服務(wù)器：192.168.100.23 32位redhat5.7系統(tǒng)； 配置：yum本地源配置：[root@kvm-scm yum.repos.d]# pwd /etc/yum.repos.d [root@kvm-scm yum.repos.d]# cat rhel-source.repo [rhel-source] name=Red Hat Enterprise Linux $releasever - $basearch - Source #baseurl=ftp://ftp.redhat.com/pub/redhat/linux/enterprise/$releasever/en/os/SRPMS/ #baseurl=ftp://ftp.redhat.com/pub/redhat/linux/enterprise/$releasever/en/os/SRPMS/ baseurl=file:///mnt/rhel62/Server enabled=1 gpgcheck=0 gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release [rhel-source-beta] name=Red Hat Enterprise Linux $releasever Beta - $basearch - Source baseurl=ftp://ftp.redhat.com/pub/redhat/linux/beta/$releasever/en/os/SRPMS/ enabled=0 gpgcheck=1 gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-beta,file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release 系統(tǒng)環(huán)境、安裝包centOS 5.4 db4 vsftpd 需要RPM包 db4-tcl-4.3.29-10.el5_5.2 db4-4.3.29-10.el5_5.2 db4-java-4.3.29-10.el5_5.2 db4-utils-4.3.29-10.el5_5.2 db4-devel-4.3.29-10.el5_5.2 vsftpd-2.0.5-16.el5_5.1 2、安裝vsftp yum install vsftpd* yum install db4-* 添加虛擬用戶口令vim /etc/login.txt yzlread yzldsz!@# yzlwrite yzldsz#@! yzlother yzldsz*** 生成虛擬用戶口令認(rèn)證文件db_load -T -t hash -f /etc/login.txt /etc/vsftpd/vsftpd_login.db 注意：每次新加用戶，都要執(zhí)行此條，生成數(shù)據(jù)庫。 chmod 600 /etc/vsftpd/vsftpd_login.db 編輯vsftpd的PAM認(rèn)證文件vi /etc/pam.d/vsftpd 將里面的全部注釋掉，添加下面的兩行32位 authrequired/lib/security/pam_userdb.so db=/etc/vsftpd/vsftpd_login accountrequired/lib/security/pam_userdb.so db=/etc/vsftpd/vsftpd_login 注： 64位系統(tǒng)，動態(tài)庫位置有變化： /lib64/security/pam_userdb.so authrequired/lib64/security/pam_userdb.so db=/etc/vsftpd/vsftpd_login accountrequired/lib64/security/pam_userdb.so db=/etc/vsftpd/vsftpd_login 建立本地映射用戶并設(shè)置宿主目錄權(quán)限useradd -d /home/ftpsite -s /sbin/nologin virtual chmod 700 /home/ftpsite 配置vsftpd.conf解析：vi /etc/vsftpd/vsftpd.conf anonymous_enable=NO local_enable=YES listen=YES#設(shè)置VSFTP服務(wù)器啟動方式為獨立啟動 #virtual_use_local_privs=YES#將此配置注釋掉，否則虛擬用戶的權(quán)限無法細(xì)分 user_config_dir=/etc/vsftpd/vsftpd_user_conf#創(chuàng)建此目錄，此目錄為用戶的權(quán)限文件配置目錄 chroot_local_user=YES#設(shè)置目錄不可以更改主目錄 listen_port=21 pasv_enable=YES pasv_max_port=30000 pasv_min_port=30999 guest_enable=YES#開啟虛擬用戶 guest_username=virtual#FTP虛擬用戶對于的系統(tǒng)用戶 pam_service_name=vsftpd#PAM認(rèn)證文件 實例配置：cd /etc/vsftpd cp vsftpd.conf vsftpd.conf.orig echo>vsftpd.conf vim /etc/vsftpd/vsftpd.conf # Example config file /etc/vsftpd/vsftpd.conf # # The default compiled in settings are fairly paranoid. This sample file # loosens things up a bit, to make the ftp daemon more usable. # Please see vsftpd.conf.5 for all compiled in defaults. # # READ THIS: This example file is NOT an exhaustive list of vsftpd options. # Please read the vsftpd.conf.5 manual page to get a full idea of vsftpd's # capabilities. # # Allow anonymous FTP? (Beware - allowed by default if you comment this out). anonymous_enable=NO #anonymous_enable=YES # # Uncomment this to allow local users to log in. local_enable=YES # # Uncomment this to enable any form of FTP write command. write_enable=NO # # Default umask for local users is 077. You may wish to change this to 022, # if your users expect that (022 is used by most other ftpd's) local_umask=022 # # Uncomment this to allow the anonymous FTP user to upload files. This only # has an effect if the above global write enable is activated. Also, you will # obviously need to create a directory writable by the FTP user. anon_upload_enable=NO # # Uncomment this if you want the anonymous FTP user to be able to create # new directories. anon_mkdir_write_enable=NO anon_other_write_enable=NO anon_world_readable_only=NO # # Activate directory messages - messages given to remote users when they # go into a certain directory. dirmessage_enable=YES # # The target log file can be vsftpd_log_file or xferlog_file. # This depends on setting xferlog_std_format parameter xferlog_enable=YES # # Make sure PORT transfer connections originate from port 20 (ftp-data). connect_from_port_20=YES # # If you want, you can arrange for uploaded anonymous files to be owned by # a different user. Note! Using "root" for uploaded files is not # recommended! #chown_uploads=YES #chown_username=whoever # # The name of log file when xferlog_enable=YES and xferlog_std_format=YES # WARNING - changing this filename affects /etc/logrotate.d/vsftpd.log #xferlog_file=/var/log/xferlog # # Switches between logging into vsftpd_log_file and xferlog_file files. # NO writes to vsftpd_log_file, YES to xferlog_file xferlog_std_format=YES # # You may change the default value for timing out an idle session. #idle_session_timeout=600 # # You may change the default value for timing out a data connection. #data_connection_timeout=120 # # It is recommended that you define on your system a unique user which the # ftp server can use as a totally isolated and unprivileged user. #nopriv_user=ftpsecure # # Enable this and the server will recognise asynchronous ABOR requests. Not # recommended for security (the code is non-trivial). Not enabling it, # however, may confuse older FTP clients. #async_abor_enable=YES # # By default the server will pretend to allow ASCII mode but in fact ignore # the request. Turn on the below options to have the server actually do ASCII # mangling on files when in ASCII mode. # Beware that on some FTP servers, ASCII support allows a denial of service # attack (DoS) via the command "SIZE /big/file" in ASCII mode. vsftpd # predicted this attack and has always been safe, reporting the size of the # raw file. # ASCII mangling is a horrible feature of the protocol. #ascii_upload_enable=YES #ascii_download_enable=YES # # You may fully customise the login banner string: #ftpd_banner=Welcome to blah FTP service. # # You may specify a file of disallowed anonymous e-mail addresses. Apparently # useful for combatting certain DoS attacks. #deny_email_enable=YES # (default follows) #banned_email_file=/etc/vsftpd/banned_emails # # You may specify