vsftpd+ldap认证
2015-07-14 10:43
806 查看
一、环境
系统 CentOS 6.4x64最小化安装
IP 192.168.3.19
二、安装ldap
三、安装配置vsftp
本文出自 “ly36843运维” 博客，请务必保留此出处http://ly36843.blog.51cto.com/3120113/1673999
系统 CentOS 6.4x64最小化安装
IP 192.168.3.19
二、安装ldap
[root@test ~]# yum install openldap openldap-* -y [root@test ~]# yum install nscd nss-pam-ldapd nss-* pcre pcre-* -y配置ldap
[root@test ~]# cd /etc/openldap/ [root@test openldap]# cp /usr/share/openldap-servers/slapd.conf.obsolete slapd.conf [root@test openldap]# cp slapd.conf slapd.conf_`date +%Y%m%d`.bak [root@test openldap]# ll total 32 drwxr-xr-x. 2 root root 4096 Jul 14 09:48 certs -rw-r--r--. 1 root root 282 Jul 14 09:40 ldap.conf drwxr-xr-x 2 root root 4096 Jul 14 09:48 schema -rw-r--r-- 1 root root 4635 Jul 14 09:49 slapd.conf -rw-r--r-- 1 root root 4635 Jul 14 09:49 slapd.conf_20150714.bak drwx------ 3 ldap ldap 4096 Jul 14 09:48 slapd.d设置ldap管理员密码
[root@test openldap]# slappasswd -s weyee
{SSHA}+lnTFVa2PrStKgqt4SNFk4pl7Vo7QFUr
[root@test openldap]# slappasswd -s weyee|sed -e "s#{SSHA}#rootpw\t{SSHA}#g" >>/etc/openldap/slapd.conf
[root@test openldap]# tail -1 /etc/openldap/slapd.conf
rootpw {SSHA}d+rLMyEPKqcBroWW0vvazZ1+DRY2UmsP修改dc配置[root@test openldap]# vim /etc/openldap/slapd.conf #以下参数大概在114行 database bdb #使用bdb数据库 suffix "dc=test,dc=org" #定义dc，指定搜索的域 rootdn "cn=admin,dc=test,dc=org" #定义管理员的dn，使用这个dn能登陆openldap优化ldap配置参数
[root@test openldap]# vim /etc/openldap/slapd.conf loglevel 296 #定义日志级别 cachesize 1000 #换成条目数 checkpoint 2048 10 #表示内存中达到2048k或者10分钟，执行一次checkpoint，即写入数据文件的操作配置相关权限
[root@test openldap]# vim /etc/openldap/slapd.conf #删除默认权限，将下面的内容都删除 database config access to * by dn.exact="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" manage by * none # enable server status monitoring (cn=monitor) database monitor access to * by dn.exact="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" read by dn.exact="cn=Manager,dc=my-domain,dc=com" read by * none #添加新的权限(这是2.3的权限设置方式) access to * by self write by anonymous auth by * read配置syslog记录ldap的服务日志
[root@test openldap]# cp /etc/rsyslog.conf /etc/rsyslog.conf_`date +%Y%m%d`.bak #往配置文件中增加如下内容 [root@test openldap]# tail -1 /etc/rsyslog.conf local4.* /var/log/ldap.log #重启rsyslog服务 [root@test openldap]# /etc/init.d/rsyslog restart Shutting down system logger: [ OK ] Starting system logger: [ OK ]配置ldap数据库路径
#创建数据文件 [root@test openldap]# cp /usr/share/openldap-servers/DB_CONFIG.example /var/lib/ldap/DB_CONFIG [root@test openldap]# chown ldap.ldap /var/lib/ldap/DB_CONFIG [root@test openldap]# chmod 700 /var/lib/ldap/ [root@test openldap]# ll /var/lib/ldap/ total 4 -rw-r--r-- 1 ldap ldap 845 Jul 14 09:58 DB_CONFIG [root@test openldap]# egrep -v "\#|^$" /var/lib/ldap/DB_CONFIG set_cachesize 0 268435456 1 set_lg_regionmax 262144 set_lg_bsize 2097152 [root@test openldap]# slaptest -u #检查配置文件是否正常 config file testing succeeded启动ldap服务
[root@test ~]# /etc/init.d/slapd start Starting slapd: [ OK ] [root@test ~]# ps aux |grep ldap ldap 1700 0.0 1.6 490532 16592 ? Ssl 10:00 0:00 /usr/sbin/slapd -h ldap:/// ldapi:/// -u ldap root 1706 0.0 0.0 103240 868 pts/0 S+ 10:00 0:00 grep ldap [root@test ~]# netstat -tunlp |grep slapd tcp 0 0 0.0.0.0:389 0.0.0.0:* LISTEN 1700/slapd tcp 0 0 :::389 :::* LISTEN 1700/slapd #添加到开机自启动 [root@test ~]# chkconfig slapd on #查看日志文件 [root@test ~]# tail /var/log/ldap.log Jul 14 10:00:11 test slapd[1699]: @(#) $OpenLDAP: slapd 2.4.39 (Oct 15 2014 09:51:43) $#012#011mockbuild@c6b8.bsys.dev.centos.org:/builddir/build/BUILD/openldap-2.4.39/openldap-2.4.39/build-servers/servers/slapd查询一下ldap的内容
[root@test ~]# ldapsearch -LLL -W -x -H ldap://test.org -D "cn=admin,dc=test,dc=org" -b "dc=test,dc=org" "(udi=*)" Enter LDAP Password: ldap_bind: Invalid credentials (49) #这里报错 #解决如下，删除默认2.4的配置文件，重新生成2.3的配置文件 [root@test ~]# rm -rf /etc/openldap/slapd.d/* [root@test ~]# slaptest -f /etc/openldap/slapd.conf -F /etc/openldap/slapd.d/ 55a46df9 bdb_monitor_db_open: monitoring disabled; configure monitor database to enable config file testing succeeded [root@test ~]# ll /etc/openldap/slapd.d/ total 8 drwxr-x--- 3 root root 4096 Jul 14 10:03 cn=config -rw------- 1 root root 1302 Jul 14 10:03 cn=config.ldif #修改权限 [root@test ~]# chown -R ldap.ldap /etc/openldap/slapd.d/ #重启服务 [root@test ~]# /etc/init.d/slapd restart Stopping slapd: [ OK ] Starting slapd: [ OK ] #再次查询ldap内容 [root@test ~]# ldapsearch -LLL -W -x -H ldap://test.org -D "cn=admin,dc=test,dc=org" -b "dc=test,dc=org" "(udi=*)" Enter LDAP Password: #密码是上文中的weyee No such object (32) #ldap中还没有任何数据创建一个系统用户user1，设置密码user1
[root@test ~]# useradd user1 [root@test ~]# passwd user1 Changing password for user user1. New password: BAD PASSWORD: it is too short BAD PASSWORD: is too simple Retype new password: passwd: all authentication tokens updated successfully.安装migrationtools
[root@test ~]# yum install migrationtools -y编辑migrationtool的配置文件/usr/share/migrationtools/migrate_common.ph
[root@test ~]# vim /usr/share/migrationtools/migrate_common.ph # Default DNS domain $DEFAULT_MAIL_DOMAIN = "test.org"; # Default base $DEFAULT_BASE = "dc=test,dc=org";下面利用pl脚本将/etc/passwd 和/etc/shadow生成LDAP能读懂的文件格式，保存在/tmp/下
[root@test ~]# /usr/share/migrationtools/migrate_base.pl >/tmp/base.ldif [root@test ~]# /usr/share/migrationtools/migrate_passwd.pl /etc/passwd >/tmp/passwd.ldif [root@test ~]# /usr/share/migrationtools/migrate_passwd.pl /etc/group >/tmp/group.ldif下面就要把这三个文件导入到LDAP，这样LDAP的数据库里就有了我们想要的用户
#导入base [root@test ~]# ldapadd -x -D "cn=admin,dc=test,dc=org" -W -f /tmp/base.ldif Enter LDAP Password: adding new entry "dc=test,dc=org" adding new entry "ou=Hosts,dc=test,dc=org" adding new entry "ou=Rpc,dc=test,dc=org" adding new entry "ou=Services,dc=test,dc=org" adding new entry "nisMapName=netgroup.byuser,dc=test,dc=org" adding new entry "ou=Mounts,dc=test,dc=org" adding new entry "ou=Networks,dc=test,dc=org" adding new entry "ou=People,dc=test,dc=org" adding new entry "ou=Group,dc=test,dc=org" adding new entry "ou=Netgroup,dc=test,dc=org" adding new entry "ou=Protocols,dc=test,dc=org" adding new entry "ou=Aliases,dc=test,dc=org" adding new entry "nisMapName=netgroup.byhost,dc=test,dc=org" #导入passwd [root@test ~]# ldapadd -x -D "cn=admin,dc=test,dc=org" -W -f /tmp/passwd.ldif Enter LDAP