Construction and configuration of vSFTPD server on CentOS 6.x

Posted by Vijay.Bansode on Sun, 02 Jun 2019 21:12:06 +0200

Abstract:

        Hand-in-hand teaches you how to build a vsftpd server, which implements virtual user authentication based on db files and MySQL database files. Of course, this article also includes the problem checking in the process of building, haha.

        In addition, I also built tests on CentOS 7.x. The steps are consistent, individual commands will be different, but the test effect will not be affected.


Server deployment requirements analysis (implementation effect):

1. Encrypt the whole process of login and transmission.
2. Record the log of files uploaded and downloaded by users.
3. For each user, there are public folders (files can be seen and downloaded by everyone) and private folders (files can be uploaded and downloaded only by oneself).

1. Installation of vsftpd service:

1. Search for the installation package of vsftpd in the yum source:
[root@dba ~]# cat /etc/centos-release 
CentOS release 6.5 (Final)

[root@dba ~]# yum list | grep -i "vsftpd"
vsftpd.x86_64                               2.2.2-24.el6                 base   
You have new mail in /var/spool/mail/root

2. Install vsftpd service program:

[root@dba ~]# yum list | grep -i "vsftpd" && yum -y install vsftpd

[root@dba ~]# whereis vsftpd
vsftpd: /usr/sbin/vsftpd /etc/vsftpd /usr/share/man/man8/vsftpd.8.gz

3. Start the vsftpd service program:

[root@dba ~]# /etc/init.d/vsftpd start
//Start vsftpd: vsftpd: \\\\\\\\\

[root@dba ~]# netstat -lntp | grep "21"
tcp        0      0 0.0.0.0:21                  0.0.0.0:*                   LISTEN      1677/vsftpd

4. Visit vsftpd service:

Browser access: ftp://192.168.0.110/ The / var/ftp/pub directory is accessed by default.

Customer Degree Access (recommended filezilla): https://www.filezilla.cn/download/client


2. Detailed description of vsftpd service configuration:

1. Backup configuration file and user black-and-white list configuration:

[root@dba ~]# cd /etc/vsftpd/
[root@dba vsftpd]# ll
//Total dosage 20
-rw------- 1 root root  125 3 month  22 20:14 ftpusers
-rw------- 1 root root  361 3 month  22 20:14 user_list
-rw------- 1 root root 4599 3 month  22 20:14 vsftpd.conf
-rwxr--r-- 1 root root  338 3 month  22 20:14 vsftpd_conf_migrate.sh
[root@dba vsftpd]# cp vsftpd.conf vsftpd.conf_bak
[root@dba vsftpd]# ll
//Total dosage 28
-rw------- 1 root root  125 3 month  22 20:14 ftpusers
-rw------- 1 root root  361 3 month  22 20:14 user_list
-rw------- 1 root root 4599 3 month  22 20:14 vsftpd.conf
-rw------- 1 root root 4599 8 month  18 23:21 vsftpd.conf_bak
-rwxr--r-- 1 root root  338 3 month  22 20:14 vsftpd_conf_migrate.sh

ftpusers: Preservation ftp Login user blacklist, in which users need to enter a user name and password, but can not login successfully.
user_list: User whitelist (blacklist) list, whitelist or blacklist by vsftpd.conf Medium parameters are controlled.
//White list:
userlist_enable=YES    #Enabling User List Function
userlist_deny=NO    #Configuration does not disable user login in user_list
userlist_file=/etc/vsftpd/user_list    #Specify the path and file name of the user list file
userlist_log=YES    #Blocked user log based on user_list
//Blacklist:
userlist_enable=YES    #Enabling User List Function
userlist_deny=YES    #Configuration disables user login in user_list. Users entering login name in list will be blocked without entering password, which is safer than ftpusers.
userlist_file=/etc/vsftpd/user_list    #Specify the path and file name of the user list file
userlist_log=YES

