Linux学习-FTP

FTP(File Transfer Protocol)：文件传输协议
21/tcp
21/udp
文件共享服务，将一个主机中的文件共享给用户，工作于应用层
RPC(Remote Procedure Call)：远程过程调用，位于两台主机中的两个进程基于二进制格式进行数据通信
NFS(Network File System)：
Samba：CIFS/SMB跨平台文件共享

FTP有两个连接：
控制连接(命令连接)：一直在线，工作在21号端口
数据连接：按需打开，按需关闭，
FTP主动模式：20/TCP
FTP被动模式：

FTP数据传输模式(自动模式，让服务自身来选择)：遵循数据本身
二进制
文本

FTP服务器端程序
vsftpd：Very Secure ftp Daemon
proftpd：
pureftpd：

Serv-U
FileZilla

FTP客户端程序：
CLI：
ftp
lftp
GUI：
gftpd
FlashXP
cuteftp
filezilla
vsftpd
配置文件：/etc/vsftpd
服务脚本：/etc/init.d/vsftpd
主程序：/usr/sbin/vsftpd
基于PAM实现用户认证：
/etc/pam.d/*
/lib/security/*
/lib64/security/*
支持虚拟用户
/var/ftp:只有root用户有写权限
上传和下载
安装vsftpd

[root@mail ~]#  yum install -y vsftpd
#vsftpd所安装的文件
[root@mail ~]# rpm -ql vsftpd
/etc/logrotate.d/vsftpd
/etc/pam.d/vsftpd
/etc/rc.d/init.d/vsftpd
/etc/vsftpd
/etc/vsftpd/ftpusers
/etc/vsftpd/user_list
/etc/vsftpd/vsftpd.conf
/etc/vsftpd/vsftpd_conf_migrate.sh
/usr/sbin/vsftpd
... ...

[root@mail ~]# finger ftp
Login: ftp            			Name: FTP User
Directory: /var/ftp                 	Shell: /sbin/nologin
Never logged in.
No mail.
No Plan.
#启动vsftpd
[root@mail var]# service vsftpd start
Starting vsftpd for vsftpd:                                [  OK  ]

ftp用户类别：
匿名用户：–>系统用户
虚拟用户：–>系统用户
系统用户：
用户的家目录：/var/ftp

windows连接ftp

C:\Users\Administrator>ftp 192.168.88.135
连接到 192.168.88.135。
220 (vsFTPd 2.2.2)
200 Always in UTF8 mode.
#匿名，使用anonymous
用户(192.168.88.135:(none)): anonymous
331 Please specify the password.
密码:
230 Login successful.
ftp> ls
200 PORT command successful. Consider using PASV.
150 Here comes the directory listing.
pub
226 Directory send OK.
ftp: 收到 8 字节，用时 0.00秒 8000.00千字节/秒。
ftp> help
命令可能是缩写的。  命令为:

!               delete          literal         prompt          send
?               debug           ls              put             status
append          dir             mdelete         pwd             trace
ascii           disconnect      mdir            quit            type
bell            get             mget            quote           user
binary          glob            mkdir           recv            verbose
bye             hash            mls             remotehelp
cd              help            mput            rename
close           lcd             open            rmdir

#通过系统用户登录ftp服务器,系统用户登录显示的是用户的家目录下的内容
C:\Users\Administrator>ftp 192.168.88.135
连接到 192.168.88.135。
220 (vsFTPd 2.2.2)
200 Always in UTF8 mode.
用户(192.168.88.135:(none)): hadoop
331 Please specify the password.
密码:
230 Login successful.
ftp> ls
200 PORT command successful. Consider using PASV.
150 Here comes the directory listing.
**abc.txt**
226 Directory send OK.
ftp: 收到 12 字节，用时 0.00秒 12000.00千字节/秒。

