第十八周：网络文件共享服务及iptables

最新推荐文章于 2024-11-13 22:29:30 发布

N45_632917996

最新推荐文章于 2024-11-13 22:29:30 发布

阅读量207

点赞数

分类专栏：作业文章标签： linux 运维 centos

本文链接：https://blog.csdn.net/wauzy/article/details/108236352

版权

作业专栏收录该内容

18 篇文章 0 订阅

订阅专栏

1、实现基于MYSQL验证的vsftpd虚拟用户访问

在数据库服务器上安装MySQL及创建虚拟用户账号、授权访问

[root@mariadb-server ~]# yum install mariadb-server
[root@mariadb-server ~]# systemctl start mariadb
[root@mariadb-server ~]# mysql
MariaDB [(none)]> create database vsftpd;
MariaDB [(none)]> use vsftpd;
MariaDB [vsftpd]> create table users (id INT AUTO_INCREMENT NOT NULL PRIMARY KEY,name CHAR(50) BINARY NOT NULL,password CHAR(48) BINARY NOT NULL);
MariaDB [vsftpd]> insert users (name,password) values ('ftpuser1',password('centos'));
MariaDB [vsftpd]> insert users (name,password) values ('ftpuser2',password('magedu'));
MariaDB [(none)]> grant select on vsftpd.* to vsftpd@'192.168.8.%' identified by 'centos';

测试链接数据库服务器

[root@ftp-server ~]# mysql -uvsftpd -h192.168.8.17 -pcentos

安装vsftpd及编译pam_mysql

[root@ftp-server ~]# yum install vsftpd -y
[root@ftp-server ~]# yum install gcc gcc-c++ pam-devel mariadb-devel -y
[root@ftp-server ~]# tar xf pam_mysql-0.7RC1.tar.gz 
[root@ftp-server ~]# cd pam_mysql-0.7RC1/
[root@ftp-server ~/pam_mysql-0.7RC1]# ./configure --with-pam-mods-dir=/lib64/security/
[root@ftp-server ~/pam_mysql-0.7RC1]# make && make install

在FTP服务器上配置vsftpd服务

在FTP服务器上建立pam认证所需文件

[root@ftp-server ~]# vim /etc/pam.d/vsftpd.mysql
auth required pam_mysql.so user=vsftpd passwd=centos host=192.168.8.17 db=vsftpd table=users usercolumn=name passwdcolumn=password crypt=2             
account required pam_mysql.so user=vsftpd passwd=centos host=192.168.8.17 db=vsftpd table=users usercolumn=name passwdcolumn=password crypt=2

建立相应用户和修改vsftpd配置文件，使其适应mysql认证


[root@ftp-server ~]# vim /etc/vsftpd/vsftpd.conf
anonymous_enable=NO                修改
guest_enable=YES                   添加
guest_username=vuser               添加
pam_service_name=vsftpd.mysql      修改  
 
[root@ftp-server ~]# useradd -s /sbin/nologin -d /var/ftproot vuser
[root@ftp-server ~]# chmod 555 /var/ftproot  需除去ftp根目录的写权限
[root@ftp-server ~]# mkdir /var/ftproot/{upload,pub}
[root@ftp-server ~]# setfacl -m u:vuser:rwx /var/ftproot/upload   对upload具有读写权限

[root@ftp-server ~]# systemctl start vsftpd
[root@ftp-server ~]# tail /var/log/secure    查看日志

在FTP服务器上配置虚拟用户具有不同的访问权限

[root@ftp-server ~]# vim /etc/vsftpd/vsftpd.conf 
user_config_dir=/etc/vsftpd/vusers_config/       添加
[root@ftp-server ~]# mkdir /etc/vsftpd/vusers_config
[root@ftp-server ~]# cd /etc/vsftpd/vusers_config
[root@ftp-server /etc/vsftpd/vusers_config]# touch ftpuser1
[root@ftp-server /etc/vsftpd/vusers_config]# touch ftpuser2
##ftpuser1具有读写权限---------------------------------------
[root@ftp-server /etc/vsftpd/vusers_config]# vim ftpuser1
anon_upload_enable=YES
anon_mkdir_write_enable=YES
anon_other_write_enable=YES
##ftpuser2路径变更且没有读写权限---------------------------------------
[root@ftp-server /etc/vsftpd/vusers_config]# vim ftpuser2
local_root=/var/ftproot/ftpuser2 
[root@ftp-server /etc/vsftpd/vusers_config]# mkdir /var/ftproot/ftpuser2
[root@ftp-server /etc/vsftpd/vusers_config]# chmod 555 /var/ftproot/ftpuser2
[root@ftp-server /etc/vsftpd/vusers_config]# touch /var/ftproot/ftpuser2/user2    验证
[root@ftp-server /etc/vsftpd/vusers_config]# systemctl restart vsftpd

