Linux网络管理之六:vsftpd-2.0.5源代码安装和PAM使用 推荐

[root@AS4 ~]# rpm -qa | grep vsftpd
vsftpd-2.0.1-5.EL4.3
[root@AS4 ~]# rpm -e vsftpd-2.0.1-5.EL4.3 ---先删除原来的版本
---------------------------------------------------------
[root@AS4 src]# pwd
/usr/src
[root@AS4 src]# ls
kernels redhat vsftpd-2.0.5.tar.gz --------下载的源代码文件===============================================================
一、解压：

[root@AS4 src]# tar xvzf vsftpd-2.0.5.tar.gz ---解压下载的源文件
vsftpd-2.0.5/
vsftpd-2.0.5/oneprocess.h
vsftpd-2.0.5/ipaddrparse.h
……
vsftpd-2.0.5/BENCHMARKS
vsftpd-2.0.5/features.h
==================================================================
二、查看安装说明,作好相应的准备工作：

[root@AS4 src]# cd vsftpd-2.0.5
[root@AS4 vsftpd-2.0.5]# more INSTALL -----查看安装帮助文件
INSTALL
=======

This file details how to build and install / run vsftpd from the vsftpd
distribution .tar.gz file.

Step 1) Build vsftpd.[/b]

Switch to the directory created when you unpacked the vsftpd .tar.gz file.
e.g.:

cd vsftpd-1.1.2

edit "builddefs.h" to handle compile-time settings (tcp_wrappers build,ssl,etc).

Just type "make" (and mail me to fix it if it doesn't build ;-).
This should produce you a vsftpd binary. You can test for this, e.g.:

[chris@localhost vsftpd]$ ls -l vsftpd
-rwxrwxr-x 1 chris chris 61748 Sep 27 00:26 vsftpd ----编译后产生的二进制文件

Step 2) Satisfy vsftpd pre-requisites[/b]
2a) vsftpd needs the user "nobody" in the default configuration. Add this
user in case it does not already exist. e.g.:

[root@localhost root]# useradd nobody
useradd: user nobody exists

2b) vsftpd needs the (empty) directory /usr/share/empty in the default
configuration. Add this directory in case it does not already exist. e.g.:

[root@localhost root]# mkdir /usr/share/empty/
mkdir: cannot create directory `/usr/share/empty': File exists

2c) For anonymous FTP, you will need the user "ftp" to exist, and have a
valid home directory (which is NOT owned or writable by the user "ftp").
The following commands could be used to set up the user "ftp" if you do not
have one:

[root@localhost root]# mkdir /var/ftp/
[root@localhost root]# useradd -d /var/ftp ftp

(the next two are useful to run even if the user "ftp" already exists).
[root@localhost root]# chown root.root /var/ftp
[root@localhost root]# chmod og-w /var/ftp

Step 3) Install vsftpd config file, executable, man page, etc.[/b]

Running "make install" will try to copy the binary, man pages, etc. to
somewhere sensible.
……略……
You have new mail in /var/spool/mail/root
=============================================================================
创建必要的帐号和目录：

[root@AS4 ~]# useradd nobody
useradd: user nobody exists
[root@AS4 ~]# mkdir /usr/share/empty
mkdir: cannot create directory `/usr/share/empty': File exists
[root@AS4 ~]# mkdir /var/ftp
mkdir: cannot create directory `/var/ftp': File exists
[root@AS4 ~]# useradd -d /var/ftp ftp
useradd: user ftp exists
[root@AS4 ~]# chown root:root /var/ftp
[root@AS4 ~]# chmod og-w /var/ftp
======================================================
三、编译和安装

1、根据说明文档，首先要编辑一下 builddefs.h 文件。我们来看看他默认的选项都有什么，然后把需要的功能前面的undef 改成define，然后编译就可以用了。

[root@AS4 vsftpd-2.0.5]# cat builddefs.h
#ifndef VSF_BUILDDEFS_H
#define VSF_BUILDDEFS_H

