-
热评好文
-
最新评论
-
51cto_blog：Hi~大大这篇文章写得很优秀，可以尝试参加一下【2021年度技术博客大赛】，丰厚超值奖品！参加成功，百分百中奖！>> https://blog.51cto.com/contest/index
-
目录
-
[root@centos7_2 ~]# yum install mariadb-server -y
[root@centos7_2 ~]# systemctl start mariadb
## 1.1创建数据库
[root@centos7_2 ~]# mysql
MariaDB [(none)]> create database vsftpd;
## 1.2创建表
MariaDB [(none)]> use vsftpd
CREATE TABLE users (
id INT AUTO_INCREMENT NOT NULL PRIMARY KEY,
name CHAR(50) BINARY NOT NULL,
password CHAR(48) BINARY NOT NULL
);
### 插入虚拟用户数据
INSERT INTO users(name,password) values('user1',password('pass1'));
INSERT INTO users(name,password) values('user2',password('pass2'));
## 1.3创建用户
GRANT SELECT ON vsftpd.users TO vsftpd@'192.168.47.%' IDENTIFIED BY 'centos';
[root @ centos7 data]#yum install gcc gcc-c++ pam-devel mariadb-devel -y
centos7：无对应rpm包，需手动编译安装
## 2.1 手动编译安装pam_mysql
[root @ centos7 data]#ls
pam_mysql-0.7RC1.tar.gz
[root @ centos7 data]#tar xvf pam_mysql-0.7RC1.tar.gz
[root @ centos7 data]#ls
pam_mysql-0.7RC1 pam_mysql-0.7RC1.tar.gz
[root @ centos7 data]#cd pam_mysql-0.7RC1/
[root @ centos7 pam_mysql-0.7RC1]#./configure --with-pam-mods-dir=/lib64/security/
[root @ centos7 pam_mysql-0.7RC1]#make && make install
## 2.2 建立pam认证所需文件
[root @ centos7 pam_mysql-0.7RC1]#cd /etc/pam.d/
[root @ centos7 pam.d]#vim vsftpd.mysql
auth required pam_mysql.so user=vsftpd passwd=centos host=192.168.47.101 db=vsftpd table=users usercolumn=name passwdcolumn=password crypt=2
account required pam_mysql.so user=vsftpd passwd=centos host=192.168.47.101 db=vsftpd table=users usercolumn=name passwdcolumn=password crypt=2
## 2.3 安装vsfptd
[root @ centos7 pam.d]#yum install vsftpd -y
### 2.3.1 修改配置文件
[root @ centos7 pam.d]#vim /etc/vsftpd/vsftpd.conf
#### (1)pam_service_name=vsftpd.mysql
#### (2)虚拟账号映射成vuser
guest_enable=YES
guest_username=vuser
#### (3)允许虚拟账号登录
anonymous_enable=YES
#### (3)设置每个虚拟账号独立的配置
user_config_dir=/etc/vsftpd/vusers.d/
### 2.3.2 创建一个系统账户，用于虚拟账户的映射
#### (1)[root @ centos7 pam.d]#useradd -d /data/ftproot -s /sbin/nologin vuser
[root @ centos7 pam.d]#cd /data/
[root @ centos7 data]#ls
ftproot pam_mysql-0.7RC1 pam_mysql-0.7RC1.tar.gz
[root @ centos7 data]#ll
total 332
drwx------ 3 vuser vuser 78 Dec 14 22:50 ftproot
drwxrwxrwx 3 tao tao 4096 Dec 14 22:37 pam_mysql-0.7RC1
-rw-r--r-- 1 root root 335240 Jun 7 2020 pam_mysql-0.7RC1.tar.gz
#### (2)[root @ centos7 data]#chmod 555 ftproot/ #修改文件权限，不能有写得权限
[root @ centos7 data]#ll
total 332
dr-xr-xr-x 3 vuser vuser 78 Dec 14 22:50 ftproot
drwxrwxrwx 3 tao tao 4096 Dec 14 22:37 pam_mysql-0.7RC1
-rw-r--r-- 1 root root 335240 Jun 7 2020 pam_mysql-0.7RC1.tar.gz
#### (3)[root @ centos7 data]#mkdir /data/ftproot/upload
[root @ centos7 data]#ll /data/ftproot/
total 0
drwxr-xr-x 2 root root 6 Dec 14 22:52 upload
#### (4)[root @ centos7 data]#setfacl -m u:vuser:rwx /data/ftproot/upload/
#### (5)设置每个虚拟账户独立的配置
[root @ centos7 data]#mkdir /etc/vsftpd/vusers.d/
设置user1可以匿名上传
[root @ centos7 vusers.d]#vim user1
anon_upload_enable=YES
anon_mkdir_write_enable=YES
anon_other_write_enable=YES
设置user2的共享目录为/data/ftproot2
mkdir /data/ftproot2
touch /data/ftproot2/ftproot2.txt
[root @ centos7 vusers.d]#vim user2
local_root=/data/ftproot2/
### 2.3.3重启服务
[root @ centos7 data]#systemctl restart vsftpd
### 2.3.4测试
[root@centos7_2 ~]# ftp 192.168.47.100
Connected to 192.168.47.100 (192.168.47.100).
