3.6. vsftpd基于文件的验证
3.6.1. 安装vsftpd
1[root@centos-7 vsftpd]$yum install vsftpd
2[root@centos-7 vsftpd]$yum install libdb-utils
3.6.2. 制作db文件
1root@centos-7 certs]$cd /etc/vsftpd/
2# 用户一行是用户一行是密码。
3[root@centos-7 vsftpd]$vim dbusers.txt
4[root@centos-7 vsftpd]$cat dbusers.txt
5user1
6p1
7user2
8p2
9user3
10p3
11[root@centos-7 vsftpd]$db_load -T -t hash -f dbusers.txt dbusers.db
12[root@centos-7 vsftpd]$ll
13total 32
14-rw-r--r--. 1 root root 12288 Feb 3 18:29 dbusers.db
15-rw-r--r--. 1 root root 21 Feb 3 18:29 dbusers.txt
16-rw-------. 1 root root 125 Aug 3 2017 ftpusers
17-rw-------. 1 root root 361 Aug 3 2017 user_list
18-rw-------. 1 root root 5214 Feb 3 18:27 vsftpd.conf
19-rwxr--r--. 1 root root 338 Aug 3 2017 vsftpd_conf_migrate.sh
20[root@centos-7 vsftpd]$chmod 600 dbusers.*
3.6.3. 添加虚拟映射用户
1[root@centos-7 vsftpd]$useradd -d /data/dbuser -s /sbin/nologin dbuser
2[root@centos-7 vsftpd]$chmod a-w /data/dbuser/
3[root@centos-7 vsftpd]$mkdir /data/dbuser/{pub,upload}
4[root@centos-7 vsftpd]$setfacl -m u:dbuser:rwx /data/dbuser/dupload
5setfacl: /data/dbuser/dupload: No such file or directory
6[root@centos-7 vsftpd]$setfacl -m u:dbuser:rwx /data/dbuser/upload
7[root@centos-7 vsftpd]$setfacl -m u:dbuser:rx /data/dbuser/pub
3.6.4. 编辑配置文件
添加pam配置文件
1[root@centos-7 vsftpd]$vim /etc/pam.d/vsftpd.db
2[root@centos-7 vsftpd]$cat /etc/pam.d/vsftpd.db
3auth required pam_userdb.so db=/etc/vsftpd/dbusers
4account required pam_userdb.so db=/etc/vsftpd/dbusers
vsftpd配置文件
1[root@centos-7 vsftpd]$vim vsftpd.conf
2# 添加如下3行
3pam_service_name=vsftpd.db
4guest_enable=YES
5guest_username=dbuser
3.6.5. 测试
重启服务
1[root@centos-7 vsftpd]$systemctl restart vsftpd
虚拟用户登陆
1[root@centos-7 vsftpd]$ftp 172.18.46.7
2Connected to 172.18.46.7 (172.18.46.7).
3220 (vsFTPd 3.0.2)
4Name (172.18.46.7:root): user1
5331 Please specify the password.
6Password:
7230 Login successful.
8Remote system type is UNIX.
9Using binary mode to transfer files.
10ftp> quit
11221 Goodbye.
3.6.6. 用户单独配置
编辑配置文件
1[root@centos-7 vsftpd]$vim vsftpd.conf
2# 添加下面一行
3user_config_dir=/etc/vsftpd/dbuser.conf.d
4
5[root@centos-7 vsftpd]$mkdir /etc/vsftpd/dbuser.conf.d
6[root@centos-7 vsftpd]$cd /etc/vsftpd/dbuser.conf.d
7[root@centos-7 dbuser.conf.d]$vim user1
8[root@centos-7 dbuser.conf.d]$cat user1
9anon_upload_enable=YES
10anon_mkdir_write_enable=YES
重启服务
1[root@centos-7 dbuser.conf.d]$systemctl restart vsftpd
测试user1用户
1[root@centos-7 dbuser.conf.d]$ftp 172.18.46.7
2Connected to 172.18.46.7 (172.18.46.7).
3220 (vsFTPd 3.0.2)
4Name (172.18.46.7:root): user1
5331 Please specify the password.
6Password:
7230 Login successful.
8Remote system type is UNIX.
9Using binary mode to transfer files.
10ftp> ls
11227 Entering Passive Mode (172,18,46,7,56,108).
12150 Here comes the directory listing.
13drwxr-xr-x 2 0 0 4096 Feb 03 10:57 pub
14drwxrwxr-x 2 0 0 4096 Feb 03 10:57 upload
15226 Directory send OK.
16ftp> cd upload
17250 Directory successfully changed.
18ftp> !ls
19user1
20ftp> !lcd /root
21+bash: lcd: command not found
22ftp> lcd /root
23Local directory now /root
24ftp> !ls
2511.txt 11.txt.gpg 1gb.file 20-nproc.conf abc.awk anaconda-ks.cfg app a.txt bin centos74.magedu.com.txt Desktop Documents Downloads file1 file2 Music Pictures Public Templates test.sh test.txt usr Videos
26ftp> put 11.txt
27local: 11.txt remote: 11.txt
28227 Entering Passive Mode (172,18,46,7,28,173).
29150 Ok to send data.
30226 Transfer complete.
314 bytes sent in 0.0351 secs (0.11 Kbytes/sec)
32ftp> quit
33221 Goodbye.
测试user1用户
1[root@centos-7 dbuser.conf.d]$ftp 172.18.46.7
2Connected to 172.18.46.7 (172.18.46.7).
3220 (vsFTPd 3.0.2)
4Name (172.18.46.7:root): user2
5331 Please specify the password.
6Password:
7230 Login successful.
8Remote system type is UNIX.
9Using binary mode to transfer files.
10ftp> cd upload
11250 Directory successfully changed.
12ftp> lcd /root
13Local directory now /root
14ftp> !ls
1511.txt 11.txt.gpg 1gb.file 20-nproc.conf abc.awk anaconda-ks.cfg app a.txt bin centos74.magedu.com.txt Desktop Documents Downloads file1 file2 Music Pictures Public Templates test.sh test.txt usr Videos
16ftp> put 11.txt
17local: 11.txt remote: 11.txt
18227 Entering Passive Mode (172,18,46,7,23,214).
19550 Permission denied.
20ftp> quit
21221 Goodbye.
可以看出来，user1是因为有了特定的配置就具有了上传权限，user2没有特定的配置，使用默认的配置没有上传权限。