chroot：禁锢用户于自己家目录

ftp://192.168.88.135/

通过hadoop用户登录后，可以上传文件，直接拖动文件到目录下即可

通过ftp客户端上传文件

[root@mail ~]# ftp 192.168.88.135
Connected to 192.168.88.135 (192.168.88.135).
220 (vsFTPd 2.2.2)
Name (192.168.88.135:root): hadoop
331 Please specify the password.
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> 
ftp> lcd /etc/vsftpd
Local directory now /etc/vsftpd
ftp> put vsftpd.conf
local: vsftpd.conf remote: vsftpd.conf
227 Entering Passive Mode (192,168,88,135,133,13).
150 Ok to send data.
226 Transfer complete.
4599 bytes sent in 1.6e-05 secs (287437.50 Kbytes/sec)
ftp> ls
227 Entering Passive Mode (192,168,88,135,65,182).
150 Here comes the directory listing.
-rw-r--r--    1 0        0               0 Apr 30 01:22 abc.txt
-rw-r--r--    1 2527     2527      8530914 Apr 30 01:29 python384rc1.chm
-rw-r--r--    1 2527     2527         4599 Apr 30 01:36 vsftpd.conf
226 Directory send OK.

#默认匿名用户不能上传文件
[root@mail ~]# ftp 192.168.88.135
Connected to 192.168.88.135 (192.168.88.135).
220 (vsFTPd 2.2.2)
Name (192.168.88.135:root): ftp
331 Please specify the password.
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> lcd /etc
Local directory now /etc
ftp> ls
227 Entering Passive Mode (192,168,88,135,138,4).
150 Here comes the directory listing.
drwxr-xr-x    2 0        0            4096 Mar 22  2017 pub
226 Directory send OK.
ftp> put inittab
local: inittab remote: inittab
227 Entering Passive Mode (192,168,88,135,75,133).
550 Permission denied.
#修改完/etc/vsftpd/vsftpd.conf配置文件中的【anon_upload_enable=YES】项后，重启服务器

#创建一个单独的目录，给ftp用户有编辑文件，供匿名用户来上传文件，
[root@mail vsftpd]# mkdir /var/ftp/upload
[root@mail vsftpd]# setfacl -m u:ftp:rwx /var/ftp/upload
[root@mail vsftpd]# getfacl /var/ftp/upload
getfacl: Removing leading '/' from absolute path names
# file: var/ftp/upload
# owner: root
# group: root
user::rwx
user:ftp:rwx
group::r-x
mask::rwx
other::r-x
[root@mail vsftpd]# ll -d /var/ftp/upload
drwxrwxr-x+ 2 root root 4096 Apr 30 09:45 /var/ftp/upload
#重新使用ftp命令上传文件
[root@mail ~]# ftp 192.168.88.135
Connected to 192.168.88.135 (192.168.88.135).
220 (vsFTPd 2.2.2)
Name (192.168.88.135:root): ftp
331 Please specify the password.
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> lcd /etc
Local directory now /etc
ftp> cd upload
250 Directory successfully changed.
ftp> put inittab
local: inittab remote: inittab
227 Entering Passive Mode (192,168,88,135,174,184).
150 Ok to send data.
226 Transfer complete.
884 bytes sent in 1.7e-05 secs (52000.00 Kbytes/sec)
ftp> ls
227 Entering Passive Mode (192,168,88,135,238,44).
150 Here comes the directory listing.
-rw-------    1 14       50            884 Apr 30 01:48 inittab
226 Directory send OK.
#在/etc/vsftpd/vsftpd.conf中未打开【anon_mkdir_write_enable=YES】配置项，匿名用户不能创建文件夹
ftp> mkdir test
550 Permission denied.
#在/etc/vsftpd/vsftpd.conf中打开【anon_mkdir_write_enable=YES】配置项,并重新启动vsftpd服务
ftp> cd upload
250 Directory successfully changed.
#创建目录
ftp> mkdir test
257 "/upload/test" created
#目录创建成功
ftp> ls
227 Entering Passive Mode (192,168,88,135,130,227).
150 Here comes the directory listing.
-rw-------    1 14       50            884 Apr 30 01:48 inittab
drwx------    2 14       50           4096 Apr 30 01:59 test
226 Directory send OK.
#启动欢迎信息项，需要显示欢迎信息的目录中创建一个【.message】文件
[root@mail upload]# vim .message
---welcome to upload directory---
---don't create illegal file---

ftp> cd upload
**250----welcome to upload directory---
250----don't create illegal file---**
250 Directory successfully changed.

