[openwrt][telnet][ftp] 关闭telnet和ftp，ssh

**Telnet **

默认端口号是 23

获取telnet的进程号

ps | grep "telnetd" | grep "login.sh" |  awk '{print $1}'

kill 进程号

root@OpenWrt:~# ps | grep "telnetd" 
10372 root      1776 S    /usr/sbin/telnetd -l /bin/login.sh
10827 root      1772 S    grep telnetd
root@OpenWrt:~# ps | grep "telnetd" | grep "login.sh"
10372 root      1776 S    /usr/sbin/telnetd -l /bin/login.sh
root@OpenWrt:~# ps | grep "telnetd" | grep "login.sh" |  awk '{print $1}'
10372
root@OpenWrt:~# 

ssh里面打开telnet

root@OpenWrt:/# /usr/sbin/telnetd -l /bin/login.sh
root@OpenWrt:/# ps | grep "telnetd" | grep "login.sh" |  awk '{print $1}' 
12430

---

代码里面关掉telnet
\openwrt7621\trunk\base\package\utils\busybox\files\telnet

start_service() {
		service_start /usr/sbin/telnetd -l /bin/login.sh
}

改为：

start_service() {
              exit
}

---

关闭ssh和Telnet，并且连同scp一起关闭，是在编译源码中关闭，非路由器里面。
ssh关闭，不编译dropbear就行了，没了ssh服务，scp也就没有了。
来源

---

开机默认关闭：/trunk/base/package/utils/busybox/files/telnet

---

FTP（vsftpd）

端口21

root@OpenWrt:~# /etc/init.d/vsftpd stop
root@OpenWrt:~# 
root@OpenWrt:~# /etc/init.d/vsftpd start

---

VSFTP是一个基于GPL发布的类Unix系统上使用的FTP服务器软件，它的全称是Very Secure FTP 从此名称可以看出来，编制者的初衷是代码的安全。在使用Vsftp服务是经常需要启动、停止、重启vsftp服务，下面是这几个操作使用的指令：

1、启动Vsftpd服务其命令为： service vsftpd start 或 /etc/init.d/vsftpd start

2、停止Vsftpd服务的命令为：service vsftpd stop 或 /etc/init.d/vsftpd stop

3、重新启动Vsftpd服务的命令为：service vsftpd restart 或 /etc/init.d/vsftpd restart

4、检查Vsftpd服务的运行状态：service vsftpd status

---

FTP server vsftpd
来自 Double_win：http://www.cnblogs.com/double-win/p/3848797.html
(1)安装vsFTP，使用如下命令：

opkg update
opkg install vsftpd

(2)配置/etc/vsftpd.conf
根据是否允许anonymous登录，选择不同的配置文件：
允许anonymous：

background=YES
listen=YES
chown_uploads=YES
chown_username=root
ftp_username=nobody
#enable anonymous user
anonymous_enable=YES
anon_upload_enable=YES
anon_root=/mnt/anonymous
anon_mkdir_write_enable=YES
anon_max_rate=512000
local_enable=YES
write_enable=YES
local_umask=022
check_shell=NO
local_root=/mnt
chroot_local_user=yes
accept_timeout=60
idle_session_timeout=300
max_clients=600
max_per_ip=5
#dirmessage_enable=YES
ftpd_banner=Welcome to vsFTP service.
session_support=NO
syslog_enable=YES

不允许匿名访问的话：

secure_chroot_dir=/mnt/sda3/ftpdir   #创建对应的文件夹
  ftp_username=root        #允许的用户名root 
  nopriv_user=root    
  background=YES
  listen=YES
  anonymous_enable=NO
  local_enable=YES
  write_enable=YES
  local_umask=022
  check_shell=NO
  dirmessage_enable=YES
  ftpd_banner=Welcome to vsFTP service.
  syslog_enable=YES
  max_clients=600
  max_per_ip=5
  accept_timeout=60    #设置连接超时

(4)启动vsftpd服务

/etc/init.d/vsftpd restart     #重启vsftpd服务
/etc/init.d/vsftpd enable     #允许开机自启动