2. Introduction of other important configurations:

Configuration item grammar format: directive=value
	Anonymous users:
		Anonymous users are mapped to ftp users, only if the owner has write rights.
		Whether anonymous users are allowed to log in:
		anonymous_enable=YES
			Upload operation for anonymous users; validity depends on write_enable=YES
			anon_upload_enable=NO
			workdirrite_enable=YES
			The owner has the right to write.
		anon_mkdir_write_enable=NO
			The permission of anonymous users to create directories;
		anon_other_write_enable=NO
			Anonymous users delete and rename operation permissions;
	Local users:		
	        local_enable
			All non-anonymous users depend on this instruction to take effect.
		local_umask
			The permission mask for local users to upload files;
	Catalog message:
		dirmessage_enable
			The first time a user enters a directory, vsftpd looks at the. message file and displays its contents to the user. Messageag_file specifies the file path instead of using the default. message.
		messag_file
	Data transmission log:
		xferlog_enable
		xferlog_std_format
		xferlog_file=/var/log/vsftpd.log
		vsftpd_log_file
	Data transmission mode:
		connect_from_port_20; whether PORT mode is enabled or not, the default is NO;
	To modify the owner of files uploaded by anonymous users:
		chown_uploads: Whether to modify;
		chown_username: When the chown_uploads instruction is enabled, the file owner is modified to the user specified by the instruction; the default is root;
		chown_upload_mode: Set the permission for anonymous users to upload files; default is 600;
	Set the session timeout:
		idle_session_timeout, the time-out of idle session;
		connect_timeout: In PORT mode, the time-out for server to connect client is long.
		data_connection_timeout: The time-out of data transmission;
	Command-connected listening ports:
		listen_port=20
	Set connection and port rate:
	        local_max_rate: The transmission rate of the local user in bytes; default is 0, which means unlimited;
		anon_max_rate: the maximum transmission rate of anonymous users;
		max_clients: Maximum number of concurrent connections, on the server side;
		max_per_ip: The maximum number of connections initiated by each client at the same time;
	Login welcome information:
		ftp_banner="Welcome"
	Local users are confined:
		chroot_local_user=YES; imprisons all local users;
			Note: Require users not to have write access to home directories;

		chroot_list_enable=YES;
		chroot_list_file=/etc/vsftpd/chroot_list;
			Confinement specifies the user in the home directory;
Virtual user configuration:
        Based on db file:
            /etc/vsftpd/vusers.txt
            Odd rows: username
            Even lines: password
        Based on mysql database:
            User names and passwords can be added to the database through SQL statements, and vsftpd achieves user authentication through pam interface to link with mysql database.

Note: When virtual users and anonymous users log on to the FTP server, they are mapped to a user in the local user list. The default is ftp, but they can also be specified manually!            
[root@dba vsftpd]# cat /etc/passwd | grep ftp
ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin

3. Typical configuration cases of vsftpd:

1. Virtual user authentication based on db_load:

#1.1 Modify the relevant configuration items in vsftpd.conf:
anonymous_enable=NO
chroot_local_user=YES
pam_service_name=vsftpd    #Open the pam authentication function, and the corresponding pam configuration file is named vsftpd

guest_enable=YES
guest_username=ftp
user_config_dir=/etc/vsftpd/user_conf

#1.2 Create a user profile directory:
[root@dba vsftpd]# install -d /etc/vsftpd/user_conf
[root@dba vsftpd]# ll
//Total dosage 28
-rw------- 1 root root  125 3 month  22 20:14 ftpusers
drwxr-xr-x 2 root root 4096 8 month  19 00:08 user_conf
-rw------- 1 root root  361 3 month  22 20:14 user_list
-rw------- 1 root root  894 8 month  19 00:08 vsftpd.conf
-rw------- 1 root root 4599 8 month  18 23:21 vsftpd.conf_bak
-rwxr--r-- 1 root root  338 3 month  22 20:14 vsftpd_conf

#1.3 Create ftp username password source file and corresponding database file:
[root@dba vsftpd]# touch vusers
[root@dba vsftpd]# echo -e "user01\nuser01" vusers 
[root@dba vsftpd]# echo -e "user02\nuser02" >> vusers 
[root@dba vsftpd]# more vusers 
user01
user01
user02
user02

