源码安装vsftp服务

更新：2021-09-17

网络工具

1
2
3
## ifconfig netstat 等命令
# yum -y install net-tools
# netstat -ntpl

tcpdump

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
wget http://www.tcpdump.org/release/libpcap-1.10.1.tar.gz

wget http://www.tcpdump.org/release/tcpdump-4.99.1.tar.gz

tar -zxvf libpcap-1.10.1.tar.gz
cd libpcap-1.10.1
./configure
make & make install

tar -zxvf tcpdump-4.99.1.tar.gz
cd tcpdump-4.99.1
./configure
make & make install


tcpdump --version
1
2
3
4
tcpdump -i ens33 src 192.168.18.137

## 抓取 21 号端口报文
tcpdump tcp port 21

vsftpd

vsftpd-3.0.5

https://security.appspot.com/downloads/vsftpd-3.0.5.tar.gz

https://blog.csdn.net/dmlk31/article/details/111399858

1
2

https://security.appspot.com/vsftpd.html
1
grep -r "{关键字}"  {路径}
1
2
3
4
5
6
7
8
#ifndef VSF_BUILDDEFS_H
#define VSF_BUILDDEFS_H

#undef VSF_BUILD_TCPWRAPPERS
#define VSF_BUILD_PAM
#undef VSF_BUILD_SSL

#endif /* VSF_BUILDDEFS_H */
1
2
3
vim builddefs.h
vim 替换所有
:%s/undef/define/g
1
2
3
4
5
6
7
8
#ifndef VSF_BUILDDEFS_H
#define VSF_BUILDDEFS_H

#define VSF_BUILD_TCPWRAPPERS
#define VSF_BUILD_PAM
#define VSF_BUILD_SSL

#endif /* VSF_BUILDDEFS_H */

错误*

1
2
3
4
5
tcpwrap.c:16:20: fatal error: tcpd.h: No such file or directory
   #include <tcpd.h>
                    ^
compilation terminated.
make: *** [tcpwrap.o] Error 1
1
yum -y install tcp_wrappers tcp_wrappers-devel
1
2
3
4
5
ssl.c:28:25: fatal error: openssl/err.h: No such file or directory
 #include <openssl/err.h>
                         ^
compilation terminated.
make: *** [ssl.o] Error 1
1
2
3
4
5
6
ssl.c: In function ‘ssl_init’:
ssl.c:98:18: error: ‘SSL_OP_NO_TLSv1_3’ undeclared (first use in this function)
       options |= SSL_OP_NO_TLSv1_3;
                  ^
ssl.c:98:18: note: each undeclared identifier is reported only once for each function it appears in
make: *** [ssl.o] Error 1

以上错误需要升级 openssl

1
2
3
/usr/bin/ld: cannot find -lcap
collect2: error: ld returned 1 exit status
make: *** [vsftpd] Error 1
1
yum -y install libcap libcap-devel
1
# yum -y install tcp_wrappers tcp_wrappers-devel libcap libcap-devel pam-devel

如果是64位系统，需要替换lib目录的位置

1
sed -i 's/lib\//lib64\//g' vsf_findlibs.sh

编译安装

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
# mkdir -p /usr/local/vsftpd/{conf,conf/user,bin,lib,empty}
# touch /usr/local/vsftpd/conf/chroot

# mkdir -p /var/log/vsftpd

#  make && make install

# ln -sv /usr/local/sbin/vsftpd /usr/local/vsftpd/bin/vsftpd

## 查看编译的vsftpd二进制文件是否加载了 pam、ssl so
# [root@192 vsftpd-3.0.5]# ldd /usr/local/vsftpd/bin/vsftpd
        linux-vdso.so.1 =>  (0x00007ffc731a6000)
        libpam.so.0 => /lib64/libpam.so.0 (0x00007ff7af83d000)
        libdl.so.2 => /lib64/libdl.so.2 (0x00007ff7af639000)
        libnsl.so.1 => /lib64/libnsl.so.1 (0x00007ff7af41f000)
        libresolv.so.2 => /lib64/libresolv.so.2 (0x00007ff7af206000)
        libutil.so.1 => /lib64/libutil.so.1 (0x00007ff7af003000)
        libcap.so.2 => /lib64/libcap.so.2 (0x00007ff7aedfe000)
        libc.so.6 => /lib64/libc.so.6 (0x00007ff7aea31000)
        libaudit.so.1 => /lib64/libaudit.so.1 (0x00007ff7ae808000)
        /lib64/ld-linux-x86-64.so.2 (0x00007ff7afc72000)
        libattr.so.1 => /lib64/libattr.so.1 (0x00007ff7ae603000)
        libcap-ng.so.0 => /lib64/libcap-ng.so.0 (0x00007ff7ae3fd000)
## 复制配置文件    
# cp /root/vsftpd-3.0.5/vsftpd.conf /usr/local/vsftpd/conf