2、通过NFS实现服务器/www共享访问。

在这里插入图片描述

1.安装Mariadb并创建相关表格、授权

[root@mariadb-server ~]# yum install mariadb-server -y
[root@mariadb-server ~]# mysql 
MariaDB [(none)]> create database wpdb;
MariaDB [(none)]> grant all on wpdb.* to wpuser@'192.168.8.%' identified by 'centos';

2.安装apache

[root@apache-slave ~]# yum install httpd php php-mysql -y
[root@apache-master ~]# yum install httpd php php-mysql
[root@apache-master ~]# id apache
uid=48(apache) gid=48(apache) groups=48(apache)

3.安装nfs、设置共享目录

[root@nfs-server ~]# yum install nfs-utils -y
[root@nfs-server ~]# mkdir /data/web
[root@nfs-server ~]# useradd -r -s /sbin/nologin -u 48 apache
[root@nfs-server ~]# setfacl -m u:apache:rwx /data/web
[root@nfs-server ~]# vim /etc/exports
/data/web *(rw,all_squash,anonuid=48,anongid=48) 
[root@nfs-server ~]# exportfs -r                           加载
[root@nfs-server ~]# showmount -e 192.168.8.47             检查配置
Export list for 192.168.8.47:
/data/web *
[root@nfs-server ~]# systemctl start nfs-server

4.apache挂在nfs及安装wordpress

[root@apache-master ~]# mount 192.168.8.47:/data/web /var/www/html/
[root@apache-master ~]# cd /var/www/html/
[root@apache-master /var/www/html]# tar xf wordpress-4.8.3-zh_CN.tar.gz
[root@apache-master /var/www/html]# systemctl start httpd
##从服务器配置-------------------------------------------------------
[root@apache-slave ~]# mount 192.168.8.47:/data/web /var/www/html/
[root@apache-slave ~]# systemctl start httpd
##访问--------------------------------------------------------------
http://192.168.8.17/wordpress/index.php    安装word press
http://192.168.8.27/wordpress/             访问

3、配置samba共享，实现/www目录共享

在这里插入图片描述

1.安装samba配置

[root@samba ~]# yum install samba -y
[root@samba ~]# smbpasswd -a smbuser   
[root@samba ~]# ll /var/lib/samba/private/passdb.tdb 
-rw------- 1 root root 421888 Aug 26 16:39

[root@samba ~]# mkdir /data/web
[root@samba ~]# chmod 700 /data/web
[root@samba ~]# chown -R smbuser.smbuser /data/web
[root@samba ~]# ll /var/libvim /etc/samba/smb.conf
[global]
       workgroup = SAMBA                                                                                                                              
        security = user

        passdb backend = tdbsam
[share]                               新增
        path = /data/web
        writable = yes                任何人都可以访问
[root@samba ~]# systemctl start smb nmb

2.apache配置

[root@apache ~]# yum install httpd -y
[root@apache ~]# mount -o username=smbuser,password=centos //192.168.8.47/share /var/www/html/
[root@apache ~]# echo 192.168.8.7 >/var/www/html/index.html
[root@apache ~]# systemctl start httpd

##访问----------------------------------------------------------
[root@samba ~]# cat /data/web/index.html 
192.168.8.7

挂载时用share即代表目录及权限（/etc/samba/smb.conf配置share名称）

4、使用rsync+inotify实现/www目录实时同步

在这里插入图片描述

1.安装httpd，基于fcgi配置httpd

[root@apache ~]#  yum install httpd php php-mysql php-fpm -y
[root@apache ~]# vim /etc/httpd/conf.d/fcgi.conf
DirectoryIndex index.php
ProxyRequests Off
ProxyPassMatch ^/(.*\.php)$ fcgi://127.0.0.1:9000/var/www/html/$1
[root@apache ~]# httpd -M |grep fcgi
[root@Apache ~]# vim /var/www/html/test.php       测试php
<?php                                                                                                                                                 
echo date("Y/m/d H:i:s");
phpinfo();
?>
[root@apache ~]# systemctl start php-fpm httpd    启动
##测试------------------------------------------------------------
192.168.8.17/test.php