220 (vsFTPd 3.0.2)
Name (192.168.47.100:root): user1
331 Please specify the password.
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> quit
221 Goodbye.
[root@centos7_2 ~]# ftp 192.168.47.100
Connected to 192.168.47.100 (192.168.47.100).
220 (vsFTPd 3.0.2)
Name (192.168.47.100:root): user2
331 Please specify the password.
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
192.168.47.100机器
[root @ centos7 data]#systemctl start nfs-server
[root @ centos7 data]#mkdir /www
[root @ centos7 data]#touch /www/www.txt
共享目录规则的配置文件(/etc/exports 或者/etc/exports.d/*.exports)
[root @ centos7 data]#vim /etc/exports
/www *
说明:* 代表共享给所有的主机
也可以如下设置
### 1)/www *(rw) 给可读可写权限，但是需要设置权限：setfacl -m u:nfsnobody:rwx nfsdir1 ，才能够修改及创建文件
权限的压榨:本机的root权限，跑到远程服务器上去，变成了nobody
普通用户是不压榨；用户ID与远程服务器上的相同的用户ID匹配；没有对应的用户就以用户ID表示
### 2)/www *(rw,all_squash) 所有的都压榨
### 3)/www *(rw,no_root_squash) root用户不压榨
### 4)/www *(rw,no_root_squash,all_squash,anonuid=987,anongid=981) 所有的都压榨;都压榨成UID为987的用户
### 4)/www 192.168.47.101 共享给某台主机
### 4)/www 192.168.47.0/24 共享给某个网段
在服务启动的状态，重新加载配置文件
[root @ centos7 data]#exportfs -r
查看共享的文件
[root @ centos7 data]#exportfs -v
/data/nfsdir1 <world>(sync,wdelay,hide,no_subtree_check,sec=sys,ro,secure,root_squash,no_all_squash)
/wwww <world>(sync,wdelay,hide,no_subtree_check,sec=sys,ro,secure,root_squash,no_all_squash)
192.168.47.101机器
查看主机共享的信息
[root@centos7_3 data]# showmount -e 192.168.47.100
Export list for 192.168.47.100:
/wwww *
/data/nfsdir1 *
将远程目录，挂载到本地目录中
[root@centos7_3 data]# mkdir /data/www
[root@centos7_3 ~]# mount 192.168.47.100:/www /data/www/
[root@centos7_3 ~]# ll /data/www/
total 0
-rw-r--r-- 1 root root 0 Dec 15 2020 www.txt
1.samba服务器:
#1)安装samba包
[root @ centos7 ~]#yum install samba -y
#2)创建samba用户和组
[root @ centos7 ~]#useradd -s /sbin/nologin -G admins smbuser1
[root @ centos7 ~]#useradd -s /sbin/nologin smbuser2
[root @ centos7 ~]#smbpasswd -a smbuser1
New SMB password:
Retype new SMB password:
Added user smbuser1.
[root @ centos7 ~]#smbpasswd -a smbuser2
New SMB password:
Retype new SMB password:
Added user smbuser2.
#3)创建samba共享目录
[root @ centos7 ~]#mkdir /www
[root @ centos7 ~]#touch /www/www.txt
[root @ centos7 ~]#chgrp admins /www/
[root @ centos7 ~]#chmod 775 /www/
#4)samba配置文件修改
[root @ centos7 ~]#vim /etc/samba/smb.conf
[share]
path=/www
write list =@admins
#5)启动服务
[root @ centos7 ~]#systemctl start smb.service
2.客户端
#1)测试
[root@centos7_2 ~]# smbclient -L 192.168.47.100 -U smbuser1%123
Sharename Type Comment
--------- ---- -------
print$ Disk Printer Drivers
share Disk
IPC$ IPC IPC Service (Samba 4.10.16)
smbuser1 Disk Home Directories
Reconnecting with SMB1 for workgroup listing.
