CentOS下VSFTPD配置指南

1、通过YUM安装必需的vsftpd, pam, pam-devel；
2、通过编译安装必需的pam_mysql(下面附件里)；
3、修改默认vsftpd配置文件 (/etc/vsftpd/vsftpd.conf)以及添加ftp用户的权限配置文件(/etc/vsftpd/vconf/)；
4、添加虚拟系统用户，及其ftp用户登录认证数据库；
5、修改vsftpd默认的pam配置文件 (/etc/pam.d/vsftpd)；
6、添加ftp端口到防火墙，重启vsftpd服务，测试ftp虚拟用户登录。

1)
[simonsun@magic ~]$ sudo yum install vsftpd pam pam-devel
目前的版本为
vsftpd - 2.0.5-12.el5, pam - 0.99.6.2-3.27.el5, pam-devel - 0.99.6.2-3.27.el5。

2)
[simonsun@magic ~]$ wget http://prdownloads.sourceforge.net/pam-mysql/pam_mysql-0.7RC1.tar.gz
[simonsun@magic ~]$ tar zxvf pam_mysql-0.7RC1.tar.gz
[simonsun@magic ~]$ ls pam_mysql-0.7RC1
acinclude.m4  config.guess  configure     CREDITS     ltmain.sh    missing        pam_mysql.c        pkg.m4
aclocal.m4    config.h.in   configure.in  INSTALL     Makefile.am  mkinstalldirs  pam_mysql.spec     README
ChangeLog     config.sub    COPYING       install-sh  Makefile.in  NEWS           pam_mysql.spec.in  stamp-h.in
[simonsun@magic ~]$ vim pam_mysql-0.7RC1/configure
#修改configure中的一个bug,将下面的一段修改，加上#include <md5global.h>,原来没有此引用。
=================================
#include <md5global.h>
#include <md5.h>

int
main ()
{

md5_calc(0, 0, 0);

  ;
  return 0;
}
=================================
[simonsun@magic ~]$ cd pam_mysql-0.7RC1
[simonsun@magic pam_mysql-0.7RC1]$ ./configure
[simonsun@magic pam_mysql-0.7RC1]$ make
[simonsun@magic pam_mysql-0.7RC1]$ sudo make install
[simonsun@magic pam_mysql-0.7RC1]$ sudo cp /usr/lib/security/pam_mysql.* /lib/security/
注：centos 6.0下，这一步拷贝系统已经做好了，可以跳过。
3)
[simonsun@magic ~]$ sudo vim /etc/vsftpd/vsftpd.conf
======================================
anonymous_enable=NO
local_enable=YES
write_enable=YES
local_umask=022
#anon_upload_enable=YES
#anon_mkdir_write_enable=YES
dirmessage_enable=YES
xferlog_enable=YES
connect_from_port_20=YES
#chown_uploads=YES
#chown_username=whoever
xferlog_file=/var/log/vsftpd.log
xferlog_std_format=YES
#idle_session_timeout=600
#data_connection_timeout=120
#nopriv_user=ftpsecure
#async_abor_enable=YES
#ascii_upload_enable=YES
#ascii_download_enable=YES
ftpd_banner=Welcome to Magic Linux FTP service.

#deny_email_enable=YES
# (default follows)
#banned_email_file=/etc/vsftpd/banned_emails

chroot_local_user=YES
#chroot_list_enable=YES
# (default follows)
#chroot_list_file=/etc/vsftpd/chroot_list

#ls_recurse_enable=YES
listen=YES
listen_port=21
#listen_ipv6=YES

#下面是添加的：
guest_enable=YES
guest_username=vvsftpd        #虚拟系统用户，在下面的步骤4)里添加该用户到系统用户中。
user_config_dir=/etc/vsftpd/vconf/    #登录ftp的虚拟用户的权限配置文件。
pam_service_name=vsftpd
userlist_enable=YES
tcp_wrappers=YES
======================================
[simonsun@magic ~]$ sudo mkdir /etc/vsftpd/vconf/
[simonsun@magic ~]$ sudo vim /etc/vsftpd/vconf/myftp
======================================
write_enable=YES
anon_upload_enable=YES
anon_mkdir_write_enable=YES
anon_world_readable_only=NO
======================================

