18、Linux常用的共享服务的搭建

1、实现基于MYSQL验证的vsftpd虚拟用户访问

1、安装vsftpd包和mariadb软件包
[root@C76 ~]# yum install vsftpd -y
[root@C76 ~]# yum install mariadb-server -y
[root@C76 ~]# systemctl start mariadb #启动mysql
[root@C76 ~]# mysql #登录mysql
MariaDB [(none)]> create database vsftpd;
MariaDB [(none)]> use vsftpd;
MariaDB [vsftpd]> create table user(id INT auto_increment not null primary key, name char(30) binary not null, password char(30) binary not null );
MariaDB [vsftpd]> insert user(name,password) value('user1',password('redhat'));
MariaDB [vsftpd]> insert user(name,password) value('user2',password('redhat'));
MariaDB [vsftpd]> grant select on vsftpd.user to vsftpd@'192.168.44.%' identified by 'redhat';
2、下载安装pam-msyql
[root@C76 ~]# wget http://prdownloads.sourceforge.net/pam-mysql/pam_mysql-0.7RC1.tar.gz
[root@C76 ~]# tar -xvf pam_mysql-0.7RC1.tar.gz
[root@C76 ~]# cd pam_mysql-0.7RC1/
#安装依赖包
[root@C76 ~]# yum install gcc gcc-c++ pam-devel mariadb-devel -y
[root@C76 pam_mysql-0.7RC1]# ./configure --with-pam-mods-dir=/lib64/security/
3、修改pam配置
[root@C76 pam_mysql-0.7RC1]# vim /etc/pam.d/vsftpd.sql
auth required pam_mysql.so user=vsftpd passwd=redhat
host=192.168.44.134 db=vsftpd table=user usercolumn=name
passwdcolumn=password crypt=2
account required pam_mysql.so user=vsftpd passwd=redhat
host=192.168.44.134 db=vsftpd table=user usercolumn=name
passwdcolumn=password crypt=2
4、配置FTP服务
创建共享家目录
[root@C76 ~]# useradd -d /data/ftpdata1/ -s /sbin/nologin user1
#给共享目录添加权限
[root@C76 ~]# chmod 755 /data/ftpdata1
[root@C76 ~]# mkdir /data/ftpdata1/upload
[root@C76 ~]# setfacl -m u:user:rwx /data/ftpdata1/upload/
#修改配置文件
[root@C76 ~]# vim /etc/vsftpd/vsftpd.conf
pam_service_name=vsftpd.mysql
guest_enable=YES
guest_username=user
user_config_dir=/etc/vsftpd/vusers.d/
[root@C76 ~]# mkdir /etc/vsftpd/vusers.d/
[root@C76 ~]# vim /etc/vsftpd/vusers.d/user1
anon_upload_enable=YES
anon_mkdir_write_enable=YES
anon_other_write_enable=YES
[root@C76 ~]# vim /etc/vsftpd/vusers.d/user2
anon_upload_enable=YES
anon_mkdir_write_enable=YES
anon_other_write_enable=YES
local_root=/data/ftpdata1
[root@C76 ~]# systemctl restart vsftpd

2、通过NFS实现服务器/www共享访问。

1、安装相关包
yum install rpcbind tcp_wrappers -y
[root@C76 ~]# systemctl start nfs-server
[root@C76 ~]# systemctl enable nfs-server
[root@C76 ~]# useradd -r -s /bin/nologin -u 987 apache
[root@C76 ~]# mkdir /www
[root@C76 ~]# vim /etc/exports
/www/ *(rw,no_root_squash,all_squash,anonuid=987,anongid=987)
[root@C76 ~]# showmount -e 192.168.44.134  #查看共享
[root@C76 ~]# exportfs -r #重新加载
[root@C76 ~]# setfacl -m u:apache:rwx /www

3、配置samba共享，实现/www目录共享

[root@C76 ~]# yum install samba  -y
#创建操作系统账号
[root@C76 ~]# useradd -r -s /sbin/nologin smbuser1
[root@C76 ~]# useradd -r -s /sbin/nologin smbuser2
[root@C76 ~]# useradd -r -s /sbin/nologin smbuser3
cp -r /etc/skel/ /home/smbuser1 #手动修改家目录
chown -R smbuser1.smbuser1 /home/smbuse1
chmod 700 /home/smbuser1
#把账号加入数据库
[root@C76 ~]# smbpasswd -a smbuser1
New SMB password:
Retype new SMB password:
Added user smbuser1.
#查看
[root@C76 ~]# pdbedit -L
smbuser1:988:

[root@C76 samba]# mkdir /data/smbshare1
[root@C76 samba]# vim smb.conf
[share1]
commit
path=/www/ #定义共享目录
read only = yes #配置可写
#writeable =yes #等价于read only =no
public = yes #设置匿名用户可以访问
valid users=smbuser1 smbuser2 配置可访问用户
write list =smbuser1 #配置可写列表
#设置隐藏共享
browsable =no #默认是yes:x
​
自动挂载/etc/fstab
#centos6加sec在centos7不用加
•// 192.168.44.134/share1 /mnt/smbshare cifs sec=ntlmssp,credentials=/etc/smb.txt 0 0
•把用户名和密码写入/etc/smb.txt中
username=smbuser1
password=redhat
chmod 600 /etc/smb.txt
vim /etc/samba/smb.conf
[global]
      workgroup = WORKGROUP
      security = user
      config file=/etc/samba/conf.d/%U #用户独立的配置文件
      passdb backend = tdbsam
​
      printing = cups
      printcap name = cups
      load printers = yes
      cups options = raw
      log file =/var/log/samba/log.%m
      log level = 2
​
[root@C76 samba]# mkdir conf.d/
[root@C76 samba]# cd /etc/samba/conf.d/
[root@C76 conf.d]# mkdir /www/
[root@C76 conf.d]# chmod 777 /www/
[root@C76 conf.d]# cat liubo
[share]
comment = Sharedir3
path=/www
writeable =no

4、使用rsync+inotify实现/www目录实时同步

1、安装rsync
[root@C76 ~]# yum install rsync -y
2、配置
[root@C76 ~]# vim /etc/rsyncd.conf
uid = root
gid = root
use chroot = no
max connections = 0
ignore errors
exclude = lost+found/
log file = /var/log/rsyncd.log
pid file = /var/run/rsyncd.pid
lock file = /var/run/rsyncd.lock
reverse lookup = no
hosts allow = 192.168.44.0/24
[backup]
path = /backupdir/
comment = backupdir
read only = no
auth users = rsyncuser
secrets file = /etc/rsync.pass

#生成验证文件,用于存放远程登录rsync服务器（用户名及密码）同步数据
[root@C76 ~]#echo "rsyncuser:liu" > /etc/rsync.pass
[root@C76 ~]#chmod 600 /etc/rsync.pass
#服务器端准备同步备份的目录
[root@C76 ~]#mkdir /backupdir
#启动服务并设为开机启动
[root@C76 ~]#systemctl start rsyncd   
[root@C76 ~]#systemctl enable rsyncd
#客户端配置密码文件
[root@C76 ~]#echo "liu" > /etc/rsync.pass
[root@C76 ~]#chmod 600 /etc/rsync.pass
#客户端测试同步数据
[root@C76 ~]#rsync -avz --password-file=/etc/rsync.pass /data/www rsyncuser@192.168.44.134::backup/
#数据同步脚本
[root@C76 ~]#vim inotify_rsync.sh
#!/bin/bash
SRC='/www/'
DEST='rsyncuser@192.168.44.134::backup'
inotifywait -mrq --timefmt '%Y-%m-%d %H:%M' --format '%T %w %f' -
e create,delete,moved_to,close_write,attrib ${SRC} |while read DATE
TIME DIR FILE;do
FILEPATH=${DIR}${FILE}
rsync -az --delete --password-file=/etc/rsync.pass $SRC $DEST &&
echo "At ${TIME} on ${DATE}, file $FILEPATH was backuped up via rsync"
>> /var/log/changelist.log
done
[root@C76 ~]#chmod +x innotify_rsync.sh

5、使用iptable实现: 放行telnet, ftp, web服务,放行samba服务,其他端口服务全部拒绝

#允许本机访问ssh端口
[root@C76 ~]# iptables -I INPUT -s 192.168.44.134 -p tcp --dport 22 -j ACCEPT
#开放telnet, ftp, web端口
[root@C76 ~]# iptables -A INPUT -p tcp -m multiport --dports 20,21,23,80,443,139,445 -j ACCEPT
[root@C76 ~]#iptables -A INPUT -p udp --dport 137:138 -j ACCEPT
#拒绝连接
[root@C76 ~]# iptables -A INPUT -j REJECT