[root@dba vsftpd]# db_load -T -t hash -f /etc/vsftpd/vusers /etc/vsftpd/login.db
[root@dba vsftpd]# ll
//Total dosage 44
-rw-r--r-- 1 root root 12288 8 month  19 00:20 login.db
-rw-r--r-- 1 root root    28 8 month  19 00:17 vusers

#1.4 Create configuration files for each user:
[root@dba vsftpd]# cd user_conf/
[root@dba user_conf]# more user02 
# When using local_root to specify a home directory for a virtual user (the default directory after ftp login is successful), you can specify it in a user's separate configuration file, or add user to create a new user, and specify the user's home directory with the - d option.
local_root=/ftp/user02
write_enable=YES
anon_umask=022
anon_world_readable_only=NO
anon_upload_enable=YES
anon_mkdir_write_enable=YES
anon_other_write_enable=YES

#1.5 Configure pam authentication file to associate users in db file with vsftpd service:
[root@dba pam.d]# ll vsftpd*
-rw-r--r-- 1 root root 101 8 month  19 00:28 vsftpd
-rw-r--r-- 1 root root 335 8 month  19 00:27 vsftpd.bak
[root@dba pam.d]# more vsftpd
auth required pam_userdb.so db=/etc/vsftpd/login
account required pam_userdb.so db=/etc/vsftpd/login

#1.6 Create the ftp home directory corresponding to the user:
[root@dba user_conf]# mkdir -p /ftp/user01/upload
[root@dba user_conf]# mkdir -p /ftp/user02/upload
[root@dba user_conf]# ls -ld /ftp/*
drwxr-xr-x 3 root root 4096 8 month  19 00:31 /ftp/user01
drwxr-xr-x 3 root root 4096 8 month  19 00:31 /ftp/user02

//Because the user user01 and user02 created above login to the ftp server, mapping the cost of user ftp to create files and directories, it is necessary to have the opportunity that the user's home directory belongs to the user: ftp
[root@dba ftp]# chown ftp:root user01
[root@dba ftp]# chown ftp:root user02
[root@dba ftp]# ls -ld *
drwxr-xr-x 3 ftp root 4096 8 month  19 00:31 user01
drwxr-xr-x 3 ftp root 4096 8 month  19 00:31 user02

//Note: When authorizing a user's home directory, it should be noted that sometimes when there are write permissions in the home directory, errors will be reported when logging in or uploading files.


#1.7 Problem solving:
//After doing the above, the client can login to the ftp server normally, but the upload file to the user upload directory is wrong:
    response: 	553 Could not create file.
    error: 	Serious file transfer error

//So looking at the upload directory write permission, we found that upload directory belongs to the wrong sovereignty limit, and upload files after modification are normal.
[root@dba ftp]# ls -ld user01/upload
drwxr-xr-x 2 root root 4096 8 month  19 00:31 user01/upload
[root@dba ftp]# ls -ld user02/upload
drwxr-xr-x 2 root root 4096 8 month  19 00:31 user02/upload
[root@dba ftp]# chown -R ftp:root user01/upload
[root@dba ftp]# chown -R ftp:root user02/upload
[root@dba ftp]# ls -ld user01/upload
drwxr-xr-x 2 ftp root 4096 8 month  19 00:31 user01/upload
[root@dba ftp]# ls -ld user02/upload
drwxr-xr-x 2 ftp root 4096 8 month  19 00:31 user02/upload

#1.8 For historical reasons, FTP protocol adopts non-encrypted authentication and data transmission by default. There are two options to make authentication and transmission process encrypted temporarily.
//Scheme 1: openssl built-in ftp server for encryption transmission, specific configuration cases can be referred to link: http://blog.csdn.net/xinxinxin19881112/article/details/46831311
//Scheme 2: Using vsftpd server-side program, modify the configuration to encrypt authentication and transmission process. The specific configuration is as follows:
//First, the pem certificate file used for encryption is generated:
[root@dba ftp]# openssl req -x509 -nodes -days 365 -newkey rsa:1024 -keyout /etc/vsftpd/vsftpd.pem -out /etc/vsftpd/vsftpd.pem
Generating a 1024 bit RSA private key
.++++++
........++++++
writing new private key to '/etc/vsftpd/vsftpd.pem'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:BeiJing
Locality Name (eg, city) [Default City]:BJ
Organization Name (eg, company) [Default Company Ltd]:360
Organizational Unit Name (eg, section) []:Security
Common Name (eg, your name or your server's hostname) []:anonymous.org

