网络系统管理Linux环境——StorageSrv之VSFTPD

[root@storagesrv ~]# yum install vsftpd -y

[root@storagesrv ~]# mkdir /webdata

[root@storagesrv ~]# useradd webadmin

[root@storagesrv ~]# cat /etc/vsftpd/vsftpd
webuser
123456
[root@storagesrv ~]#

[root@storagesrv ~]# db_load -T -t hash -f /etc/vsftpd/vsftpd /etc/vsftpd/vsftpd.db

[root@appsrv csk-rootca]# openssl genrsa -out ftp.key
Generating RSA private key, 2048 bit long modulus
...+++
.......+++
e is 65537 (0x10001)
[root@appsrv csk-rootca]#

[root@appsrv csk-rootca]# openssl req -new -key ftp.key -out ftp.csr
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:CN
State or Province Name (full name) []:China
Locality Name (eg, city) [Default City]:BeiJing
Organization Name (eg, company) [Default Company Ltd]:skills
Organizational Unit Name (eg, section) []:Operations Departments
Common Name (eg, your name or your server's hostname) []:ftp.chinaskills.cn
Email Address []:

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
[root@appsrv csk-rootca]#
[root@appsrv csk-rootca]#

[root@appsrv csk-rootca]# openssl ca -keyfile private/cakey.pem -cert csk-ca.pem -in ftp.csr -out ftp.crt

[root@appsrv csk-rootca]# scp ftp.crt ftp.key root@192.168.100.200:/root

[root@storagesrv ~]# cp -a /etc/vsftpd/vsftpd.conf{,.bak}
[root@storagesrv ~]# grep -Ev "^$|^#" /etc/vsftpd/vsftpd.conf.bak > /etc/vsftpd/vsftpd.conf
[root@storagesrv ~]#

[root@storagesrv ~]# cat /etc/vsftpd/vsftpd.conf
anonymous_enable=NO		# 修改为NO
local_enable=YES
write_enable=YES
local_umask=022
dirmessage_enable=YES
xferlog_enable=YES
connect_from_port_20=YES
xferlog_std_format=YES
listen=NO
listen_ipv6=YES
pam_service_name=vsftpd
userlist_enable=YES
tcp_wrappers=YES
# 添加内容
guest_enable=YES
guest_username=webadmin
user_config_dir=/etc/vsftpd
local_root=/webdata
allow_writeable_chroot=YES
chroot_local_user=YES
ssl_enable=YES
force_local_data_ssl=YES
force_local_logins_ssl=YES
rsa_cert_file=/root/ftp.crt
rsa_private_key_file=/root/ftp.key
deny_file={*.doc,*.docx,*.xlsx}
local_max_rate=100000
max_per_ip=2
pasv_min_port=40000
pasv_max_port=41000
[root@storagesrv ~]#

[root@storagesrv ~]# cat /etc/pam.d/vsftpd
# 注释其他撰写两条用户路径
#%PAM-1.0
#session    optional     pam_keyinit.so    force revoke
file=/etc/vsftpd/ftpusers onerr=succeed
#auth       required    pam_listfile.so item=user sense=deny file=/etc/vsftpd/ftpusers onerr=succeed
auth    required        pam_userdb.so db=/etc/vsftpd/vsftpd
account required        pam_userdb.so db=/etc/vsftpd/vsftpd
#auth       include     password-auth
#account    include     password-auth
#session    required     pam_loginuid.so
#session    include     password-auth
[root@storagesrv ~]#

[root@storagesrv ~]# cat /etc/vsftpd/webuser
local_root=/webdata
write_enable=YES
anon_upload_enable=YES
anon_mkdir_write_enable=YES
anon_other_write_enable=YES
[root@storagesrv ~]#

[root@storagesrv ~]# chmod 777 /webdata -
[root@storagesrv ~]# systemctl restart vsftpd

[root@insidecli ~]# yum install lftp -y

[root@insidecli ~]# vim /etc/lftp.conf
set ssl:verify-certificate no