centos7部署ftps，使用mysql管理账户

1、安装vsftp

yum install vsftpd

2、创建SSL证书

[root@test ssl]# openssl req -x509 -nodes -keyout /etc/ssl/private/vsftpd.pem -out /etc/ssl/private/vsftpd.pem -days 365 -newkey rsa:2048
Generating a 2048 bit RSA private key
..........................................................+++
.................................+++
writing new private key to '/etc/ssl/private/vsftpd.pem'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN 
State or Province Name (full name) []:guangdong
Locality Name (eg, city) [Default City]:shenzhen
Organization Name (eg, company) [Default Company Ltd]:XXX
Organizational Unit Name (eg, section) []:cloud
Common Name (eg, your name or your server's hostname) []:yas
Email Address []:XXX@xxx

3、配置ftp用户

[root@test ~]# vim /etc/vsftpd/vsftpd.conf
anonymous_enable=NO
local_enable=YES
write_enable=NO
local_umask=022
dirmessage_enable=YES
connect_from_port_20=YES
idle_session_timeout=600
listen=YES
pam_service_name=vsftpd
userlist_enable=YES
tcp_wrappers=YES
# 开启 ssl 并指定使用的协议
ssl_enable=YES
ssl_tlsv1=YES
ssl_sslv2=NO
ssl_sslv3=NO
# 指定证书和 key 文件
rsa_cert_file=/etc/ssl/private/vsftpd.pem
rsa_private_key_file=/etc/ssl/private/vsftpd.pem
# 安全选项
allow_anon_ssl=NO
force_local_data_ssl=YES
force_local_logins_ssl=YES
require_ssl_reuse=NO
ssl_ciphers=HIGH
# 指定主动模式时使用的端口范围
pasv_min_port=40000
pasv_max_port=50000

guest_enable=YES
guest_username=vsftpd
virtual_use_local_privs=YES
user_config_dir=/etc/vsftpd/vconf

4、配置虚拟用户
useradd vuser -s /sbin/nologin
5、安装mysql：

yum install mysql-server mysql-devel pam-devel -y
wget https://nchc.dl.sourceforge.net/project/pam-mysql/pam-mysql/0.7RC1/pam_mysql-0.7RC1.tar.gz
tar zxvf pam_mysql-0.7RC1.tar.gz -C /usr/src/
cd pam_mysql-0.7RC1/
./configure --with-mysql=/usr --with-pam=/usr --with-pam-mods-dir=/usr/lib
报错：
checking for C++ compiler default output file name... configure: error: C++ compiler cannot create executables
安装c++编译器：yum install gcc-c++
如果报错，执行：yum install mysql*
make && make install
yum install -y mariadb-server
systemctl start mariadb.service

6、配置数据库

# mysql -uroot -p
Enter password: 
Welcome to the MariaDB monitor.  Commands end with ; or \g.
Your MariaDB connection id is 3
Server version: 5.5.56-MariaDB MariaDB Server

Copyright (c) 2000, 2017, Oracle, MariaDB Corporation Ab and others.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

MariaDB [(none)]> create database vsftp;
Query OK, 1 row affected (0.00 sec)

MariaDB [(none)]> use vsftp;
Database changed
MariaDB [vsftp]> create table users (name char(16) binary ,passwd char(125) binary);
Query OK, 0 rows affected (0.01 sec)

MariaDB [vsftp]> INSERT INTO vsftp.users(name,passwd) VALUES ('tom',PASSWORD('123456')),('jerry',PASSWORD('654321'));
MariaDB [vsftp]> GRANT ALL ON vsftpd.* TO 'root'@'127.0.0.1' IDENTIFIED BY 'password';
MariaDB [vsftp]> GRANT ALL ON vsftpd.* TO 'root'@'localhost' IDENTIFIED BY 'passwrod';

7、修改pam配置

# cat /etc/pam.d/vsftpd
#%PAM-1.0
#session    optional     pam_keyinit.so    force revoke
#auth       required	pam_listfile.so item=user sense=deny file=/etc/vsftpd/ftpusers onerr=succeed
#auth       required	pam_shells.so
#auth       include	password-auth
#account    include	password-auth
#session    required     pam_loginuid.so
#session    include	password-auth
auth   required    /lib64/security/pam_userdb.so db=/etc/vsftpd/vftpuser
account required    /lib64/security/pam_userdb.so db=/etc/vsftpd/vftpuser

8、添加虚拟用户

[root@test vsftpd]# cat vftpuser.txt 
tom
123456
[root@test vsftpd]# db_load -T -t hash -f vftpuser.txt /etc/vsftpd/vftpuser.db
[root@test vusers_conf]# pwd
/etc/vsftpd/vusers_conf
[root@test vusers_conf]# cat tom 
anon_upload_enable=NO
anon_mkdir_write_enable=NO
anon_other_write_enable=NO
local_root=/home/vuser/pub
write_enable=YES
download_enable=YES
anon_world_readable_only=YES
local_umask=022

9、
报错1:
gnutls_record_recv an unexpected tls packet was received
解决：
chroot_local_user=YES
allow_writeable_chroot=YES

报错2：
[root@cloud ~]# ftp 10.22.1.53
Connected to 10.22.1.53 (10.22.1.53).
220 (vsFTPd 3.0.2)
Name (10.22.1.53:root): yas
530 Non-anonymous sessions must use encryption.
Login failed.
421 Service not available, remote server has closed connection
解决：命令行不能支持ssl加密连接，需要使用filezilla