1、实现基于MYSQL验证的vsftpd虚拟用户访问
FTP服务器：192.168.45.202
数据库服务器：192.168.45.203
1. FTP服务器安装ftp、pam_mysql
[root@s202 ~]# yum install vsftpd -y
对于centos7，pam_mysql需要编译安装
首先下载pam_mysql
[root@s202 src]# wget http://prdownloads.sourceforge.net/pam-mysql/pam_mysql-0.7RC1.tar.gz
解压pam_mysql
[root@s202 src]# tar xvf pam_mysql-0.7RC1.tar.gz
安装依赖包，然后对pam_mysql进行编译安装
[root@s202 pam_mysql-0.7RC1]# yum -y groupinstall "Development Tools"
[root@s202 pam_mysql-0.7RC1]# yum -y install mariadb-devel pam-devel
[root@s202 pam_mysql-0.7RC1]# ./configure --with-pam-mods-dir=/lib64/security --with-mysql=/usr --with-pam=/usr
[root@s202 pam_mysql-0.7RC1]# make && make install
/bin/sh ./libtool --mode=compile gcc -DHAVE_CONFIG_H -I. -I. -I. -I/usr/include/security -I/usr/include -g -O2 -g -O2 -I/usr/include/mysql -c pam_mysql.c
mkdir .libs
gcc -DHAVE_CONFIG_H -I. -I. -I. -I/usr/include/security -I/usr/include -g -O2 -g -O2 -I/usr/include/mysql -c pam_mysql.c -fPIC -DPIC -o .libs/pam_mysql.o
pam_mysql.c: In function 'pam_mysql_converse':
pam_mysql.c:3192:4: warning: passing argument 2 of 'conv->conv' from incompatible pointer type [enabled by default]
conv->appdata_ptr))) {
^
pam_mysql.c:3192:4: note: expected 'const struct pam_message **' but argument is of type 'struct pam_message **'
/bin/sh ./libtool --mode=link gcc -g -O2 -I/usr/include/mysql -o pam_mysql.la -rpath /lib64/security -module -avoid-version pam_mysql.lo -L/usr/lib64/mysql -lmysqlclient -lpthread -lz -lm -ldl -lssl -lcrypto -lcrypt
gcc -shared .libs/pam_mysql.o -L/usr/lib64/mysql -lmysqlclient -lpthread -lz -lm -ldl -lssl -lcrypto -lcrypt -Wl,-soname -Wl,pam_mysql.so -o .libs/pam_mysql.so
creating pam_mysql.la
(cd .libs && rm -f pam_mysql.la && ln -s ../pam_mysql.la pam_mysql.la)
make[1]: Entering directory `/usr/local/src/pam_mysql-0.7RC1'
/bin/sh ./mkinstalldirs /lib64/security
/bin/sh ./libtool --mode=install /usr/bin/install -c pam_mysql.la /lib64/security/pam_mysql.la
/usr/bin/install -c .libs/pam_mysql.so /lib64/security/pam_mysql.so
/usr/bin/install -c .libs/pam_mysql.lai /lib64/security/pam_mysql.la
PATH="$PATH:/sbin" ldconfig -n /lib64/security
----------------------------------------------------------------------
Libraries have been installed in:
/lib64/security
If you ever happen to want to link against installed libraries
in a given directory, LIBDIR, you must either use libtool, and
specify the full pathname of the library, or use the `-LLIBDIR'
flag during linking and do at least one of the following:
- add LIBDIR to the `LD_LIBRARY_PATH' environment variable
during execution
- add LIBDIR to the `LD_RUN_PATH' environment variable
during linking
- use the `-Wl,--rpath -Wl,LIBDIR' linker flag
- have your system administrator add LIBDIR to `/etc/ld.so.conf'
See any operating system documentation about shared libraries for
more information, such as the ld(1) and ld.so(8) manual pages.
----------------------------------------------------------------------
make[1]: Nothing to be done for `install-data-am'.
make[1]: Leaving directory `/usr/local/src/pam_mysql-0.7RC1'
[root@s202 pam_mysql-0.7RC1]# ll /lib64/security/pam_mysql.*
-rwxr-xr-x 1 root root 882 Sep 12 00:18 /lib64/security/pam_mysql.la
-rwxr-xr-x 1 root root 141720 Sep 12 00:18 /lib64/security/pam_mysql.so
2. 数据库服务器安装数据库，并创建虚拟账号
[root@s203 ~]# yum install mariadb-server -y
[root@s203 ~]# systemctl start mariadb
[root@s203 ~]# systemctl enable mariadb
Created symlink from /etc/systemd/system/multi-user.target.wants/mariadb.service to /usr/lib/systemd/system/mariadb.service.
登录数据库，创建数据库及账号
MariaDB [(none)]> create database vsftpd;
Query OK, 1 row affected (0.00 sec)
MariaDB [(none)]> grant select on vsftpd.* to vsftpd@'192.168.45.*' identified by 'qwe123';
Query OK, 0 rows affected (0.00 sec)
创建数据表，并创建虚拟用户
MariaDB [(none)]> use vsftpd;
Database changed
MariaDB [vsftpd]> create table user (id int auto_increment not null primary key,name char(50) binary not null,password char(48) binary not null);
Query OK, 0 rows affected (0.00 sec)
MariaDB [vsftpd]> desc users;
ERROR 1146 (42S02): Table 'vsftpd.users' doesn't exist
MariaDB [vsftpd]> desc user;
+----------+----------+------+-----+---------+----------------+
| Field | Type | Null | Key | Default | Extra |
+----------+----------+------+-----+---------+----------------+
| id | int(11) | NO | PRI | NULL | auto_increment |
| name | char(50) | NO | | NULL | |
| password | char(48) | NO | | NULL | |
+----------+----------+------+-----+---------+----------------+
3 rows in set (0.00 sec)
MariaDB [vsftpd]> insert into user(name,password) values ('yyt',password('qwe123'));
Query OK, 1 row affected (0.00 sec)
MariaDB [vsftpd]> insert into user(name,password) values ('mm',password('qwe123'));
Query OK, 1 row affected (0.00 sec)
MariaDB [vsftpd]> select * from user;
+----+------+-------------------------------------------+
| id | name | password |
+----+------+-------------------------------------------+
| 1 | yyt | *8DCDD69CE7D121DE8013062AEAEB2A148910D50E |
| 2 | mm | *8DCDD69CE7D121DE8013062AEAEB2A148910D50E |
+----+------+-------------------------------------------+
2 rows in set (0.00 sec)
3. 在FTP服务器上配置vsftpd服务
1.在FTP服务器上建立pam认证所需文件
vim /etc/pam.d/vsftpd.mysql 添加如下两行
auth required pam_mysql.so user=vsftpd passwd=qwe123 host=192.168.45.203 db=vsftpd table=user usercolumn=name passwdcolumn=password crypt=2
account required pam_mysql.so user=vsftpd passwd=qwe123 host=192.168.45.203 db=vsftpd table=user usercolum n=name passwdcolumn=password crypt=2
2.建立相应用户和修改vsftpd配置文件，使其适应mysql认证
建立虚拟用户映射的系统用户及对应的目录
[root@s202 pam_mysql-0.7RC1]# useradd -s /sbin/nologin -d /var/ftproot vuser
[root@s202 pam_mysql-0.7RC1]# chmod 555 /var/ftproot/
[root@s202 pam_mysql-0.7RC1]# mkdir /var/ftproot/{upload,pub} -pv
mkdir: created directory ‘/var/ftproot/upload’
mkdir: created directory ‘/var/ftproot/pub’
[root@s202 pam_mysql-0.7RC1]# setfacl -m u:vuser:rwx /var/ftproot/upload/
检查修改/etc/vsftpd.conf
（1）确保/etc/vsftpd.conf中已经启用了以下选项
anonymous_enable=YES
（2）添加下面两项
guest_enable=YES
guest_username=vuser
（3）修改下面一项，原系统用户无法登录
pam_service_name=vsftpd.mysql
4. 启动ftp，并进行测试
启动FTP
[root@s202 pam_mysql-0.7RC1]# systemctl start vsftpd
测试
root@ubuntu:~# ftp 192.168.45.202
Connected to 192.168.45.202.
220 (vsFTPd 3.0.2)
Name (192.168.45.202:root): yyt
331 Please specify the password.
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls
200 PORT command successful. Consider using PASV.
150 Here comes the directory listing.
drwxr-xr-x 2 0 0 6 Sep 11 16:40 pub
drwxrwxr-x 2 0 0 6 Sep 11 16:40 upload
226 Directory send OK.
2、通过NFS实现服务器/www共享访问。
1.CentOS7中带有NFS服务，直接启动即可
[root@s202 ~]# systemctl start nfs-server
[root@s202 ~]# systemctl enable nfs-server
2.创建要分享的目录，并授权
[root@s202 ~]# mkdir /www
[root@s202 ~]# chown nfsnobody /data
3.编辑共享配置文件
[root@s202 ~]# cat /etc/exports
/www 192.168.45.0/24(rw)
4.重读配置文件使共享生效
[root@s202 ~]# exportfs -r
[root@s202 ~]# showmount -e #查看服务端共享是否存在
Export list for s202:
/www 192.168.45.0/24
5.在客户端进行挂载测试
root@ubuntu:/# mkdir /www
root@ubuntu:/# mount -t nfs 192.168.45.202:/www /www
mount: /data: bad option; for several filesystems (e.g. nfs, cifs) you might need a /sbin/mount.<type> helper program.
客户端挂载时报错，在Ubuntu环境下安装nfs-common包即可
root@ubuntu:/# apt-get install nfs-common
安装完成后重新挂载
root@ubuntu:/# mount -t nfs 192.168.45.202:/www /www
root@ubuntu:/# df -h
Filesystem Size Used Avail Use% Mounted on
udev 955M 0 955M 0% /dev
tmpfs 198M 9.6M 188M 5% /run
/dev/sda1 196G 4.2G 182G 3% /
tmpfs 986M 0 986M 0% /dev/shm
tmpfs 5.0M 0 5.0M 0% /run/lock
tmpfs 986M 0 986M 0% /sys/fs/cgroup
tmpfs 197M 0 197M 0% /run/user/0
overlay 196G 4.2G 182G 3% /var/lib/docker/overlay2/82eb04b48975cc18ee8b9b51c58f4e2d77b847ac2349361952e4600d5a8c1330/merged
shm 64M 0 64M 0% /var/lib/docker/containers/d205ac0909bea88b9fdef109d0cc3828a240b04744eca21cd128f554018f9d83/mounts/shm
192.168.45.202:/www 50G 33M 50G 1% /www
root@ubuntu:/# cd /www/
root@ubuntu:/www# ls
nginx
到此共享设置完成，如果想要永久挂载，则需要在/etc/fstab文件中添加挂载即可
vim /etc/fstab
# /etc/fstab: static file system information.
#
# Use 'blkid' to print the universally unique identifier for a
# device; this may be used with UUID= as a more robust way to name devices
# that works even if disks are added and removed. See fstab(5).
#
# <file system> <mount point> <type> <options> <dump> <pass>
# / was on /dev/sda1 during installation
UUID=0e817721-c384-48ca-ac25-acdaaa2cc2e8 / ext4 errors=remount-ro 0 1
/swapfile none swap sw 0 0
192.168.45.202:/www /www nfs defaults 0 0
mount -a 使挂载生效即可
3、配置samba共享，实现/www目录共享
1、在samba服务器上安装samba包
[root@s202 ~]# yum -y install samba
2、创建samba用户组和用户
[root@s202 ~]# groupadd -r admins
[root@s202 ~]# useradd -s /sbin/nologin -G admins mm
[root@s202 ~]# smbpasswd -a mm
New SMB password:
Retype new SMB password:
Added user mm.
[root@s202 ~]# useradd -s /sbin/nologin yuan
[root@s202 ~]# smbpasswd -a yuan
New SMB password:
Retype new SMB password:
Added user yuan.
3、创建samba共享目录
[root@s202 ~]# mkdir /www
[root@s202 ~]# chgrp admins /www
[root@s202 ~]# chmod 2775 /www
4、samba服务器配置，设置允许admins组中的用户创建、编辑共享目录文件
vim /etc/samba/smb.conf
[global]
workgroup = SAMBA
security = user
passdb backend = tdbsam
[share]
path = /www
write list = @admins
5、启动服务
[root@s202 ~]# systemctl start smb nmb
[root@s202 ~]# systemctl enable smb nmb
Created symlink from /etc/systemd/system/multi-user.target.wants/smb.service to /usr/lib/systemd/system/smb.service.
Created symlink from /etc/systemd/system/multi-user.target.wants/nmb.service to /usr/lib/systemd/system/nmb.service.
6、在客户端测试
安装cifs-utils包
root@ubuntu:~# apt-get -y install cifs-utils
root@ubuntu:~# mkdir /www/mm
root@ubuntu:~# mount -o username=mm //192.168.45.202/share /www/mm
Password for mm@//192.168.45.202/share: ******
root@ubuntu:~# echo hello mm > /www/mm/mmfile.txt
root@ubuntu:~# cat /www/mm/mmfile.txt
hello mm
#由于yuan用户不在admins用户组中，所以yuan不能编辑、创建文件
root@ubuntu:~# mkdir /www/yuan
root@ubuntu:~# mount -o username=yuan //192.168.45.202/share /www/yuan
Password for yuan@//192.168.45.202/share: ******
root@ubuntu:~# echo hello yuan > /www/yuan/yuanfile.txt
-bash: /www/yuan/yuanfile.txt: Permission denied
4、使用rsync+inotify实现/www目录实时同步
数据服务器：192.168.45.202
备份服务器：192.168.45.203
1、在数据服务器端安装inotify-tools（需要epel源）
[root@s202 ~]# yum -y install inotify-tools
2、在备份服务器端配置rsyncd.conf文件
vim /etc/rsyncd.conf
uid = root
gid = root
use chroot = no
max connections = 0
ignore errors
exclude = lost+found/
log file = /var/log/rsyncd.log
pid file = /var/run/rsyncd.pid
lock file = /var/run/rsyncd.lock
reverse lookup = no
hosts allow = 192.168.45.0/24
[backup]
path = /backup/
comment = backup
read only = no
auth users = rsyncuser
secrets file = /etc/rsync.pass
3、在备份服务器端生成验证文件
[root@s203 ~]# echo "rsyncuser:qwe123" > /etc/rsync.pass
[root@s203 ~]# chmod 600 /etc/rsync.pass
4、在备份服务器端创建备份数据存放目录，并启动rsync服务
[root@s203 ~]# mkdir /backup
[root@s203 ~]# systemctl start rsyncd
5、在数据服务器端配置密码文件，并测试数据同步
[root@s202 ~]# echo "qwe123"> /etc/rsync.pass
[root@s202 ~]# chmod 600 /etc/rsync.pass
[root@s202 ~]# rsync -avz --password-file=/etc/rsync.pass /data/www/ rsyncuser@192.168.45.203::backup
6、在数据服务器端创建监控脚本
[root@s202 data]# vim inotify_rsync.sh
[root@s202 data]# cat inotify_rsync.sh
#!/bin/bash
SRC='/data/www/'
DEST='rsyncuser@192.168.45.203::backup'
inotifywait -mrq --timefmt '%Y-%m-%d %H:%M' --format '%T %w %f' -e create,delete,moved_to,close_write,attrib ${SRC} |while read DATE TIME DIR FILE;do
FILEPATH=${DIR}${FILE}
rsync -az --delete --password-file=/etc/rsync.pass $SRC $DEST && echo "At ${TIME} on ${DATE}, file $FILEPATH was backuped up via rsync" >> /var/log/changelist.log
done
7、添加执行权限，并运行测试效果
[root@s202 data]# chmod +x inotify_rsync.sh
[root@s202 data]# ./inotify_rsync.sh
在备份服务器端监控同步效果
[root@s202 data]# watch -n1 ls -l /backup
测试同步成功
5、使用iptable实现: 放行telnet, ftp, web服务,放行samba服务,其他端口服务全部拒绝
- 开放telnet
[root@centos7 ~]# iptables -A INPUT -p tcp --dport 23 -j ACCEPT - 开放ftp
修改/etc/sysconfig/iptables-config
IPTABLES_MODULES="nf_conntrack_ftp"
[root@centos7 ~]# modproble nf_conntrack_ftp
[root@centos7 ~]# iptables -A INPUT -p tcp -m state --state ESTABLISHED,RELATED -j ACCEPT
[root@centos7 ~]# iptables -A INPUT -p tcp --dport 21 -m state --state NEW -j ACCEPT
- 开放web，默认端口80
[root@centos7 ~]# iptables -A INPUT -p tcp --dport 80 -j ACCEPT - 开放samba
tcp端口139,445，udp端口137,138
[root@centos7 ~]# iptables -A INPUT -p tcp -m multiport --dports 139,445 -j ACCEPT
[root@centos7 ~]# iptables -A INPUT -p udp -m multiport --dports 137,138 -j ACCEPT
- 禁用其它所有
[root@centos7 ~]# iptables -A INPUT -j REJECT
[root@centos7 ~]# iptables -vnL
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:23
679 54856 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:21 state NEW
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:80
197 11820 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 multiport dports 139,445
3 702 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 multiport dports 137,138
0 0 REJECT all -- * * 0.0.0.0/0 0.0.0.0/0 reject-with icmp-port-unreachable
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 6 packets, 644 bytes)
pkts bytes target prot opt in out source destination