---

https://wiki.openwrt.org/doc/howto/ftp.overview
http://www.cnblogs.com/double-win/p/3848797.html
https://blog.csdn.net/kingwan560/article/details/52209705

---

开机默认关闭：/trunk/base/feeds/packages/net/vsftpd/files/vsftpd.conf

---

SSH

端口22

/etc/init.d/dropbear stop   //停止

/etc/init.d/dropbear start  //开启

netstat -ant |grep :22 //查看端口信息

如何默认关闭
修改配置文件

root@OpenWrt:~# cat /etc/config/dropbear 
config dropbear
        option PasswordAuth 'on'
        option RootPasswordAuth 'on'
        option Port         '22'
#       option BannerFile   '/etc/banner'
root@OpenWrt:~# 

------------------------------------------------------------
option BannerFile   '/etc/banner' //是ssh连接成功的显示的那个图案
  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 -----------------------------------------------------

https://wiki.openwrt.org/doc/uci/dropbear

添加一个 option enable ‘0’，重启/etc/init.d/dropbear restart。
然后可以看到ssh的22端口已经关闭

root@OpenWrt:~# cat /etc/config/dropbear 
config dropbear
        option PasswordAuth 'on'
        option RootPasswordAuth 'on'
        option enable '0'
        option Port         '22'
#       option BannerFile   '/etc/banner'
root@OpenWrt:~# 
root@OpenWrt:~# netstat -ant |grep :22
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      
tcp        0      0 :::22                   :::*                    LISTEN      
root@OpenWrt:~# 
root@OpenWrt:~# /etc/init.d/dropbear restart
root@OpenWrt:~# 
root@OpenWrt:~# netstat -ant |grep :22
root@OpenWrt:~# 

system("uci set /etc/config/dropbear.@dropbear[0].enable=1"); // 1 is open,defalut is 1
system("uci commit /etc/config/dropbear");
system("/etc/init.d/dropbear restart");

新建连接的ssh已无法建立

---

开机默认关闭：
/trunk/base/package/ramips/ui/luci-mtk/src/contrib/uci/hostfiles/etc/config/dropbear

---

unsigned char *ManagementSetting(int *pResult, json_object *pJsonReq, unsigned char* pOutBuf, int* pOutLen)
{
	json_object *rsp_json = NULL;	
	json_object *pApconf = NULL;	
	int nCheckTypRet = FALSE, nExeRet = TRUE;
	char szCmd[256] = {0};
	char ret_ssh[BUF_SIZE_64] = {0};
	char ret_telnet[BUF_SIZE_64] = {0};
	char ret_ftp[BUF_SIZE_64] = {0};
	char *json_val = NULL;
	char out_buf[128] = {0};
	int  telnet_pid = -999;

	*pResult = FALSE;
	
	rsp_json = json_object_new_object();
	CHECK_NEW_JSON(rsp_json);
	
	json_object_object_foreach(pJsonReq, key, val)
	{
		json_val = json_object_get_string(val);

	
		my_printf(LOG_MODE_LEVEL_3, "%s(%d) ,key:%s val:%s\n",__FUNCTION__,__LINE__,key,json_object_get_string(val));	

		if (strcmp(key, "SSH") == 0) //22
		{
			GetNVRamData("/etc/config/CusCMCfg.globalValue.SSH",ret_ssh,BUF_SIZE_64); 
			my_printf(LOG_MODE_LEVEL_3, "%s(%d) SSH %s   ret_ssh:%s\n",__FUNCTION__,__LINE__,json_val,ret_ssh);
			if(openUtil_strcmp(json_val,"On") == 0)
			{
				if(openUtil_strcmp(ret_ssh,"Off") == 0)//current status is off,so switch to on
				{
					my_printf(LOG_MODE_LEVEL_3, "%s(%d) SSH %s\n",__FUNCTION__,__LINE__,json_val);
					system("uci set /etc/config/dropbear.@dropbear[0].enable=1"); // 1 is open,defalut is 1
					system("uci commit /etc/config/dropbear");
					sleep(1);
					system("/etc/init.d/dropbear restart");
					//my_printf(LOG_MODE_LEVEL_3, "%s(%d) SSH /etc/init.d/dropbear restart 1\n",__FUNCTION__,__LINE__);
					sleep(1);