#undef VSF_BUILD_TCPWRAPPERS
#define VSF_BUILD_PAM
#undef VSF_BUILD_SSL

#endif /* VSF_BUILDDEFS_H */

我们通过上面代码我们可以看到，ftp验证是通过pam方式来验证的，这是一种虚拟用户登录ftp的验证方式。这是vsftpd的一个安全的手段，通过pam方式，本地用户是没有办法登录到ftp上（但匿名ftp是能登录），这在事实上增强了系统的安全。

2、编译安装：

[root@AS4 vsftpd-2.0.5]# make;make install
gcc -c main.c -O2 -Wall -W -Wshadow -idirafter dummyinc
……
gcc -o vsftpd main.o utility.o prelogin.o ftpcmdio.o postlogin.o privsock.o tunables.o ftpdataio.o ……
ipaddrparse.o access.o features.o readwrite.o ssl.o sysutil.o sysdeputil.o -Wl,-s `./vsf_findlibs.sh`
if [ -x /usr/local/sbin ]; then \
install -m 755 vsftpd /usr/local/sbin/vsftpd; \
else \
install -m 755 vsftpd /usr/sbin/vsftpd; fi
……
if [ -x /etc/xinetd.d ]; then \
install -m 644 xinetd.d/vsftpd /etc/xinetd.d/vsftpd; fi

3、验证结果

1）查看一下make install将make编译好的二进制文件安装到了那个目录。
[root@AS4 ~]# which vsftpd
/usr/local/sbin/vsftpd

2）查看一下vsftpd的依赖库（如果您发现vsftpd所依赖的库有libpam的行，这说明您所编译的还是通过pam验证登录。）
[root@AS4 vsftpd-2.0.5]# ldd vsftpd
libwrap.so.0 => /usr/lib/libwrap.so.0 (0x03db6000)
libnsl.so.1 => /lib/libnsl.so.1 (0x00175000)
libpam.so.0 => /lib/libpam.so.0 (0x00b4b000) ----通过PAM进行验证
libdl.so.2 => /lib/libdl.so.2 (0x0088f000)
libresolv.so.2 => /lib/libresolv.so.2 (0x009dd000)
libutil.so.1 => /lib/libutil.so.1 (0x003b9000)
libcap.so.1 => /lib/libcap.so.1 (0x00111000)
libc.so.6 => /lib/tls/libc.so.6 (0x00763000)
libaudit.so.0 => /lib/libaudit.so.0 (0x00b6c000)
/lib/ld-linux.so.2 (0x0074a000)

4、要复制一些文件过去

[root@AS4 vsftpd-2.0.5]# cp vsftpd.conf /etc
[root@AS4 vsftpd-2.0.5]# cp vsftpd /usr/sbin
[root@AS4 vsftpd-2.0.5]# cp RedHat/vsftpd.pam /etc/pam.d/ftp ----用于pam认证的文件
==============================================================
四、配制/etc/vsftpd.conf

[root@AS4 vsftpd-2.0.5]# cp /etc/vsftpd.conf /etc/vsftpd.confBAK
在最后一行添加listen=YES 使服务器可以独立运行

[root@AS4 vsftpd-2.0.5]# /usr/local/sbin/vsftpd & ---服务后台运行并将控制台交还我们
[1] 3170 ----可把这一句写到/etc/rc.local文件中。
[root@AS4 vsftpd-2.0.5]# netstat -tnl | grep :21 ----可见已开始在21端口进行侦听
tcp 0 0 0.0.0.0:21 0.0.0.0:* LISTEN
===============================================
五、测试

[root@AS4 ~]# ftp localhost
Connected to AS4.SKY.COM.
220 (vsFTPd 2.0.5)
530 Please login with USER and PASS.
530 Please login with USER and PASS.
KERBEROS_V4 rejected as an authentication type
Name (localhost:root):anonymous -------匿名登录
331 Please specify the password.
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls
227 Entering Passive Mode (127,0,0,1,132,192)
150 Here comes the directory listing.
drwxr-xr-x 2 0 0 4096 Apr 09 09:15 pub
-rw-r--r-- 1 0 0 7 Apr 09 09:15 t1.txt
-rw-r--r-- 1 0 0 7 Apr 09 09:15 t2.txt
226 Directory send OK.
ftp> bye
221 Goodbye.
======================================================
六、建立虚拟帐号

