和虚拟账户
Vsftp传输重要数据不安全，要采用ssl保证安全
1.安装ca
[root@www ~]# vim /etc/hosts
127.0.0.1 localhost.localdomain localhost
::1 localhost6.localdomain6 localhost6
222.1.1.132 www.hotel.com
[root@www ~]# hostname
www.hotel.com
[root@www ~]# cat /etc/sysconfig/network
HOSTNAME=www.hotel.com
[root@www ~]# vim /etc/pki/tls/openssl.cnf
45 dir = /etc/pki/CA # Where everything is kept
88 countryName = optional
89 stateOrProvinceName = optional
90 organizationName = optional
[root@www ~]# cd /etc/pki/CA/
[root@www CA]# openssl genrsa 1024 >private/cakey.pem
[root@www CA]# openssl req -new -x509 -key private/cakey.pem -out cacert.pem
[root@www CA]# chmod 600 private/*
[root@www CA]# mkdir crl certs newcerts
[root@www CA]# touch serial index.txt
[root@www CA]# echo "09">serial
[root@www Server]# rpm -ivh vsftpd--16.el5_4.1.i386.rpm
[root@www Server]# mkdir -pv /etc/ftp/certs
mkdir: created directory `/etc/ftp'
mkdir: created directory `/etc/ftp/certs'
[root@www Server]# cd /etc/ftp/certs
[root@www certs]# openssl genrsa 1024 >vsftpd.key产生密钥
[root@www certs]# openssl req -new -key vsftpd.key -out vsftpd.csr产生请求证书的文件
[root@www certs]# openssl ca -in vsftpd.csr -out vsftpd.crt
Using configuration from /etc/pki/tls/openssl.cnf
Check that the request matches the signature
Signature ok
Certificate Details:
Serial Number: 9 (0x9)
Validity
Not Before: Oct 22 11:34:52 2011 GMT
Not After : Oct 21 11:34:52 2012 GMT
Subject:
countryName = cn
stateOrProvinceName = hn
organizationName = zzu
organizationalUnitName = hotel
commonName = www.hotel.com
X509v3 extensions:
X509v3 Basic Constraints:
CA:FALSE
Netscape Comment:
OpenSSL Generated Certificate
X509v3 Subject Key Identifier:
74:9A:07:DB:7B:89:75:D0:90:66:71:04:91:72:42:68:F9:9F:0A:0A
X509v3 Authority Key Identifier:
keyid:B6:53:B5:C4:64:8E:7C:E2:DE:2A:8C:F9:8E:0D:1C:5C:7F:52:99:48
Certificate is to be certified until Oct 21 11:34:52 2012 GMT (365 days)
Sign the certificate? [y/n]:y
1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated
使用抓包工具测试ftp的安全性
# yum list all |grep wireshark
wireshark.i386 -1.el5_3.1 rhel-server
wireshark-gnome.i386 -1.el5_3.1 rhel-server
# yum install wireshark* -y --有依赖的包
# useradd user1
# passwd user1
#service vsftpd start
#chkconfig vsftpd on
# cd /var/ftp/pub/
# touch test01
# touch test02
#tshark –ni eth0 –R “tcp.dstport eq 21”
67-1
采用ssl安全登陆
[root@www pub]# vim /etc/vsftpd/vsftpd.conf
--vsftp是支持ssl的
--默认是no
force_local_logins_ssl=YES
force_local_data_ssl=YES
ssl_enable=YES
ssl_tlsv1=YES
ssl_sslv2=YES
ssl_sslv3=YES
rsa_cert_file=/etc/ftp/certs/vsftpd.crt
rsa_private_key_file=/etc/ftp/certs/vsftpd.key
pam_service_name=vsftpd
userlist_enable=YES
tcp_wrappers=YES
[root@www pub]# service vsftpd restart
[root@www pub]# chmod 600 /etc/ftp/certs*
#service vsftpd restart
命令行不支持ftps登陆，需要使用ftp客户端工具登陆
Flashfxp
[root@www pub]# tail -f /var/log/secure
Oct 22 20:18:28 www sshd[5584]: pam_unix(sshd:session): session opened for user user1 by (uid=0)
Oct 22 20:18:28 www sshd[5588]: subsystem request for sftp
Oct 22 20:18:55 www sshd[5584]: pam_unix(sshd:session): session closed for user user1
67-2
虚拟账号
在linux系统上不存在的账号，但是是能够访问ftp的账号
当虚拟用户登陆到ftp服务器时会转换成其他linux系统上用户的身份访问ftp
1.创建虚拟账号的文件并转换成数据库文件
[root@www pub]# cd /etc/ftp
[root@www ftp]# cd /etc/vsftpd/
[root@www vsftpd]# vim viruser.txt
zhangsan
123
lisi
123
需要安装光盘的数据库转换文件的工具
[root@www vsftpd]# cd /mnt/cdrom/Server/
rpm –qlp db4-utils-4.3.29-10.el5.i386.rpm
--查看有没有db_load工具
[root@www Server]# rpm -ivh db4-utils--10.el5.i386.rpm
#/lib/security/pam_userdb.so 模块存放的位置
# /lib/security/pam_userdb.so
Segmentation fault
# more /usr/share/doc/pam-0.99.6.2/txts/README.pam_userdb
查看模块的用法
[root@www Server]# cd /etc/vsftpd/
--db_load 没有man手册
[root@www vsftpd]# db_load -T -t hash -f viruser.txt viruser.db
[root@www vsftpd]# vim /etc/vsftpd/vsftpd.conf
force_local_logins_ssl=YES
force_local_data_ssl=YES
ssl_enable=YES
ssl_tlsv1=YES
ssl_sslv2=YES
ssl_sslv3=YES
rsa_cert_file=/etc/ftp/certs/vsftpd.crt
rsa_private_key_file=/etc/ftp/certs/vsftpd.key
pam_service_name=vsftpd.v
需要加入来宾账户
guest_enable=YES 打开guest账号否则虚拟用户登陆到ftp站点，提示连接错误
guest_username=user1 设置虚拟账号的映射必须是本地的用户账号可以没有密码的账号
[root@www pam.d]# cp vsftpd vsftpd.v
[root@www pam.d]# vim vsftpd.v
#%PAM-1.0
--验证的规则的文件和模块
auth required pam_userdb.so db=/etc/vsftpd/viruser
--判断账号密码是否有效
account required pam_userdb.so db=/etc/vsftpd/viruser
[root@www pam.d]# service vsftpd restart
ftp client 测试匿名用户登陆
67-3
--登陆有关的日志
[root@www pam.d]# tail -f /var/log/secure
Oct 22 20:26:08 www sshd[5678]: pam_unix(sshd:session): session opened for user user1 by (uid=0)
Oct 22 20:26:08 www sshd[5680]: subsystem request for sftp
Oct 22 20:38:25 www sshd[5678]: pam_unix(sshd:session): session closed for user user1
Oct 22 20:38:51 www sshd[5756]: Accepted password for user1 from UNKNOWN port 2627 ssh2
Oct 22 20:38:51 www sshd[5756]: pam_unix(sshd:session): session opened for user user1 by (uid=0)
Oct 22 21:11:00 www vsftpd: pam_userdb(vsftpd.v:auth): user 'zhangsan' granted access
Oct 22 21:14:27 www vsftpd: pam_userdb(vsftpd.v:auth): user 'lisi' granted access
