Vsftpd使用MySQL驗證明驗

Vsftpd使用mysql驗證明驗筆記

實驗環境:

操做系統：CentOS 6.5 64位

主機	IP	做用
mysql.xruan.com	192.168.0.11	用於存儲vsftpd虛擬用戶信息
vsftp.xruan.com	192.168.0.12	提供ftp服務

實驗步驟：

第1步：安裝vsftpd並測試可用性（在vsftp.xruan.com，192.168.0.12上執行）

[root@CentOS6lsrv02 ~]# yum install -y vsftpd

[root@CentOS6lsrv02 ~]# yum install -y lftp

[root@CentOS6lsrv02 ~]# lftp 192.168.0.12

lftp 192.168.0.12:~>

第2步：安裝mysql-server並建立用戶和表（在mysql.xruan.com，192.168.0.11上執行）

[root@CentOS6lsrv01 ~]# yum install -y mysql-server &> /dev/null

[root@CentOS6lsrv01 ~]# rpm -q mysql-server

mysql-server-5.1.71-1.el6.x86_64

啓動mysqld服務

[root@CentOS6lsrv01 ~]# service mysqld start

Initializing MySQL database:  WARNING: The host 'CentOS6lsrv01' could notbe looked up with resolveip.

This probably means that your libc libraries arenot 100 % compatible

with this binary MySQL version. The MySQLdaemon, mysqld, should work

normally with the exception that host nameresolving will not work.

This means that you should use IP addressesinstead of hostnames

when specifying MySQL privileges !

Installing MySQL system tables...

OK

Filling help tables...

OK

 

To start mysqld at boot time you have to copy

support-files/mysql.server to the right placefor your system

 

PLEASE REMEMBER TO SET A PASSWORD FOR THE MySQLroot USER !

To do so, start the server, then issue thefollowing commands:

 

/usr/bin/mysqladmin -u root password'new-password'

/usr/bin/mysqladmin -u root -h CentOS6lsrv01password 'new-password'

 

Alternatively you can run:

/usr/bin/mysql_secure_installation

 

which will also give you the option of removingthe test

databases and anonymous user created bydefault.  This is

strongly recommended for production servers.

 

See the manual for more instructions.

 

You can start the MySQL daemon with:

cd /usr ; /usr/bin/mysqld_safe &

 

You can test the MySQL daemon withmysql-test-run.pl

cd /usr/mysql-test ; perl mysql-test-run.pl

 

Please report any problems with the/usr/bin/mysqlbug script!

 

                                                             [ OK  ]

Starting mysqld:                                          [  OK  ]

運行 /usr/bin/mysql_secure_installation 按提示設置好mysql中root用戶密碼，這裏我設置爲「xruan」。

建立數據庫並授予用戶權限

mysql> CREATE DATABASE vsftpd;

Query OK, 1 row affected (0.00 sec)

 

mysql> GRANT ALL ON vsftpd.* TO vsftpd@'%'IDENTIFIED BY 'passwd';

Query OK, 0 rows affected (0.00 sec)

mysql> use vsftpd

Database changed

建立表

mysql> create table users (

    ->id int AUTO_INCREMENT NOT NULL,

    ->name char(20) binary NOT NULL,

    ->password char(50) binary NOT NULL,

    ->primary key(id)

    ->);

Query OK, 0 rows affected (0.02 sec)

mysql> insert into users(name,password) values('xruan',password('xruan'));    插入1行用戶信息

Query OK, 1 row affected (0.00 sec)

mysql> insert into users(name,password) values('redhat',password('redhat'));    插入1行用戶信息

Query OK, 1 row affected (0.00 sec)

mysql> FLUSH PRIVILEGES;    刷新權限

Query OK, 0 rows affected (0.00 sec)

 

第3步：配置vsftpd基於MySQL表的虛擬用戶（在vsftp.xruan.com，192.168.0.12上執行）

首先必須完成基於MySQL表的認證，須要經過pam_mysql模塊實現，先安裝pam_mysql

先安裝epel源

到官方網站下載epel源的rpm安裝包

https://dl.fedoraproject.org/pub/epel/epel-release-latest-6.noarch.rpm

[root@CentOS6lsrv02 ~]# rpm -ivh epel-release-latest-6.noarch.rpm

[root@CentOS6lsrv02 ~]# yum install -y pam_mysql &> /dev/null

[root@CentOS6lsrv02 pam.d]# rpm -q pam_mysql

pam_mysql-0.7-0.12.rc1.el6.x86_64

 

創建pam認證所須要的配置文件（/etc/pam.d/vsftpd.mysql）

[root@CentOS6lsrv02 ~]# vi /etc/pam.d/vsftpd.mysql

auth required /lib64/security/pam_mysql.souser=vsftpd passwd=passwd host=192.168.0.11 db=vsftpd table=users usercolumn=name passwdcolumn=password crypt=2

account required /lib64/security/pam_mysql.souser=vsftpd passwd=passwd host=192.168.0.11 db=vsftpd table=users usercolumn=name passwdcolumn=password crypt=2

 

建立虛擬用戶映射的系統用戶

[root@CentOS6lsrv02 ~]# useradd -r -s /sbin/nologin vuser -d /var/ftproot

[root@CentOS6lsrv02 ~]# mkdir /var/ftproot

[root@CentOS6lsrv02 var]# chown vuser:vuser ftproot

編輯vsftpd配置文件 /etc/vsftpd/vsftpd.conf ，按以下設置：

listen=YES

anonymous_enable=YES

local_enable=YES

write_enable=YES

anon_upload_enable=NO

anon_mkdir_write_enable=NO

chroot_local_user=YES

guest_enable=YES

guest_username=vuser

pam_service_name=vsftpd.mysql

user_config_dir=/etc/vsftpd/vusers_config

 

爲每一個用戶單獨提供配置文件

user_config_dir=/etc/vsftpd/vusers_config  #在主配置文件（/etc/vsftpd/vsftpd.conf）中添加這個選項

[root@CentOS6lsrv02 vsftpd]# mkdir/etc/vsftpd/vusers_config

[root@CentOS6lsrv02 vsftpd]# vi vusers_config/xruan      #設置xruan用戶有全部權限

anon_upload_enable=YES

anon_mkdir_write_enable=YES

anon_other_write_enable=YES

[root@CentOS6lsrv02 vsftpd]# vi vusers_config/redhat     #設置redhat用戶只有upload權限

anon_upload_enable=YES

 

重啓vsftpd服務

[root@CentOS6lsrv02 vsftpd]# service vsftpd restart

Shutting down vsftpd:                                      [ OK  ]

Starting vsftpd for vsftpd:                                [  OK  ]

 

第4步：測試

[root@CentOS6lsrv02 vsftpd]# lftp -u xruan 192.168.0.12    <--使用xruan用戶登陸

Password:

lftp xruan@192.168.0.12:~> lcd /etc 

lcd ok, local cwd=/etc

lftp xruan@192.168.0.12:/> put fstab    <--能夠上傳文件

1224 bytes transferred

lftp xruan@192.168.0.12:~> rm fstab

rm ok, `fstab' removed   能夠刪除文件

 

[root@CentOS6lsrv02 vsftpd]# lftp -u redhat 192.168.0.12       <--使用redhat用戶登陸

Password:

lftp redhat@192.168.0.12:~> lcd /etc

lcd ok, local cwd=/etc lftp redhat@192.168.0.12:/>put selinux/config    <--能夠上傳文件

457 bytes transferred

lftp redhat@192.168.0.12:/> rm config

rm: Access failed: 550 Permission denied.(config)     <--不能刪除文件

到此，實驗成功！！！！！