4)
[simonsun@magic ~]$ sudo /usr/sbin/useradd -d /home/vvsftpd -s /sbin/nologin vvsftpd
[simonsun@magic ~]$ mysql -u root -p
＃执行如下语句，为虚拟系统用户vvsftpd创建虚拟用户(如myftp)登录ftp时的认证数据库vsftpd
======================================
create database vsftpd;
use vsftpd;
create table user(name char(20) binary,passwd char(20) binary);
insert into user values ('myftp',ENCRYPT('ptfym'));
grant select on vsftpd.user to vvsftpd@localhost identified by 'PaSsWoRd';
flush privileges;
======================================

5)
[simonsun@magic ~]$ sudo vim /etc/pam.d/vsftpd
修改成如下
======================================
#%PAM-1.0
session    optional     pam_keyinit.so    force revoke
auth       required     pam_listfile.so item=user sense=deny file=/etc/vsftpd/ftpusers nerr=succeed
#auth       required    pam_shells.so
auth required /lib/security/pam_mysql.so user=vvsftpd passwd=PaSsWoRd host=localhost db=vsftpd table=user usercolumn=name passwdcolumn=passwd crypt=1
account required /lib/security/pam_mysql.so user=vvsftpd passwd=PaSsWoRd host=localhost db=vsftpd table=user usercolumn=name passwdcolumn=passwd crypt=1
#auth       include     system-auth
#account    include     system-auth
session    include      system-auth
session    required     pam_loginuid.so

======================================

6)
[simonsun@magic ~]$ sudo /sbin/iptables -I INPUT -p tcp --dport 20 -j ACCEPT
[simonsun@magic ~]$ sudo /sbin/iptables -I INPUT -p tcp --dport 21 -j ACCEPT
[simonsun@magic ~]$ sudo /etc/rc.d/init.d/iptables save
[simonsun@magic ~]$ sudo /etc/rc.d/init.d/iptables restart
清除防火墙规则：                                           [确定]
把 chains 设置为 ACCEPT 策略：filter nat                   [确定]
正在卸载 Iiptables 模块：                                  [确定]
应用 iptables 防火墙规则：                                 [确定]
载入额外 iptables 模块：ip_conntrack_netbios_ns            [确定]
[simonsun@magic ~]$ sudo /etc/rc.d/init.d/vsftpd restart
关闭 vsftpd：                                              [确定]
为 vsftpd 启动 vsftpd：                                    [确定]
[simonsun@magic ~]$ ftp shellfisher.3322.org //这个网址是我用3322网站关联的我本机在互联网上的IP对应的一个域名。
Connected to shellfisher.3322.org.
220 Welcome to Magic Linux FTP service.
530 Please login with USER and PASS.
530 Please login with USER and PASS.
KERBEROS_V4 rejected as an authentication type
Name (shellfisher.3322.org:simonsun): myftp
331 Please specify the password.
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls
227 Entering Passive Mode (221,215,250,110,86,88)
150 Here comes the directory listing.
226 Directory send OK.
ftp> mkdir testftp
257 "/testftp" created
ftp> ls     
227 Entering Passive Mode (221,215,250,110,43,155)
150 Here comes the directory listing.
drwx------    2 507      509          4096 Mar 24 08:32 testftp
226 Directory send OK.
ftp> quit
221 Goodbye.

 

以上均在CentOS5系列下测试过，centos6下需稍作改动，特别是pam_mysql.
======================================

参考链接：
http://blog.chinaunix.net/u/27493/showart_418571.html
http://wiki.centos.org/HowTos/Chroot_Vsftpd_with_non-system_users