an explicit list of local users to chroot() to their home # directory. If chroot_local_user is YES, then this list becomes a list of # users to NOT chroot(). chroot_local_user=YES #chroot_list_enable=YES #chroot_list_enable=YES # (default follows) #chroot_list_file=/etc/vsftpd/chroot_list # # You may activate the "-R" option to the builtin ls. This is disabled by # default to avoid remote users being able to cause excessive I/O on large # sites. However, some broken FTP clients such as "ncftp" and "mirror" assume # the presence of the "-R" option, so there is a strong case for enabling it. #ls_recurse_enable=YES # # When "listen" directive is enabled, vsftpd runs in standalone mode and # listens on IPv4 sockets. This directive cannot be used in conjunction # with the listen_ipv6 directive. listen=YES # # This directive enables listening on IPv6 sockets. To listen on IPv4 and IPv6 # sockets, you must run two copies of vsftpd whith two configuration files. # Make sure, that one of the listen options is commented !! #listen_ipv6=YES listen_port=21 pasv_enable=YES pasv_max_port=30000 pasv_min_port=30999 guest_enable=YES guest_username=virtual pam_service_name=vsftpd #userlist_enable=YES tcp_wrappers=YES user_config_dir=/etc/vsftpd/vsftpd_user_conf dual_log_enable=YES vsftpd_log_file=/var/log/vsftpd.log 用戶配置權(quán)限mkdir /etc/vsftpd/vsftpd_user_conf vi /etc/vsftpd/vsftpd_user_conf/yzlread local_root=/home/ftpsite/ write_enable=YES anon_world_readable_only=NO vi /etc/vsftpd/vsftpd_user_conf/yzlwrite local_root=/home/ftpsite/如果/home/ftpsite/zhanxun write_enable=YES anon_world_readable_only=NO anon_upload_enable=YES anon_mkdir_write_enable=YES anon_other_write_enable=YES vi /etc/vsftpd/vsftpd_user_conf/yzlother local_root=/home/ftpsite/ write_enable=YES anon_world_readable_only=NO anon_upload_enable=YES 啟動服務(wù)：service vsftpd restart 訪問：ftp://192.168.0.222 問題分析：修改配置時報啟動錯誤：[root@kvm vsftpd]# service vsftpd restart Shutting down vsftpd:[OK] Starting vsftpd for vsftpd: 500 OOPS: bad bool value in config file for: guest_enable [FAILED] 登錄報認(rèn)證失?。?/span>但登錄的密碼實際并沒有錯誤。Connected to localhost (127.0.0.1). 220 (vsFTPd 2.2.2) Name (localhost:root): yzlread 331 Please specify the password. Password: 530 Login incorrect. Login failed. LOG日志：[root@kvm log]# tail -f vsftpd.log Wed Jul 18 12:06:33 2012 [pid 11846] [yzlwrite] FAIL LOGIN: Client "127.0.0.1" Wed Jul 18 12:07:10 2012 [pid 12033] CONNECT: Client "127.0.0.1" Wed Jul 18 12:07:41 2012 [pid 12199] CONNECT: Client "127.0.0.1" Wed Jul 18 12:08:14 2012 [pid 12198] [yzlread] FAIL LOGIN: Client "127.0.0.1" 檢查各配置項，沒有發(fā)現(xiàn)錯誤，完全按照文檔配置。 在32機器上正常，在64位機器上不正常。 最后檢查認(rèn)證的配置： [root@kvm log]# vim/etc/pam.d/vsftpd #%PAM-1.0 #sessionoptionalpam_keyinit.soforce revoke #authrequiredpam_listfile.so item=user sense=deny file=/etc/vsftpd/ftpusers onerr=succeed #authrequiredpam_shells.so #authincludepassword-auth #accountincludepassword-auth #sessionrequiredpam_loginuid.so #sessionincludepassword-auth authrequired/lib/security/pam_userdb.so db=/etc/vsftpd/vsftpd_login accountrequired/lib/security/pam_userdb.so db=/etc/vsftpd/vsftpd_login 分析：在想，難道是認(rèn)證的包不存在？ [root@kvm log]# ll/lib/security/pam_userdb.so ls: cannot access /lib/security/pam_userdb.so: No such file or directory [root@kvm log]# 果然不存在。 [root@kvm log]# find /lib64 -name pam_userdb.so /lib64/security/pam_userdb.so 原來，64位的庫位置變了！ 教訓(xùn)：從32位程序安裝到64位，要考慮動態(tài)庫的位置變化等因素。 啟動時報錯：/etc/init.d/vsftpd start|restart 教訓(xùn)： 安裝linux時最好先關(guān)閉selinux. 登錄報file size錯誤：[root@yun_zl ~]# ftp localhost Trying ::1... ftp: connect to address ::1Connection refused Trying 127.0.0.1... Connected to localhost (127.0.0.1). 220 (vsFTPd 2.2.2) Name (localhost:root): yzlwrite 331 Please specify the password. Password: /etc/vsftpd/vsftpd_login.db: file size not a multiple of the pagesize Login failed. rpm -qa|grep db4 db4-4.7.25-16.el6.i686 db4-devel-4.7.25-16.el6.x86_64 db4-devel-4.7.25-16.el6.i686 db4-cxx-4.7.25-16.el6.x86_64 db4-cxx-4.7.25-16.el6.i686 db4-4.7.25-16.el6.x86_64 db4-utils-4.7.25-16.el6.x86_64 刪除I686的包： rpm -e db4-devel-4.7.25-16.el6.i686 yum install db4-tcl-* Error Downloading Packages: db4-tcl-4.7.25-16.el6.x86_64: failure: Packages/db4-tcl-4.7.25-16.el6.x86_64.rpm from base: [Errno 256] No more mirrors to try. [root@yun_zl db4]# pwd /opt/soft/db4 wget http://mirror./centos/6/os/x86_64/Packages/db4-tcl-4.7.25-17.el6.x86_64.rpm db4-java-4.7.25-16.el6.x86_64.rpm 比較0.222環(huán)境： db4-4.7.25-16.el6.x86_64 db4-devel-4.7.25-16.el6.x86_64 db4-utils-4.7.25-16.el6.x86_64 db4-cxx-4.7.25-16.el6.x86_64 這幾個包都有，不用再安裝java,tcl等開發(fā)包。 再執(zhí)行： [root@yun_zl Packages]# db_load -T -t hash -f /etc/login.txt /etc/vsftpd/vsftpd_login.db db_load: /etc/vsftpd/vsftpd_login.db: file size not a multiple of the pagesize [root@yun_zl Packages]# file /etc/vsftpd/vsftpd_login.db /etc/vsftpd/vsftpd_login.db: Berkeley DB (Hash, version 9, native byte-order) db_load -T -t hash -f /etc/login.txt /etc/vsftpd/vsftpd_login1.db db_load -T -t hash -f /etc/login.txt /etc/vsftpd/vsftpd_login.db db_load: /etc/vsftpd/vsftpd_login.db: file size not a multiple of the pagesize db_load: DB->open: /etc/vsftpd/vsftpd_login.db: Invalid argument 刪除之并重建： [root@yun_zl Packages]# rm -rf /etc/vsftpd/vsftpd_login.db [root@yun_zl Packages]# db_load -T -t hash -f /etc/login.txt /etc/vsftpd/vsftpd_login.db OK！ 沒有報錯了。 原因： 使用yum installdb4-* 將32位的包也裝上了，弄錯了數(shù)據(jù)了。
FTP添加用戶vim /etc/login.txt 第一步：增加用戶yzlread yzldsz!@# yzlwrite yzldsz#@! yzlother yzldsz*** testwrite給測試部開的 yzl#@!test 第二部：生成虛擬用戶口令認(rèn)證文件注意：每次新加用戶，都要執(zhí)行此條，生成數(shù)據(jù)庫。 db_load -T -t hash -f /etc/login.txt /etc/vsftpd/vsftpd_login.db
第三部：新建目錄
/home/ftpsite/zhanxun測試部跟展訊使用
必須執(zhí)行 chown virtual.virtual -R zhanxun
第四步：配置權(quán)限
# cd /etc/vsftpd/vsftpd_user_conf #vim testwrite用戶名
local_root=/home/ftpsite/zhanxun write_enable=YES anon_world_readable_only=NO anon_upload_enable=YES anon_mkdir_write_enable=YES anon_other_write_enable=YES
第五步：重啟服務(wù)
service vsftpd restart |
|
|