2.配置nfs-master

[root@NFS-master ~]# yum install nfs-utils -y
[root@NFS-master ~]# mkdir /data/web
[root@NFS-master ~]# useradd -r -s /sbin/nologin -u 48 apache    创建用户
[root@NFS-master ~]# setfacl -m u:apache:rwx /data/web     授权
[root@NFS-master ~]# vim /etc/exports                      设置共享
/data/web *(rw,all_squash,anonuid=48,anongid=48) 
[root@NFS-master ~]# systemctl start nfs-server

3.httpd服务器挂在目录及开机启动

[root@apache ~]# mount 192.168.8.27:/data/web /var/www/html/
[root@apache ~]# df
[root@apache /var/www/html]# tar xf wordpress-4.8.3-zh_CN.tar.gz
[root@Apache /var/www/html]# vim /etc/fstab      开机启动
192.168.8.27:/data/wordpress        /var/www/html/    nfs    defaults 0 0

4.MySQL服务器安装及授权

[root@mariaDB ~]# yum install mariadb-server -y
[root@mariaDB ~]# systemctl start mariadb
[root@hostB ~]# mysql
MariaDB [(none)]> create database wpdb;
MariaDB [(none)]> grant all on wpdb.* to wpuser@'192.168.8.%' identified by 'centos';

5.nfs-bak配置

[root@NFS-bak ~]# vim /etc/rsyncd.conf
uid = root                                                                                                                                            
gid = root
use chroot = no
max connections = 0
ignore errors
exclude = lost+found/
log file = /var/log/rsyncd.log
pid file = /var/run/rsyncd.pid
lock file = /var/run/rsyncd.lock
reverse lookup = no
hosts allow = 192.168.8.0/24
[backup]
path = /data/backup/          备份目录
comment = backup              
read only = no
auth users = rsyncuser
secrets file = /etc/rsync.pass


[root@NFS-bak ~]# mkdir /data/backup
[root@NFS-bak ~]# echo "rsyncuser:magedu" >/etc/rsync.pass
[root@NFS-bak ~]# chmod 600 /etc/rsync.pass    设权限
[root@NFS-bak ~]# systemctl start rsyncd
[root@NFS-bak ~]# systemctl enable rsyncd      开机启动

6.nfs-master配置

6.1 安装inotify

[root@NFS-master ~]# epel
[root@NFS-master ~]# yum install inotify-tools
[root@NFS-master ~]# echo "magedu" > /etc/rsync.pass
[root@NFS-master ~]# chmod 600 /etc/rsync.pass

6.2 测试同步数据


[root@NFS-master ~]# rsync -avz --password-file=/etc/rsync.pass /data/web/wordpress rsyncuser@192.168.8.47::backup

6.3 客户端创建inotify_rsync.sh脚本

[root@NFS-master ~]# vim /data/inotify_rsync.sh
#!/bin/bash
SRC='/data/web/'
DEST='rsyncuser@192.168.8.47::backup'
inotifywait -mrq --timefmt '%Y-%m-%d %H:%M' --format '%T %w %f' -e create,delete,moved_to,close_write,attrib ${SRC} |while read DATE TIME DIR FILE;do
FILEPATH=${DIR}${FILE}
rsync -az --delete --password-file=/etc/rsync.pass $SRC $DEST && echo "At ${TIME} on ${DATE}, file $FILEPATH was backuped up via rsync" >> /var/log/changelist.log
done

[root@NFS-master ~]# chmod +x /data/inotify_rsync.sh 
[root@NFS-master ~]# /data/inotify_rsync.sh &      后台启动

5、使用iptable实现: 放行telnet, ftp, web服务,放行samba服务,其他端口服务全部拒绝

[root@iptables ~]# iptables -A INPUT -s 192.168.8.1 -j ACCEPT
[root@iptables ~]# iptables -A INPUT -j REJECT
[root@iptables ~]# iptables -I INPUT 2 -p tcp -m multiport --dport 21,23,80,139 -j ACCEPT