Email Address []:You have new mail in /var/spool/mail/root

//The generated pem file is as follows:
[root@dba ~]# ll /etc/vsftpd/vsftpd.pem 
-rw-r--r-- 1 root root 1876 8 month  19 00:52 /etc/vsftpd/vsftpd.pem

//Then, modify the vsftpd.conf configuration file to open encryption:
# Enabling TLS/SSL
ssl_enable=YES
allow_anon_ssl=NO
force_local_data_ssl=YES
force_local_logins_ssl=YES
ssl_tlsv1=YES
ssl_sslv2=NO
ssl_sslv3=NO
require_ssl_reuse=NO
ssl_ciphers=HIGH
rsa_cert_file=/etc/vsftpd/vsftpd.pem
rsa_private_key_file=/etc/vsftpd/vsftpd.pem
# Define port range for connections in passive mode
pasv_max_port=65535
pasv_min_port=64000

//Restart the vsftpd service:
### CentOS 6.x
[root@dba vsftpd]# /etc/init.d/vsftpd restart
//Turn off vsftpd: [Confirm]
//Start vsftpd: vsftpd: \\\\\\\\\

### CentOS 7.x
[root@dba vsftpd]# systemctl start vsftpd

[root@dba vsftpd]# netstat -lntp | grep 21
tcp        0      0 0.0.0.0:21                  0.0.0.0:*                   LISTEN      2951/vsftpd

//After reboot, use FileZilla client to connect to the vsFTPd server, you can upload and download files normally.

2. Implementing anonymous user authentication based on pam_mysql:

[root@dba pam.d]# uname -a
Linux dba.com 2.6.32-431.el6.x86_64 #1 SMP Fri Nov 22 03:15:09 UTC 2013 x86_64 x86_64 x86_64 GNU/Linux

# 2.1 Install MySQL database and configure virtual username and password for vsftpd login:
[root@dba pam.d]# yum -y install mysql-server
[root@dba pam.d]# yum grouplist | grep -i "develop"
   Additional Development
   Desktop Platform Development
   Development tools
   Server Platform Development
   
[root@dba ~]# mysql -u root -p123456
mysql> create database vsftpd;
mysql> use vsftpd;
mysql> create table users (
    -> id int AUTO_INCREMENT NOT NULL,
    -> name char(16) binary NOT NULL,
    -> passwd char(48) binary NOT NULL,
    -> primary key(id)
    -> );
mysql> create table logs (msg varchar(255),
    -> user char(16),
    -> pid int,
    -> host char(32),
    -> rhost char(32),
    -> logtime timestamp
    -> );
    
mysql> desc users;
+--------+----------+------+-----+---------+----------------+
| Field  | Type     | Null | Key | Default | Extra          |
+--------+----------+------+-----+---------+----------------+
| id     | int(11)  | NO   | PRI | NULL    | auto_increment |
| name   | char(16) | NO   |     | NULL    |                |
| passwd | char(48) | NO   |     | NULL    |                |
+--------+----------+------+-----+---------+----------------+
3 rows in set (0.03 sec)

mysql> insert into users(name, passwd) values ('test', password('test'));
Query OK, 1 row affected (0.08 sec)

mysql> select * from users;
+----+------+-------------------------------------------+
| id | name | passwd                                    |
+----+------+-------------------------------------------+
|  1 | test | *94BDCEBE19083CE2A1F959FD02F964C7AF4CFC29 |
+----+------+-------------------------------------------+
1 row in set (0.00 sec)

# 2.2 Download and install the pam_mysql plug-in:
 [root@dba ~]# yum install openssl-devel
 [root@dba ~]# yum install mysql-devel
 [root@dba ~]# wget
[root@dba ~]# tar -zxf pam_mysql-0.7RC1.tar.gz 
[root@dba ~]# cd pam_mysql-0.7RC1
[root@dba ~]# ./configure --with-mysql=/usr --with-openssl=/usr --with-pam-mods-dir=/lib64/security
[root@dba ~]# make && make install