#----没有禁锢用户在自己家目录前
[root@mail ~]# ftp 192.168.88.135
Connected to 192.168.88.135 (192.168.88.135).
220 (vsFTPd 2.2.2)
Name (192.168.88.135:root): hadoop
331 Please specify the password.
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> pwd
257 "/home/hadoop"

#----禁锢用户在家目录后
[root@mail ~]# ftp 192.168.88.135
Connected to 192.168.88.135 (192.168.88.135).
220 (vsFTPd 2.2.2)
Name (192.168.88.135:root): hadoop
331 Please specify the password.
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> pwd
257 "/"
#在/etc/vsftpd/目录下有一个文件ftpusers，此文件中定义了不能登录ftp的用户
[root@mail upload]# cd /etc/vsftpd/
[root@mail vsftpd]# ls
chroot_list  ftpusers  user_list  vsftpd.conf  vsftpd.conf.bak  vsftpd_conf_migrate.sh
[root@mail vsftpd]# cat ftpusers
# Users that are not allowed to login via ftp
root
bin
daemon
adm
lp
sync
shutdown
halt
mail
news
uucp
operator
games
nobody
[root@mail vsftpd]# cat /etc/pam.d/vsftpd
#%PAM-1.0
session    optional     pam_keyinit.so    force revoke
auth       required	pam_listfile.so item=user sense=deny file=/etc/vsftpd/ftpusers onerr=succeed
auth       required	pam_shells.so
auth       include	password-auth
account    include	password-auth
session    required     pam_loginuid.so
session    include	password-auth

/etc/vsftpd/vsftpd.conf配置文件说明

#是否允许匿名用户
anonymous_enable=YES
#是否启用系统用户
local_enable=YES
#是否允许上传文件
write_enable=YES
#默认匿名用户不能上传文件，打开此项则匿名用户只能上传文件
anon_upload_enable=YES
#打开此项表示匿名用户可以创建目录
anon_mkdir_write_enable=YES
#是否显示欢迎信息，需要在目录下创建一个【.message】文件
dirmessage_enable=YES
#是否打开传输日志，需同时启动以下两项配置
xferlog_enable=YES
xferlog_file=/var/log/xferlog
#修改用户上传后的文件权限
#chown_uploads=YES
#chown_username=whoever
#用户的会话时长，如超过此配置则断开连接---控制连接相关
#idle_session_timeout=600
#数据连接时间---数据连接相关
#data_connection_timeout=120
#是否以纯文本形式上传和下载文件
#ascii_upload_enable=YES
#ascii_download_enable=YES
#禁锢用户在自己的家目录下
#chroot_list_enable=YES
# 禁锢用户列表，只有在/etc/vsftpd/chroot_list目录下被禁锢
#chroot_list_file=/etc/vsftpd/chroot_list
#禁锢所有用户
chroot_local_user=YES
#启用/etc/vsftpd/user_list文件
userlist_enable=YES
#用户到底能不能登录，NO黑名单，YES白名单
userlist_deny=NO|YES
#最多允许多少个客户端连接ftp服务
max_clients=#
#限制每个IP同时发起几个连接请求
max_per_ip=#

FTP安全通信方式：
ftps：ftp+ssl/tls
sftp：openssh,subsystem,sftp（SSH）

#配置/etc/vsftpd/vsftpd.conf
#启动ssl功能
ssl_enable=YES
#支持tlsv1
ssl_tlsv1=YES
#支持sslv2
ssl_sslv2=YES
#支持sslv3
ssl_sslv3=YES
#不允许匿名登录
allow_anon_ssl=NO
#强制本地用户传输使用ssl
force_local_data_ssl=YES
#强制本地用户登录
force_local_logins_ssl=YES
#证书文件
rsa_cert_file=/etc/vsftpd/ssl/vsftpd_cert.pem
#密钥文件
rsa_private_key_file=/etc/vsftpd/ssl/vsftpd_key.pem

配置FTP的安全连接

#生成私钥文件
[root@mail ~]# (umask 077;openssl genrsa -out vsftpd.key 2048)
Generating RSA private key, 2048 bit long modulus
......................................................................................................................+++
.........................................................+++
e is 65537 (0x10001)

#生成证书签署文件
[root@mail ~]# openssl req -new -key vsftpd.key -out vsftpd.csr
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:HeNan
Locality Name (eg, city) [Default City]:ZhengZhou  
Organization Name (eg, company) [Default Company Ltd]:tye
Organizational Unit Name (eg, section) []:Tech
Common Name (eg, your name or your server's hostname) []:ftp.tye.com
Email Address []:admin@tye.com