# vim /usr/local/vsftpd/conf/vsftpd.conf

anonymous_enable=NO　　// 不允许匿名登录
local_enable=YES　　// 允许本地用户登录
write_enable=YES　　// 允许本地用户写的权限
chroot_local_user=YES　　// 锁定用户根目录，不能切换到其他目录
chroot_list_enable=YES
chroot_list_file=/usr/local/vsftpd/conf/chroot
listen=YES
guest_enable=YES　　// 启用虚拟用户
guest_username=nginx　　// 虚拟用户映射的系统用户名为 nginx
pam_service_name=vsftpd　　// 设置 PAM 认证服务的配置文件名称，该文件存放在 /ect/pam.d 目录下
allow_writeable_chroot=YES　　// 从2.3.5之后，当锁定用户根目录后，如果发现根目录具有写权限则会报错
virtual_use_local_privs=YES　　// YES 表示虚拟用户使用与本地用户相同的权限，NO 表示则与匿名用户相同的权限
user_config_dir=/usr/local/vsftpd/conf/user　　// 定义用户个人配置文件所在的目录
secure_chroot_dir=/usr/local/vsftpd/empty
vsftpd_log_file=/var/log/vsftpd/vsftpd.log

listen_port=21
ftp_data_port=20

pasv_min_port=30000
pasv_max_port=30999

### ---------------- 可以创建目录 结束------------
## 必须对父母录有写权限
## chmod o+w /var/ftp/pub/
# 可写权限
write_enable=YES
# 是否允许匿名用户创建目录
anon_mkdir_write_enable=YES
### ---------------- 可以创建目录 结束------------

## delete and rename
anon_other_write_enable=YES

## upload
anon_upload_enable=YES

## 默认为YES,其它人必须有读权限才可以下载，所有设置为NO,ftp用户有读权限即可下载。
anon_world_readable_only=NO


####### 关闭匿名访问 
anonymous_enable=NO

## 本地用户可以登录
local_enable=YES

添加本地用户

1
2
useradd user1 -s /sbin/nologin
passwd users

pam 认证模块

1
2
## 映射虚拟用户
# useradd -d /data/ftpdata -g ftp -s /sbin/nologin ftpuser
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
local_enable=YES                               #是否允许本地用户登入,默认是YES
write_enable=YES                               #是否允许登陆用户有写权限
local_umask=022                                #本地用户新增文件时的umask值,默认值为077
xferlog_std_format=YES                         #日志文件将会写成xferlog的标准格式
ascii_upload_enable=YES                        #是否启用ASCII模式上传数据,默认值为NO
ascii_download_enable=YES                      #是否启用ASCII模式下载数据,默认值为NO
pam_service_name=vsftpd                        #设置PAM使用的名称,默认值为/etc/pam.d/vsftpd
userlist_enable=YES                            #是否启用user_list文件
userlist_file=/usr/local/vsftpd/conf/chroot    #控制用户访问FTP的文件,里面写着用户名称
tcp_wrappers=YES                               #是否与tcp wrapper相结合来进行主机的访问控制
guest_enable=YES                               #启用虚拟用户,默认值为NO
guest_username=ftpuser                         #映射虚拟用户,默认值为ftp
user_config_dir=/usr/local/vsftpd/conf/user    #设置用户配置文件所在的目录
allow_writeable_chroot=YES


