vsftp、selinux、firewalld知识点串接及上机讲解

一：概述

那么我们已经学过了firewalld，但还不能满足安全给我们带来某些操作或配置的麻烦性，所以我们需要进一步学习selinux，它属于应用层方面的安全，那么我们这方面的内容，我们需要掌握selinux它的知识：1、安全上下文；2、策略BOOLeans 值。也许你不明白什么意思，但我们通过实验，制造出问题，让你感觉它的重要性。

二：vsftp正常使用

三：操作示例

[root@server ~]#
[root@server ~]# setenforce 1
[root@server ~]#
[root@server ~]#
[root@server ~]# getenforce
Enforcing
[root@server ~]# chmod 777 /var/ftp/pub/

[root@localhost ~]# vi /etc/vsftpd/vsftpd.conf
local_enable=YES
local_umask=022
anon_upload_enable=YES
anon_mkdir_write_enable=YES

[root@localhost pub]# firewall-cmd --zone=public --list-all
public (default, active)
interfaces: eno16777736
sources:
services: dhcpv6-client ftp ssh
ports:
masquerade: no
forward-ports:
icmp-blocks:

[root@localhost ftp]# ll
total 0
drwxrwxrwx. 3 root root 39 Jul 21 10:43 pub
drwxr-xr-x. 2 root root 6 Jul 21 08:49 system

以上的内容是在firewalld放开了ftp服务器及我们的文件夹权限都是放开的。

以下实验，我们是开启防火墙和安全上下selinux:
输入：ftp://192.168.92.129/，我们先往ftp服务器里面pub目录存放数据，输出内容如下：

[root@localhost pub]#
[root@localhost pub]# setenforce 1
[root@localhost pub]#
[root@localhost pub]#
[root@localhost pub]# getenforce
Enforcing
[root@localhost pub]#
[root@localhost pub]#
[root@localhost pub]#

[root@localhost pub]# ls -Z /var/ftp/
drwxrwxrwx. root root system_u:object_r:public_content_t:s0 pub
drwxr-xr-x. root root unconfined_u:object_r:public_content_t:s0 system

u：代表是用户
r：代表角色
t：代表类型
system_u：代表系统管理员用户
object_r：代表文件和目录对象角色
public_content_t：代表主体或客体一组某一个类型
unconfined_u:代表没有定义的用户

我们可以借助以下命令修改安全上下文（context）的权限
chcon

[root@localhost pub]#
[root@localhost pub]#
[root@localhost pub]#
[root@localhost pub]# cd /etc/se
securetty security/ selinux/ services sestatus.conf
[root@localhost pub]# cd /etc/se
securetty security/ selinux/ services sestatus.conf
[root@localhost pub]# cd /etc/selinux/
config semanage.conf targeted/
[root@localhost pub]# cd /etc/selinux/targeted/
booleans.subs_dist contexts/ logins/ modules/ policy/ .policy.sha512 setrans.conf seusers
[root@localhost pub]# cd /etc/selinux/targeted/contexts/
customizable_types default_contexts failsafe_context initrc_context netfilter_contexts securetty_types systemd_contexts users/ virtual_image_context
dbus_contexts default_type files/ lxc_contexts removable_context sepgsql_contexts userhelper_context virtual_domain_context x_contexts
[root@localhost pub]# cd /etc/selinux/targeted/contexts/
[root@localhost contexts]# ls
customizable_types default_contexts failsafe_context initrc_context netfilter_contexts securetty_types systemd_contexts users virtual_image_context
dbus_contexts default_type files lxc_contexts removable_context sepgsql_contexts userhelper_context virtual_domain_context x_contexts
[root@localhost contexts]# cd files/
[root@localhost files]# ls
file_contexts file_contexts.bin file_contexts.homedirs file_contexts.homedirs.bin file_contexts.local file_contexts.local.bin file_contexts.subs file_contexts.subs_dist media
[root@localhost files]# cat file_contexts | grep public_content*
/srv/([^/]/)?ftp(/.)? system_u:object_r:public_content_t:s0
/srv/([^/]/)?rsync(/.)? system_u:object_r:public_content_t:s0
/var/ftp(/.)? system_u:object_r:public_content_t:s0
/var/spool/abrt-upload(/.)? system_u:object_r:public_content_rw_t:s0
[root@localhost files]#

public_content_rw_t

chcon –t public_content_rw_t /var/ftp/pub

[root@localhost files]#
[root@localhost files]# chcon -t public_content_rw_t /var/ftp/pub
[root@localhost files]#
[root@localhost files]#
[root@localhost files]# ls -Z /var/ftp/pub/
drwx------. ftp ftp system_u:object_r:public_content_t:s0 æ°æ件夹
[root@localhost files]# ls -Z /var/ftp/pub
drwx------. ftp ftp system_u:object_r:public_content_t:s0 æ°æ件夹
[root@localhost files]# ls -Z /var/ftp
drwxrwxrwx. root root system_u:object_r:public_content_rw_t:s0 pub
drwxr-xr-x. root root unconfined_u:object_r:public_content_t:s0 system
[root@localhost files]#
[root@localhost files]#
[root@localhost files]#

[root@localhost targeted]# getsebool -a | grep ftp
ftp_home_dir --> off
ftpd_anon_write --> off
ftpd_connect_all_unreserved --> off
ftpd_connect_db --> off
ftpd_full_access --> off
ftpd_use_cifs --> off
ftpd_use_fusefs --> off
ftpd_use_nfs --> off
ftpd_use_passive_mode --> off
httpd_can_connect_ftp --> off
httpd_enable_ftp_server --> off
sftpd_anon_write --> off
sftpd_enable_homedirs --> off
sftpd_full_access --> off
sftpd_write_ssh_home --> off
tftp_anon_write --> off
tftp_home_dir --> off
[root@localhost targeted]#

[root@localhost targeted]# setsebool -P ftpd_anon_write=on
[root@localhost targeted]# getsebool -a | grep ftp
ftp_home_dir --> off
ftpd_anon_write --> on
ftpd_connect_all_unreserved --> off
ftpd_connect_db --> off
ftpd_full_access --> off
ftpd_use_cifs --> off
ftpd_use_fusefs --> off
ftpd_use_nfs --> off
ftpd_use_passive_mode --> off
httpd_can_connect_ftp --> off
httpd_enable_ftp_server --> off
sftpd_anon_write --> off
sftpd_enable_homedirs --> off
sftpd_full_access --> off
sftpd_write_ssh_home --> off
tftp_anon_write --> off
tftp_home_dir --> off
[root@localhost targeted]#

通过以上实验，我们已经正常读写数据了。