					memset(out_buf, 0x0, sizeof(out_buf));
					get_system_output("netstat -nap | grep \":22\"",out_buf,sizeof(out_buf));
					my_printf(LOG_MODE_LEVEL_3, "%s(%d) out_buf=%s\n",__FUNCTION__,__LINE__, out_buf);	

					if( openUtil_strlen(out_buf) != 0 )
					{
						system("uci set /etc/config/CusCMCfg.globalValue.SSH='On'");
						system("uci commit /etc/config/CusCMCfg");
					}

				}

			}
			else //Off
			{
				if(openUtil_strcmp(ret_ssh,"On") == 0)//current status is on,so switch to off
				{
					my_printf(LOG_MODE_LEVEL_3, "%s(%d) SSH %s\n",__FUNCTION__,__LINE__,json_val);
					system("uci set /etc/config/dropbear.@dropbear[0].enable=0");
					system("uci commit /etc/config/dropbear");
					sleep(1);
					system("/etc/init.d/dropbear stop");
					//cprintf("%s(%d) SSH /etc/init.d/dropbear stop 0\n",__FUNCTION__,__LINE__);
					
					system("uci set /etc/config/CusCMCfg.globalValue.SSH='Off'");
					system("uci commit /etc/config/CusCMCfg");	
				}
			}
		}
		else if (strcmp(key, "Telnet") == 0) //23
		{
			GetNVRamData("/etc/config/CusCMCfg.globalValue.Telnet",ret_telnet,BUF_SIZE_64); 
			my_printf(LOG_MODE_LEVEL_3, "%s(%d) Telnet %s   ret_telnet:%s\n",__FUNCTION__,__LINE__,json_val,ret_telnet);
			if(openUtil_strcmp(json_val,"On") == 0)
			{
				if(openUtil_strcmp(ret_telnet,"Off") == 0)//current status is off,so switch to on
				{
					my_printf(LOG_MODE_LEVEL_3, "%s(%d) Telnet %s\n",__FUNCTION__,__LINE__,json_val);
					system("/usr/sbin/telnetd -l /bin/login.sh");
					//cprintf("%s(%d) Telnet /usr/sbin/telnetd -l /bin/login.sh\n",__FUNCTION__,__LINE__);
					//system("uci set /etc/config/CusCMCfg.globalValue.Telnet='On'");
					//system("uci commit /etc/config/CusCMCfg");
					sleep(1);

					memset(out_buf, 0x0, sizeof(out_buf));
					get_system_output("netstat -nap | grep \":23\"",out_buf,sizeof(out_buf));
					my_printf(LOG_MODE_LEVEL_3, "%s(%d) out_buf=%s\n",__FUNCTION__,__LINE__, out_buf); 
					