Password: adding new entry "uid=root,ou=People,dc=test,dc=org" adding new entry "uid=bin,ou=People,dc=test,dc=org" adding new entry "uid=daemon,ou=People,dc=test,dc=org" adding new entry "uid=adm,ou=People,dc=test,dc=org" adding new entry "uid=lp,ou=People,dc=test,dc=org" adding new entry "uid=sync,ou=People,dc=test,dc=org" adding new entry "uid=shutdown,ou=People,dc=test,dc=org" adding new entry "uid=halt,ou=People,dc=test,dc=org" adding new entry "uid=mail,ou=People,dc=test,dc=org" adding new entry "uid=uucp,ou=People,dc=test,dc=org" adding new entry "uid=operator,ou=People,dc=test,dc=org" adding new entry "uid=games,ou=People,dc=test,dc=org" adding new entry "uid=gopher,ou=People,dc=test,dc=org" adding new entry "uid=ftp,ou=People,dc=test,dc=org" adding new entry "uid=nobody,ou=People,dc=test,dc=org" adding new entry "uid=dbus,ou=People,dc=test,dc=org" adding new entry "uid=vcsa,ou=People,dc=test,dc=org" adding new entry "uid=abrt,ou=People,dc=test,dc=org" adding new entry "uid=haldaemon,ou=People,dc=test,dc=org" adding new entry "uid=ntp,ou=People,dc=test,dc=org" adding new entry "uid=saslauth,ou=People,dc=test,dc=org" adding new entry "uid=postfix,ou=People,dc=test,dc=org" adding new entry "uid=sshd,ou=People,dc=test,dc=org" adding new entry "uid=tcpdump,ou=People,dc=test,dc=org" adding new entry "uid=ldap,ou=People,dc=test,dc=org" adding new entry "uid=nscd,ou=People,dc=test,dc=org" adding new entry "uid=nslcd,ou=People,dc=test,dc=org" adding new entry "uid=user1,ou=People,dc=test,dc=org" #导入group [root@test ~]# ldapadd -x -D "cn=admin,dc=test,dc=org" -W -f /tmp/group.ldif再次查询ldap的内容
[root@test ~]# ldapsearch -LLL -w weyee -x -H ldap://test.org -D "cn=admin,dc=test,dc=org" -b "dc=test,dc=org" "(uid=user1)" dn: uid=user1,ou=People,dc=test,dc=org uid: user1 cn: user1 objectClass: account objectClass: posixAccount objectClass: top objectClass: shadowAccount userPassword:: e2NyeXB0fSQxJEovVFNOUFhVJHdmWXhyN3MzdTNVa0NVN0h0WHlHVDA= shadowLastChange: 16630 shadowMin: 0 shadowMax: 99999 shadowWarning: 7 loginShell: /bin/bash uidNumber: 500 gidNumber: 500 homeDirectory: /home/user1安装配置ldap客户端phpladpadmin
[root@test ~]# rpm -ivh http://mirrors.ukfast.co.uk/sites/dl.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-8.noarch.rpm [root@test ~]# yum install phpldapadmin -y配置Apache's phpLDAPadmin的配置文件
[root@test ~]# vim /etc/httpd/conf.d/phpldapadmin.conf <Directory /usr/share/phpldapadmin/htdocs> Order Allow,Deny Allow from all Allow from 127.0.0.1 Allow from ::1 Allow from 192.168.3.0 </Directory>禁用自动登录
[root@test ~]# vim /etc/phpldapadmin/config.php
#(line 398)
//$servers->setValue('login','attr','uid');启动httpd服务[root@test ~]# service httpd start Starting httpd: [ OK ]通过web界面访问ldap地址是http://192.168.3.19/ldapadmin/
三、安装配置vsftp
[root@test ~]# yum install vsftpd -y修改pam_ldap配置文件
[root@test ~]# vim /etc/pam_ldap.conf host 192.168.3.19 # The distinguished name of the search base. base dc=test,dc=org #uri ldap://192.168.3.19 binddn cn=admin,dc=test,dc=org bindpw weyee #修改文件/etc/pam.d/vsftpd.vu [root@test ~]# vim /etc/pam.d/vsftpd.vu auth required pam_ldap.so account required pam_ldap.so编辑vsftpd配置文件