由于ftp采用在网上以明文方式传送用户名和口令，这样帐号容易被窃取。为了防止因帐号的原因导致FTP服务器本身受到安全威胁，我们可以建立虚拟用户进行登录访问。

1、 建立虚拟帐号
[root@AS4 ~]# vi /home/vuser.txt
jack
123
bob
123
[root@AS4 ~]# id jack
id: jack: No such user ------可见系统中无此用户，其为虚拟用户
[root@AS4 ~]# id bob
id: bob: No such user

2、 为虚拟用户建立数据库文件
[root@AS4 ~]# db_load -T -t hash -f /home/vuser.txt /etc/vsftpd_login.db
[root@AS4 ~]# chmod 600 /etc/vsftpd_login.db

3、 修改/etc/pam.d/ftp文件
禁掉原文件中所有行，添加以下两行：
auth required pam_userdb.so db=/etc/vsftpd_login
account required pam_userdb.so db=/etc/vsftpd_login

4、 为虚拟用户创建映射帐号和登录主目录
[root@AS4 ~]# useradd vuser -----创建帐号同时自动在/home下创建vuser目录
[root@AS4 ~]# cp /etc/group /home/vuser -----拷一个文件进入这个目录

5、修改配置文件
[root@AS4 ~]# vi /etc/vsftpd.conf
# Example config file /etc/vsftpd.conf
……
# Allow anonymous FTP? (Beware - allowed by default if you comment this out).
anonymous_enable=NO ----禁止与匿名相关的所有项
#
# Uncomment this to allow local users to log in.
local_enable=YES
write_enable=NO
#
# Uncomment this to allow the anonymous FTP user to upload files. This only
……省略部分全部默认……
#ls_recurse_enable=YES
guest_enable=YES -----添加此行
guest_username=vuser -----添加此行
listen=YES

6、测试

[root@AS4 ~]# ftp localhost
Connected to AS4.SKY.COM.
220 (vsFTPd 2.0.5)
530 Please login with USER and PASS.
530 Please login with USER and PASS.
KERBEROS_V4 rejected as an authentication type
Name (localhost:root): anonymous
331 Please specify the password.
Password:
530 Login incorrect.
Login failed. -----匿名登录失败
ftp> use
(username) jack ----虚拟用户登录
331 Please specify the password.
Password:
230 Login successful. ----登录成功
ftp> ls
227 Entering Passive Mode (127,0,0,1,226,167)
150 Here comes the directory listing.
226 Transfer done (but failed to open directory). ----看不到文件列表，因虚拟用户进入后并没有vuser的全部权限，实际上还是匿名用户权限
ftp> get .bashrc ----测试一下可否下载
local: .bashrc remote: .bashrc
227 Entering Passive Mode (127,0,0,1,60,181)
150 Opening BINARY mode data connection for .bashrc (124 bytes).
WARNING! 8 bare linefeeds received in ASCII mode
File may not have transferred correctly.
226 File send OK. ----可以下载
124 bytes received in 0.005 seconds (24 Kbytes/s)

7、让虚拟用户可以看到文件列表

[root@AS4 ~]# ls -ld /home/vuser
drwx------ 3 vuser vuser 4096 Apr 10 19:54 /home/vuser ------其它用户和组没有权限
[root@AS4 ~]# chmod o+r /home/vuser
[root@AS4 ~]# cp /etc/group /home/vuser

8、再进行测试

[root@AS4 ~]# ftp localhost
Connected to AS4.SKY.COM.
220 (vsFTPd 2.0.5)
530 Please login with USER and PASS.
530 Please login with USER and PASS.
KERBEROS_V4 rejected as an authentication type
Name (localhost:root): jack
331 Please specify the password.
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls
227 Entering Passive Mode (127,0,0,1,122,110)
150 Here comes the directory listing.
-rw-r--r-- 1 0 0 710 Apr 10 12:22 group ----看到文件列表了
226 Directory send OK.
ftp>ftp> quit
221 Goodbye.

9、在Windows客户端进行访问
1）打开浏览器，输入ftp://10.0.0.254，并按要求输入用户名和口令。如下图所示：



2）访问结果如下：