					if( openUtil_strlen(out_buf) != 0 )
					{
						system("uci set /etc/config/CusCMCfg.globalValue.Telnet='On'");
						system("uci commit /etc/config/CusCMCfg");
					}
				}
			}
			else //Off
			{
				if(openUtil_strcmp(ret_telnet,"On") == 0)//current status is On,so switch to Off					{
				{
					get_system_output("ps | grep \"telnetd\" | grep \"login.sh\" |  awk '{print $1}'",out_buf,sizeof(out_buf));
					telnet_pid = atoi(out_buf);
					my_printf(LOG_MODE_LEVEL_3, "%s(%d) out_buf:%s  telnet_pid:%d\n",__FUNCTION__,__LINE__,out_buf,telnet_pid);
					sprintf(szCmd, "kill %d", telnet_pid);
					my_printf(LOG_MODE_LEVEL_3, "%s(%d) szCmd:%s \n",__FUNCTION__,__LINE__,szCmd);
					system(szCmd);	
					//my_printf(LOG_MODE_LEVEL_3, "%s(%d) Telnet %s\n",__FUNCTION__,__LINE__,json_val);
					system("uci set /etc/config/CusCMCfg.globalValue.Telnet='Off'");
					system("uci commit /etc/config/CusCMCfg");				
				}
			}
		}
		else if (strcmp(key, "FTP") == 0) //21
		{
			GetNVRamData("/etc/config/CusCMCfg.globalValue.FTP",ret_ftp,BUF_SIZE_64); 
			my_printf(LOG_MODE_LEVEL_3, "%s(%d) FTP %s   ret_ftp:%s\n",__FUNCTION__,__LINE__,json_val,ret_ftp);
			if(openUtil_strcmp(json_val,"On") == 0)
			{
				if(openUtil_strcmp(ret_ftp,"Off") == 0)//current status is off,so switch to on
				{
					my_printf(LOG_MODE_LEVEL_3, "%s(%d) FTP %s\n",__FUNCTION__,__LINE__,json_val);
					system("sed -i 's/listen=NO/listen=YES/g' /etc/vsftpd.conf");
					sleep(1);
					system("/etc/init.d/vsftpd restart");
					//my_printf(LOG_MODE_LEVEL_3, "%s(%d) FTP /etc/init.d/vsftpd restart YES\n",__FUNCTION__,__LINE__);		
					//system("uci set /etc/config/CusCMCfg.globalValue.FTP='On'");
					//system("uci commit /etc/config/CusCMCfg");
					sleep(1);

					memset(out_buf, 0x0, sizeof(out_buf));
					get_system_output("netstat -nap | grep \":21\"",out_buf,sizeof(out_buf));
					my_printf(LOG_MODE_LEVEL_3, "%s(%d) out_buf=%s\n",__FUNCTION__,__LINE__, out_buf); 
					
					if( openUtil_strlen(out_buf) != 0 )
					{
						system("uci set /etc/config/CusCMCfg.globalValue.FTP='On'");
						system("uci commit /etc/config/CusCMCfg");
					}

				}
			}
			else //Off
			{	
				if(openUtil_strcmp(ret_ftp,"On") == 0)//current status is on,so switch to off
				{
					my_printf(LOG_MODE_LEVEL_3, "%s(%d) FTP %s\n",__FUNCTION__,__LINE__,json_val);
					//system("/etc/init.d/vsftpd stop");
					//cprintf("%s(%d) FTP /etc/init.d/vsftpd stop\n",__FUNCTION__,__LINE__);
					system("sed -i 's/listen=YES/listen=NO/g' /etc/vsftpd.conf");
					sleep(1);
					system("/etc/init.d/vsftpd stop");
					//my_printf(LOG_MODE_LEVEL_3, "%s(%d) FTP /etc/init.d/vsftpd stop NO\n",__FUNCTION__,__LINE__);
					system("uci set /etc/config/CusCMCfg.globalValue.FTP='Off'");
					system("uci commit /etc/config/CusCMCfg");
				}
			}
		}	
		
		nCheckTypRet = TRUE;
	}
	my_printf(LOG_MODE_LEVEL_3, "%s(%d) ManagementSetting.....set...ok \n",__FUNCTION__,__LINE__);			
	
	json_object_object_add(rsp_json, COMM_RSP_STATUS, json_object_new_string(((nCheckTypRet != FALSE) ? COMM_RSP_SUCCESS : COMM_RSP_FAIL)));
	json_object_object_add(rsp_json, COMM_MSG_CODE, json_object_new_string(((nCheckTypRet != FALSE) ? COMM_MSG_0000 : COMM_MSG_2001)));
	json_object_object_add(rsp_json, COMM_RESULT, json_object_new_string(((nExeRet != 0) ? COMM_RESULT_OK : COMM_RESULT_ERROR)));

	//rsp_json buffer is released in the next function
	return ConstructFinalBuffer(pResult, MANAGEMENT_REQ, &rsp_json, pOutBuf, pOutLen);
}