Server Comment
--------- -------
Workgroup Master
--------- -------
[root@centos7_2 tt]# smbclient //192.168.47.100/share -U smbuser2%123
#2)挂载到目录
[root@centos7_2 tt]# yum -y install cifs-utils
[root@centos7_2 tt]# mkdir /data/tt
[root@centos7_2 tt]# mkdir /data/user2
[root@centos7_2 tt]# mount -o sec=ntlmssp,username=smbuser1,password=123 //192.168.47.100/share /data/tt
[root@centos7_2 data]# mount -o sec=ntlmssp,username=smbuser2,password=123 //192.168.47.100/share /data/user2
查看：
[root @ centos7 ~]#ll /www/
total 0
-rwxr--r-- 1 smbuser1 smbuser1 0 Dec 16 23:47 aliyun.txt
-rwxr--r-- 1 smbuser1 smbuser1 0 Dec 16 23:42 tt.txt
-rw-r--r-- 1 root root 0 Dec 16 23:31 www.txt
[root@centos7_2 tt]# ll /data/tt
total 0
-rwxr-xr-x 1 root root 0 Dec 16 2020 aliyun.txt
-rwxr-xr-x 1 root root 0 Dec 16 2020 tt.txt
-rwxr-xr-x 1 root root 0 Dec 16 2020 www.txt
[root@centos7_2 data]# ll /data/user2/
total 0
-rwxr-xr-x 1 root root 0 Dec 16 2020 aliyun.txt
-rwxr-xr-x 1 root root 0 Dec 16 08:01 haha.txt
-rwxr-xr-x 1 root root 0 Dec 16 2020 www.txt
rsync 服务端配置
[root @ centos7 ~]#yum install rsync -y
[root @ centos7 www]#vim /etc/rsyncd.conf
uid = root
gid = root
use chroot = no
max connections = 0
ignore errors
exclude = lost+found/
log file = /var/log/rsyncd.log
pid file = /var/run/rsyncd.pid
lock file = /var/run/rsyncd.lock
reverse lookup = no
hosts allow = 192.168.47.0/24
[backup]
path = /backup/
comment = backup
read only = no
auth users = rsyncuser
secrets file = /etc/rsync.pass
[root @ centos7 www]#mkdir /backup
[root @ centos7 www]#echo "rsyncuser:tao123" >/etc/rsync.pass
[root @ centos7 www]#chmod 600 /etc/rsync.pass
[root @ centos7 www]#systemctl start rysncd
客户端配置
[root@centos7_2 data]# yum install -y inotify-tools
[root@centos7_2 data]# echo "tao123" > /etc/rsync.pass
[root@centos7_2 data]# chmod 600 /etc/rsync.pass
[root@centos7_2 data]# mkdir /www
[root@centos7_2 data]# vim inotify_rsync.sh
#!/bin/bash
SRC='/www/'
DEST='rsyncuser@192.168.47.100::backup'
inotifywait -mrq --timefmt '%Y-%m-%d %H:%M' --format '%T %w %f' -e create,delete,moved_to,close_write,attrib ${SRC} |while read DATE TIME DIR FILE;do
FILEPATH=${DIR}${FILE}
rsync -az --delete --password-file=/etc/rsync.pass $SRC $DEST && echo "At ${TIME} on ${DATE}, file $FILEPATH was backuped up via rsync" >> /var/log/changelist.log
done
[root@centos7_2 data]# chmod +x inotify_rsync.sh
[root@centos7_2 data]# ./inotify_rsync.sh
ftp tcp 20 21
telnet tcp 23
web tcp 80 443
samba udp 137 138
tcp 139 445
yum remove libvirt-daemon
iptables -A INPUT -s 192.168.47.1 -j ACCEPT
iptables -A INPUT -p tcp -m multiport --dports 80,443,20,21,23,139,445 -j ACCEPT
iptables -A INPUT -p udp -m multiport --dports 137,138 -j ACCEPT
iptables -A INPUT -j DROP
Ctrl+Enter 发布
发布
取消