是否启用 SSL,默认为no

---------------------------------------
anonymous_enable=NO
#
# Uncomment this to allow local users to log in.
local_enable=YES
write_enable=YES
local_umask=022
#xferlog_std_format=YES                         #日志文件将会写成xferlog的标准格式
#ascii_upload_enable=YES                        #是否启用ASCII模式上传数据,默认值为NO
#ascii_download_enable=YES                      #是否启用ASCII模式下载数据,默认值为NO
pam_service_name=vsftpd                        #设置PAM使用的名称,默认值为/etc/pam.d/vsftpd
#userlist_enable=YES                            #是否启用user_list文件
#userlist_file=/usr/local/vsftpd/conf/chroot    #控制用户访问FTP的文件,里面写着用户名称
#tcp_wrappers=YES                               #是否与tcp wrapper相结合来进行主机的访问控制

guest_enable=YES
guest_username=ftpuser

chroot_local_user=YES
chroot_list_enable=YES
chroot_list_file=/usr/local/vsftpd/conf/chroot

allow_writeable_chroot=YES
virtual_use_local_privs=YES
user_config_dir=/usr/local/vsftpd/conf/user
secure_chroot_dir=/usr/local/vsftpd/empty

1
2
3
4
5
vim /etc/pam.d/vsftpd

auth required pam_userdb.so db=/usr/local/vsftpd/conf/user/v_user_passwd
account required pam_userdb.so db=/usr/local/vsftpd/conf/user/v_user_passwd

创建用户名密码文本文件

1
2
3
4
5
vim /usr/local/vsftpd/conf/user/v_user_passwd.txt

添加如下内容（一行用户名一行密码）：
tom
u

用 db_load 生成用户数据库

1
2
3
4
db_load -T -t hash -f /usr/local/vsftpd/conf/user/v_user_passwd.txt /usr/local/vsftpd/conf/user/v_user_passwd.db

chmod 600 /usr/local/vsftpd/conf/user/v_user_passwd.db
chmod 600 /usr/local/vsftpd/conf/user/v_user_passwd.txt

配置虚拟用户自定义配置文件,tom用户

1
2
3
4
5
6
vim /usr/local/vsftpd/conf/user/tom

## 注意这里要修改 当前用户的属主.
local_root=/data/ftpdata/tom
local_umask=022
write_enable=YES

ssl

1
2
3
4
5
CN：姓名；OU：组织单位名称；O：组织名称；L：省/市/自治区名称；C：国家/地区代码

mkdir /usr/local/vsftpd/ssl

openssl req -newkey rsa:2048 -nodes -keyout /usr/local/vsftpd/ssl/vsftpd.key -x509 -days 365 -out /usr/local/vsftpd/ssl/vsftpd.pem -subj "/C=CN/ST=ShanDong/L=JiNan/O=arukas/OU=arukas/CN=arukas.io/emailAddress=vsftp@arukas.io"
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
配置vsftpd服务支持SSL：# vim /usr/local/vsftpd/conf/vsftpd.conf
ssl_enable=YES											#是否启用 SSL,默认为no
allow_anon_ssl=NO										#匿名不支持SSL
force_local_logins_ssl=YES：本地用户登录加密
force_local_data_ssl=YES：本地用户数据传输加密

ssl_tlsv1=YES
ssl_sslv2=YES
ssl_sslv3=YES

在配置文件中添加这一行：
# FileZilla Client 需要配置 ssl_ciphers=HIGH
ssl_ciphers=HIGH
rsa_cert_file=/usr/local/vsftpd/ssl/vsftpd.pem			#rsa证书的位置
rsa_private_key_file=/usr/local/vsftpd/ssl/vsftpd.key

开机自启

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
# vim /usr/lib/systemd/system/vsftpd.service

[Unit]
Description=Vsftpd Service
After=network.target syslog.target

[Service]
# start main service
ExecStart=/usr/local/vsftpd/bin/vsftpd /usr/local/vsftpd/conf/vsftpd.conf

# restart main service
ExecReload=/bin/kill -s HUP $MAINPID

# stop main service
ExecStop=/bin/kill -s QUIT $MAINPID

# use private tmp
PrivateTmp=true

[Install]
WantedBy=multi-user.target

# systemctl restart vsftpd
# systemctl enable vsftpd.service

开放端口

1
2
3
4
5
6
7
8
9
10
# firewall-cmd --add-port=21/tcp --permanent 
## 数据端口
# firewall-cmd --add-port=20/tcp --permanent

# firewall-cmd --permanent --zone=public --add-port=30000-30999/tcp
# firewall-cmd --reload

# firewall-cmd --zone=public --permanent --remove-port=20/tcp 

# cat /etc/firewalld/zones/public.xml

匿名用户只可以下载文件，

1
2
3
4
## 可写权限
# chmod o+w /var/ftp/pub/


openssl

https://www.openssl.org/source/

1
2
3
# openssl ciphers -v -tls1

# ldconfig -v

openssl1.1.11

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
# wget https://www.openssl.org/source/openssl-1.1.1l.tar.gz
# tar -zxvf openssl-1.1.1l.tar.gz
# cd openssl-1.1.11