[root@test ~]# vim /etc/vsftpd/vsftpd.conf nonymous_enable=NO #不允许匿名用户访问 anon_upload_enable=YES anon_mkdir_write_enable=YES #开启这项和上一项才能上传文件和文件夹 chroot_local_user=YES guest_enable=YES #设定启用虚拟用户功能 guest_username=ftp #指定虚拟用户的宿主用户 pam_service_name=vsftpd.vu #设定PAM服务下Vsftpd的验证配置文件名。 local_root=/data启动vsftpd服务
[root@test ~]# /etc/init.d/vsftpd start Starting vsftpd for vsftpd: [ OK ] [root@test ~]# yum install ftp -y [root@test ~]# chown -R ftp.ftp /data/测试，在ldap中创建用户ldapftp，设置密码ldapftp
#查看ldapftp用户 [root@test ~]# ldapsearch -LLL -w weyee -x -H ldap://test.org -D "cn=admin,dc=test,dc=org" -b "dc=test,dc=org" "(uid=ldapftp)" dn: uid=ldapftp,ou=People,dc=test,dc=org objectClass: posixAccount objectClass: top objectClass: inetOrgPerson gidNumber: 0 givenName: ldapftp sn: ldapftp uid: ldapftp homeDirectory: /home/ldapftp cn: ldapftp uidNumber: 5355 userPassword:: e1NIQX1XZnNSS0U1dlVhR0xma0lINlFqU0F2VDJqU1U9 [root@test ~]# id ldapftp id: ldapftp: No such user #从上面的结果能看出ldapftp用户只有ldap数据库中才有 #测试访问ftp [root@test ~]# ftp 127.0.0.1 Connected to 127.0.0.1 (127.0.0.1). 220 (vsFTPd 2.2.2) Name (127.0.0.1:root): ldapftp #输入用户ldapftp 331 Please specify the password. Password: 230 Login successful. #这里显示登陆成功 Remote system type is UNIX. Using binary mode to transfer files. ftp> ls 227 Entering Passive Mode (127,0,0,1,151,90). 150 Here comes the directory listing. -rw-r--r-- 1 0 0 0 Jul 14 03:05 1.txt -rw-r--r-- 1 0 0 0 Jul 14 03:05 2.txt drwx------ 2 14 50 4096 Jul 14 03:07 新文件夹 226 Directory send OK.我们再次创建一个ldap用户test，密码test
[root@test ~]# id test id: test: No such user [root@test ~]# ldapsearch -LLL -w weyee -x -H ldap://test.org -D "cn=admin,dc=test,dc=org" -b "dc=test,dc=org" "(uid=test)" dn: uid=test,ou=People,dc=test,dc=org objectClass: posixAccount objectClass: top objectClass: inetOrgPerson gidNumber: 0 givenName: test sn: test uid: test homeDirectory: /home/test cn: test uidNumber: 41881 userPassword:: e1NIQX1xVXFQNWN5eG02WWNUQWh6MDVIcGg1Z3Z1OU09 #上面结果表明test用户只存在于ldap中 #用test访问ftp [root@test ~]# ftp 127.0.0.1 Connected to 127.0.0.1 (127.0.0.1). 220 (vsFTPd 2.2.2) Name (127.0.0.1:root): test 331 Please specify the password. Password: 230 Login successful. Remote system type is UNIX. Using binary mode to transfer files. ftp> ls 227 Entering Passive Mode (127,0,0,1,208,151). 150 Here comes the directory listing. -rw-r--r-- 1 0 0 0 Jul 14 03:05 1.txt -rw-r--r-- 1 0 0 0 Jul 14 03:05 2.txt drwx------ 2 14 50 4096 Jul 14 03:07 新文件夹 226 Directory send OK.到这里vsftpd+ldap的配置已完成
本文出自 “ly36843运维” 博客，请务必保留此出处http://ly36843.blog.51cto.com/3120113/1673999
内容来自用户分享和网络整理，不保证内容的准确性，如有侵权内容，可联系管理员处理 
相关文章推荐
- php页面出现空白解决方法
- 什么时候PHP经验MySQL存储过程
- 安装和使用php的mcrypt扩展
- PHP传值和传引用、传地址的区别
- PHP编译原理之Opcode
- php不良岗位特征
- 从框架看PHP的五种境界及各自的薪资待遇
- PHP "Warning: Unknown: failed to open stream: Permission denied in Unknown on line 0" 错误
- Composer 因SSL出错而无法更新的解决办法
- laravel 关于图片路径问题的一个坑
- php算法实例分享
- php生成数字字母的验证码图片
- 浅谈php的优缺点
- 浅谈php错误提示及查错方法
- php实现网页缓存的工具类分享
- PHP书写规范 匈牙利命名法+驼峰法命名
- THINK PHP 2.2 _STORAGE_WRITE_ERROR_ 问题解决方案
- PHP报错日志配置
- PHP源码安装
- 开启我的PHP学习之旅