第十八周

1 实现基于mysql验证的vsftpd虚拟用户访问。

安装数据库，创建用户表。

[root@localhost ~]# yum install mariadb-server
MariaDB [(none)]> create database vsftpd;
MariaDB [vsftpd]> create table users(id INT AUTO_INCREMENT NOT NULL PRIMARY KEY, name CHAR(20) BINARY NOT NULL, password CHAR(50) BINARY NOT NULL);
MariaDB [vsftpd]> insert into users(name, password) value('ftpuser1', password('password'));
MariaDB [vsftpd]> insert into users(name, password) value('ftpuser2', password('password'));
MariaDB [vsftpd]> grant select on vsftpd.* to ftp@'localhost' identified by 'password';     #本地数据库
MariaDB [vsftpd]> grant select on vsftpd.* to ftp@'127.0.0.1' identified by 'password';

安装配置ftp服务。

[root@localhost ~]# yum install vsftpd
[root@localhost ~]# tar xvf pam_mysql-0.7RC1.tar.gz
[root@localhost pam_mysql-0.7RC1]# yum install gcc make gcc-c++ pam-devel mariadb-devel 
[root@localhost pam_mysql-0.7RC1]# ./configure --with-mysql=/usr --with-pam=/usr --with-pam-mods-dir=/lib64/security
[root@localhost pam_mysql-0.7RC1]# make && make install
[root@localhost pam_mysql-0.7RC1]# vim /etc/pam.d/vsftpd.mysql
auth required pam_mysql.so user=ftp passwd=password host=localhost db=vsftpd table=users usercolumn=name passwdcolumn=password crypt=2
account required pam_mysql.so user=ftp passwd=password host=localhost db=vsftpd table=users usercolumn=name passwdcolumn=password crypt=2
[root@localhost pam_mysql-0.7RC1]# useradd -s /sbin/nologin -d /var/ftproot vuser
[root@localhost pam_mysql-0.7RC1]# chmod 555 /var/ftproot/
[root@localhost pam_mysql-0.7RC1]# mkdir /var/ftproot/{upload,pub}
[root@localhost pam_mysql-0.7RC1]# setfacl -m u:vuser:rwx /var/ftproot/upload
[root@localhost ~]# vim /etc/vsftpd/vsftpd.conf
pam_service_name=vsftpd.mysql
guest_enable=yes
guest_username=vuser

2 通过NFS实现服务器/www共享访问。

部署nfs服务

[root@localhost ~]# vim /etc/exports
/www 192.168.37.0/24(rw,no_root_squash)
[root@localhost ~]# exportfs -v
/www          	192.168.37.0/24(sync,wdelay,hide,no_subtree_check,sec=sys,rw,secure,no_root_squash,no_all_squash)

3 配置samba共享，实现/www目录共享。

[root@localhost ~]# yum install samba
[global]
        workgroup = SAMBA
        security = user                    #默认为账号密码登录验证
[www]
    comment = www
    path = /www
    browseable = yes
    read only = no
[root@localhost ~]# useradd -s /sbin/nologin -M samba
[root@localhost ~]# smbpasswd -a samba
[root@localhost ~]# setfacl -m u:samba:rwx /www/

4 使用rsync+inotify实现/www目录同步

部署rsync服务

[root@localhost media]# vim /etc/rsyncd.conf
uid = root
gid = root
use chroot = no
max connections = 0
ignore errors
exclude = lost+found/
log file = /var/log/rsyncd.log
pid file = /var/run/rsyncd.pid
lock file = /var/run/rsyncd.lock
reverse lookup = no
hosts allow = 192.168.37.0/24
[backup]
path = /opt/backup
comment = backup
read only = no
auth users = rsyncuser
secrets file = /etc/rsync.pass
[root@localhost media]# echo "rsyncuser:password" > /etc/rsyncd.pass
[root@localhost media]# chmod 600 /etc/rsync.pass
[root@localhost media]# mkdir /opt/backup
[root@localhost media]# systemctl status rsyncd.service 

安装inotify-tools

[root@localhost ~]# yum install inotify-tools
[root@localhost ~]# echo "password" > /etc/rsync.pass
[root@localhost ~]# chmod 600 /etc/rsync.pass 

编写同步脚本

[root@localhost ~]# vim inotify_rsync.sh
#!/bin/bash
SRC='/www'
DEST='rsyncuser@192.168.37.217::backup'
inotifywait -mrq --timefmt '%F %H:%M:%S' --format '%T %w %f' -e create,delete,moved_to,close_write,attrib ${SRC} |while read DATE TIME DIR FILE; do
    FILEPATH=${DIR}${FILE}
    rsync -az --delete --password-file=/etc/rsync.pass $SRC $DEST && echo "At ${TIME} on ${DATE}, file $FILEPATH was backuped up via rsync" >> /var/log/changelist.log
done
[root@localhost ~]# chmod +x inotify_rsync.sh
[root@localhost ~]# ./inotify_rsync.sh &

5 使用iptable实现: 放行telnet, ftp, web服务,放行samba服务,其他端口服务全部拒绝

[root@localhost ~]# iptables -A INPUT -p tcp --dport 23 -j ACCEPT     #telnet
[root@localhost ~]# iptables -A INPUT -p tcp -m multiport --dports 80,443 -j ACCEPT    #web
[root@localhost ~]# iptables -A INPUT -p tcp -m multiport --dport 139,445 -j ACCEPT

ftp被动模式

[root@localhost ~]# lsmod | grep nf_conntrack_ipv4
nf_conntrack_ipv4      15053  1 
nf_defrag_ipv4         12729  1 nf_conntrack_ipv4
nf_conntrack          139264  5 nf_nat,nf_nat_ipv4,xt_conntrack,nf_nat_masquerade_ipv4,nf_conntrack_ipv4
[root@localhost ~]# modprobe nf_conntrack_ftp
[root@localhost ~]# vim /etc/sysconfig/iptables-config 
IPTABLES_MODULES="nf_conntrack_ftp"
[root@localhost ~]# iptables -I INPUT -p tcp -m state --state ESTABLISHED,RELATED -j ACCEPT
[root@localhost ~]# iptables -I INPUT -p tcp --dport 21 -m state --state NEW -j ACCEPT
[root@localhost ~]# iptables -I OUTPUT -p tcp -m state --state ESTABLISHED -j ACCEPT