[root@dba ~]# ll /lib64/security/pam_mysql.*
-rwxr-xr-x 1 root root    873 Aug 19 12:27 /lib64/security/pam_mysql.la
-rwxr-xr-x 1 root root 133356 Aug 19 12:27 /lib64/security/pam_mysql.so
# 2.3 Modify the configuration of vsftpd.conf and/etc/pam.d/vsftpd.mysql
#pam_service_name=vsftpd
pam_service_name=vsftpd.mysql

[root@dba pam.d]# more vsftpd.mysql 
auth 	required /lib64/security/pam_mysql.so db=vsftpd user=root passwd=123456 host=localhost table=users usercolumn=name passwdcolumn=passwd crypt=2
account required /lib64/security/pam_mysql.so db=vsftpd user=root passwd=123456 host=localhost table=users usercolumn=name passwdcolumn=passwd crypt=2

### Introduction of crypt parameters:
[root@dba pam_mysql-0.7RC1]# less README
crypt (plain)

    The method to encrypt the user's password:

       0 (or "plain") = No encryption.  Passwords stored in plaintext.
                        HIGHLY DISCOURAGED.

       1 (or "Y")     = Use crypt(3) function.

       2 (or "mysql") = Use MySQL PASSWORD() function. It is possible
                        that the encryption function used by PAM-MySQL
                        is different from that of the MySQL server, as
                        PAM-MySQL uses the function defined in MySQL's
                        C-client API instead of using PASSWORD() SQL function
                        in the query.
                        
       3 (or "md5")   = Use plain hex MD5.

       4 (or "sha1")  = Use plain hex SHA1.

[root@dba pam.d]# /etc/init.d/vsftpd restart
Shutting down vsftpd:                                      [  OK  ]
Starting vsftpd for vsftpd:                                [  OK  ]

//Above all, the virtual user authentication environment of vsftpd server based on mysql has been built, and the next step is to start testing...


GG,Upload the file and report the error again...
//Response: 550 Permission denied.
//Error: Serious file transfer error
//Error reporting is consistent with the previous one. Perhaps it is the problem of permission allocation, huh-huh.

"test"When the account login is successful, it is mapped to ftp Users operate on files and directories, so they enter/var/ftp/Directory to view configuration files and ftp User identification.
guest_enable=YES
guest_username=ftp
user_config_dir=/etc/vsftpd/user_conf
[root@dba vsftpd]# cat /etc/passwd | grep ftp
ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin

[root@dba vsftpd]# cd /var/ftp/
[root@dba ftp]# ls -ld ../* | grep ftp
drwxr-xr-x   3 root root 4096 Aug 18 22:53 ../ftp
You have new mail in /var/spool/mail/root
[root@dba ftp]# ls -ld *
drwxr-xr-x 2 root root 4096 Mar 22 20:14 pub
//You can see the above ftp and upload directories, ftp users are not authorized to write, you can modify the way is to modify the upload directory permissions after restarting vsftpd can upload, Ok, then start!
[root@dba ftp]# chown ftp pub
[root@dba ftp]# ll
total 4
drwxr-xr-x 2 ftp root 4096 Mar 22 20:14 pub
//This should be no problem after the modification, haha ha, the results of a test and GG. Therefore, the investigation should be carried out step by step.
1,Catalog permission settings are definitely okay
2,That's the estimate. vsftpd Configuration file read and write permission settings, because of my ftp The user exists in a configuration file with the same name as the user in a separate directory, so a new name is created. test Configuration file, configuration paste up:
[root@dba user_conf]# pwd
/etc/vsftpd/user_conf
You have new mail in /var/spool/mail/root
[root@dba user_conf]# more test 
local_root=/var/ftp
write_enable=YES
anon_umask=022
anon_world_readable_only=NO
anon_upload_enable=YES
anon_mkdir_write_enable=YES
anon_other_write_enable=YES

Ok,restart vsftpd Testing, finally upload files, get it done...

IV. Summary of vsftpd deployment issues:

Waiting for updates...


Topics: vsftpd ftp MySQL yum