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:

#将证书申请文件发送到CAServer进行签发

#配置
[root@mail ~]# mkdir /etc/vsftpd/ssl
[root@mail ~]# cp vsftpd.key /etc/vsftpd/ssl/vsftpd_key.pem
[root@mail ~]# cp vsftpd.crt /etc/vsftpd/ssl/vsftpd_cert.pem

通过MySQL管理vsftpd用户

#解压安装pam_mysql
[root@mail ~]# tar xf pam_mysql-0.7RC1.tar.gz 
[root@mail pam_mysql-0.7RC1]# ./configure --with-mysql=/usr/local/mysql --with-openssl
[root@mail pam_mysql-0.7RC1]# make && make install
[root@mail pam_mysql-0.7RC1]# ls /lib/security
pam_mysql.la  pam_mysql.so

mysql> create database vsftpd;
Query OK, 1 row affected (0.01 sec)

mysql> use vsftpd;
Database changed
mysql> create table users(id smallint auto_increment not null,name char(20) binary not null,password char(48) binary not null,primary key(id)));
Query OK, 0 rows affected (0.04 sec)

mysql> desc users;
+----------+-------------+------+-----+---------+----------------+
| Field    | Type        | Null | Key | Default | Extra          |
+----------+-------------+------+-----+---------+----------------+
| id       | smallint(6) | NO   | PRI | NULL    | auto_increment |
| name     | char(20)    | NO   |     | NULL    |                |
| password | char(48)    | NO   |     | NULL    |                |
+----------+-------------+------+-----+---------+----------------+
3 rows in set (0.01 sec)
#授权
mysql> grant select on vsftpd.* to vsftpd@localhost identified by 'vsftpd';
Query OK, 0 rows affected (0.00 sec)

mysql> grant select on vsftpd.* to vsftpd@127.0.0.1 identified by 'vsftpd';
Query OK, 0 rows affected (0.00 sec)
mysql> flush privileges;
Query OK, 0 rows affected (0.00 sec)
#插入数据
mysql> insert into users(name,password)values('edison',password('123456')),('tye',password('123456'));
Query OK, 2 rows affected (0.23 sec)
Records: 2  Duplicates: 0  Warnings: 0
[root@mail pam_mysql-0.7RC1]# mysql -uvsftpd -p
Enter password: 
Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 3
Server version: 5.6.10 MySQL Community Server (GPL)

Copyright (c) 2000, 2013, Oracle and/or its affiliates. All rights reserved.

Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

mysql> show databases;
+--------------------+
| Database           |
+--------------------+
| information_schema |
| test               |
| vsftpd             |
+--------------------+
3 rows in set (0.00 sec)

#建立pam所需的配置文件
[root@mail pam_mysql-0.7RC1]# vim /etc/pam.d/vsftpd.mysql
auth required /lib/security/pam_mysql.so user=vsftpd passwd=vsftpd db=vsftpd table=users usercolumn=name passwdcolumn=password crypt=2
account required /lib/security/pam_mysql.so user=vsftpd passwd=vsftpd db=vsftpd table=users usercolumn=name passwdcolumn=password crypt=2
#修改vsftpd配置文件
#确认以下几项是启用的
anonymous_enable=YES
local_enable=YES
write_enable=YES
anon_upload_enable=YES
anon_upload_enable=NO
anon_mkdir_write_enable=NO
chroot_local_user=YES
#添加以下选项
listen=YES
guest_enable=YES
guest_username=vsftpd
pam_service_name=vsftpd.mysql
#建立虚拟用户及对应的目录
[root@mail ~]# useradd -s /sbin/nologin -d /var/ftp2 vsftp
[root@mail ~]# chmod go+rw /var/ftp2
[root@mail ~]# passwd vsftp
Changing password for user vsftp.
New password: 
BAD PASSWORD: it is too simplistic/systematic
BAD PASSWORD: is too simple
Retype new password: 
passwd: all authentication tokens updated successfully.



[root@mail ~]# ftp 192.168.88.135
Connected to 192.168.88.135 (192.168.88.135).
220 (vsFTPd 2.2.2)
Name (192.168.88.135:root): edison
331 Please specify the password.
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp>