用OpenLDAP服务器登录FTP服务

• 环境准备

虚拟机：NAT模式

系统：CentOS6.5

主机IP：192.168.213.131

• 安装ftp服务和ldap模板

yum -y install vsftpd ftp

yum -y install nss-pam-ldapd pam_ldap

• 配置各个文件

1.编辑连接OpenLDAP服务器

vi /etc/pam_ldap.conf

 host 192.168.213.131

 base dc=lulu,dc=com

 binddn cn=Manager,dc=lulu,dc=com

 bindpw 123456

2.编辑vsftpd的配置文件

vi /etc/vsftpd/vsftpd.conf

 anonymous_enable=NO

 anon_mkdir_write_enable=YES

 anon_upload_enable=YES

chroot_local_user=YES

guest_enable=YES

guest_username=ftp

local_root=/data

3.编辑vsftpd支持openldap服务器模块

vi /etc/ etc/pam.d/vsftpd

#%PAM-1.0

session    optional     pam_keyinit.so    force revoke

session    optional     pam_ldap.so

auth      sufficient     pam_ldap.so

auth      required      pam_listfile.so item=user sense=deny file=/etc/vsftpd/ftpusers onerr=succeed

auth      required      pam_shells.so

auth      include        password-auth

account   sufficient     pam_ldap.so

account   include        password-auth

session    required     pam_loginuid.so

session    include        password-auth

password  required     pam_ldap.so

• 服务启动和测试vsftpd客户端

1.启动vsftp服务

/etc/init.d/vsftpd start

chkconfig vsftpd on

2.测试vsftpd客户端

  ftp 127.0.0.1

1. 测试本地用户

[root@localhost ~]# grep test2 /etc/passwd

test2:x:502:502::/home/test2:/bin/bash

连接成功

[root@localhost ~]# ftp 127.0.0.1

Connected to 127.0.0.1 (127.0.0.1).

220 (vsFTPd 2.2.2)

Name (127.0.0.1:root): test2

331 Please specify the password.

Password:

230 Login successful.

Remote system type is UNIX.

Using binary mode to transfer files.

1. 测试openldap用户

    ldapsearch -x -b "dc=lulu,dc=com"

# test1, People, lulu.com

dn: uid=test1,ou=People,dc=lulu,dc=com

uid: test1

cn: test1

objectClass: account

objectClass: posixAccount

objectClass: top

objectClass: shadowAccount

shadowLastChange: 17491

shadowMin: 0

shadowMax: 99999

shadowWarning: 7

loginShell: /bin/bash

uidNumber: 502

gidNumber: 502

homeDirectory: /home/test1

userPassword:: e1NTSEF9ZUxkMWNpaWkxUGxpdExUNWViUHVuQSs3bkJqRFRFYTI=  

连接成功

[root@localhost ~]# ftp 127.0.0.1

Connected to 127.0.0.1 (127.0.0.1).

220 (vsFTPd 2.2.2)

Name (127.0.0.1:root): test1

331 Please specify the password.

Password:

230 Login successful.

Remote system type is UNIX.

Using binary mode to transfer files.

• 为不同的用户设置不同的访问目录

1.在/etc/vsftpd/vsftpd.conf里添加配置

user_config_dir=/etc/vsftpd/userconfig

2.在userconfig目录下用用户名命名编写配置文件

   1)test1用户

vi /etc/vsftpd/userconf/test1

     local_root=/data/ftp/test1/

   2)test1用户

vi /etc/vsftpd/userconf/test2

     local_root=/data/ftp/test2/

3.在/data/ftp/下新建目录

   mkdir -p /var/ftp/test1/

mkdir -p /var/ftp/test2/

echo 11111 >> /var/ftp/test1/1.txt

echo 11111 >> /var/ftp/test2/2.txt

chown -R test1:test1 test1

chown -R test2:test2 test2

4.结果

   1）用户test1

[root@localhost ~]# ftp 127.0.0.1

Connected to 127.0.0.1 (127.0.0.1).

220 (vsFTPd 2.2.2)

Name (127.0.0.1:root): test1

331 Please specify the password.

Password:

230 Login successful.

Remote system type is UNIX.

Using binary mode to transfer files.

ftp> ls

227 Entering Passive Mode (127,0,0,1,128,118).

150 Here comes the directory listing.

-rw-r--r--    1 0        0               5 Jul 30 11:36 1.txt

1. rectory send OK.

2）用户test2

  [root@localhost ~]# ftp 127.0.0.1

Connected to 127.0.0.1 (127.0.0.1).

220 (vsFTPd 2.2.2)

Name (127.0.0.1:root): test2

331 Please specify the password.

Password:

230 Login successful.

Remote system type is UNIX.

Using binary mode to transfer files.

ftp> ls

227 Entering Passive Mode (127,0,0,1,113,121).

150 Here comes the directory listing.

-rw-r--r--    1 0        0               5 Jul 30 11:36 2.txt

226 Directory send OK.