# ./config
# make -j2 && make install

# ln -sv /usr/local/bin/openssl /usr/bin/openssl

# echo "/usr/local/lib64" > /etc/ld.so.conf.d/openssl.conf

# ldconfig

[root@Docker ~]# openssl version -a
OpenSSL 1.1.1l  24 Aug 2021
built on: Sun Sep 12 07:14:06 2021 UTC
platform: linux-x86_64
options:  bn(64,64) rc4(16x,int) des(int) idea(int) blowfish(ptr) 
compiler: gcc -fPIC -pthread -m64 -Wa,--noexecstack -Wall -O3 -DOPENSSL_USE_NODELETE -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASM -DNDEBUG
OPENSSLDIR: "/usr/local/ssl"
ENGINESDIR: "/usr/local/lib64/engines-1.1"
Seeding source: os-specific

openssl3.0

1
# wget https://www.openssl.org/source/openssl-3.0.0.tar.gz
1
2
3
4
Can't locate IPC/Cmd.pm in @INC (@INC contains: /root/openssl-3.0.0/util/perl /usr/local/lib64/perl5 /usr/local/share/perl5 /usr/lib64/perl5/vendor_perl /usr/share/perl5/vendor_perl /usr/lib64/perl5 /usr/share/perl5 . /root/openssl-3.0.0/external/perl/Text-Template-1.56/lib) at /root/openssl-3.0.0/util/perl/OpenSSL/config.pm line 18.
BEGIN failed--compilation aborted at /root/openssl-3.0.0/util/perl/OpenSSL/config.pm line 18.
Compilation failed in require at /root/openssl-3.0.0/Configure line 23.
BEGIN failed--compilation aborted at /root/openssl-3.0.0/Configure line 23.

需要执行：

1
2
3
4
5
6
7
8
# yum install perl-IPC-Cmd

# ./config --prefix=/usr/local/ssl --openssldir=/usr/local/ssl shared zlib
# make
# make test
# make install

# ln -sv /usr/local/bin/openssl /usr/bin/openssl

make test 会失败，忽略即可。

1
2
[root@Docker bin]# openssl version
openssl: error while loading shared libraries: libssl.so.3: cannot open shared object file: No such file or directory

解决方案如下：

With your original version of OpenSSL it knew how to find the shared libs because /usr/lib64 is included in the linker’s search path. When you downloaded and compiled a “local” copy of OpenSSL, the shared libs were placed in /usr/local/lib64 by default. So you probably just need to add this directory to the search path of the linker, like this (as root):

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
# echo "/usr/local/lib64" > /etc/ld.so.conf.d/openssl.conf

# ldconfig

[root@Docker ~]# openssl version -a
OpenSSL 3.0.0 7 sep 2021 (Library: OpenSSL 3.0.0 7 sep 2021)
built on: Sun Sep 12 06:26:39 2021 UTC
platform: linux-x86_64
options:  bn(64,64)
compiler: gcc -fPIC -pthread -m64 -Wa,--noexecstack -Wall -O3 -DOPENSSL_USE_NODELETE -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_BUILDING_OPENSSL -DNDEBUG
OPENSSLDIR: "/usr/local/ssl"
ENGINESDIR: "/usr/local/lib64/engines-3"
MODULESDIR: "/usr/local/lib64/ossl-modules"
Seeding source: os-specific
CPUINFO: OPENSSL_ia32cap=0xfffa32034f8bffff:0x9c67ab

参考文献

vsftp支持TLS加密传输的配置说明

赏

谢谢你请我吃糖果

支付宝
微信
|阅读量()

扫一扫，分享到微信

微信分享二维码
本站总访问量次 |

tag:

    缺失模块。
    1、请确保node版本大于6.2
    2、在博客根目录（注意不是yilia根目录）执行以下命令：
    npm i hexo-generator-json-content --save

    3、在根目录_config.yml里添加配置： 

      jsonContent:
    meta: false
    pages: false
    posts:
      title: true
      date: true
      path: true
      text: false
      raw: false
      content: false
      slug: false
      updated: false
      comments: false
      link: false
      permalink: false
      excerpt: false
      categories: false
      tags: true

Java码农