[Linux] vsftp启用虚拟用户功能

0、部署vsftp-server，请先跳转到此处，部署vsfpt-ssl功能，点击此处

1、在/etc/vsftpd.conf配置文件添加以下内容

#开启虚拟用户的功能
guest_enable=YES
#指定虚拟用户的宿主用户
guest_username=vir
#指定虚拟用户配置文件的存放路径
user_config_dir=/etc/vsftpd/vuser_conf
#虚拟用户和本地用户有相同的权限
virtual_use_local_privs=YES

2、建立虚拟用户名文件

[root@localhost ~]# vim /etc/vsftpd/vsftpd_users.conf
#输入奇数行为账号，偶数行为密码
f1
123456

3、生成认证文件,如果db_load命令不存在先安装(yum install db4 db4-utils)

1	[root@localhost ~]# db_load -T -t hash -f /etc/vsftpd/vsftpd_users.conf /etc/vsftpd/vsftpd_users.db

4、文件生成之后，修改文件权限

1	[root@localhost ~]# chmod 600 /etc/vsftpd/vsftpd_users.db

5、编辑认证文件,将其余行注释，只保留第一行和最后两行

“/etc/vsftpd/vsftpd_users”根据自己配置的文件设置，.db后缀无需添加

[root@localhost f2]# more /etc/pam.d/vsftpd
#%PAM-1.0
#session    optional     pam_keyinit.so    force revoke
#auth       required	pam_listfile.so item=user sense=deny file=/etc/vsftpd/ftpusers onerr=succeed
#auth       required	pam_shells.so
#auth       include	password-auth
#account    include	password-auth
#session    required     pam_loginuid.so
#session    include	password-auth
auth sufficient /lib64/security/pam_userdb.so db=/etc/vsftpd/vsftpd_users
account sufficient /lib64/security/pam_userdb.so db=/etc/vsftpd/vsftpd_users

6、建立虚拟用户配置文件存放位置

[root@localhost ~]# mkdir /etc/vsftpd/vuser_conf/
[root@localhost ~]# vim /etc/vsftpd/vuser_conf/f1
#添加以下内容
local_root=/var/ftp/f1
write_enable=YES
anon_umask=022
anon_world_readable_only=NO
anon_upload_enable=YES
anon_mkdir_write_enable=YES
anon_other_write_enable=YES

7、将f1用户加入/etc/vsftpd/chroot_list，/etc/vsftpd/vsftpd.user_list允许f1用户登录

[root@localhost vsftpd]# more /etc/vsftpd/chroot_list |grep f1
f1
[root@localhost vsftpd]# more /etc/vsftpd/vsftpd.user_list |grep f1
f1

8、重新启动vsftp

1	[root@localhost ~]# systemctl vsftpd restart

9、测试用户能否正常登录：

[root@localhost surgeftp_2.3f2_linux64]# ./sslftp 192.168.168.120
Connected to 192.168.168.120
220 (vsFTPd 3.0.2)
234 Proceed with negotiation.
starting SSL/TLS
sslinit 3
Negotiated secure protocol TLSv1.2, using an AES cipher.
200 PBSZ set to 0.
200 PROT now Private.
(secure) User: f1
331 Please specify the password.
(secure) Password: ******
Connection problem SSLTCP:525:ssl_read tcp:-1000:SSL failure. (SSL_ERROR_SSL):error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number
Channel open, login Failed!

提示的错误没找到任何相关文档，尝试用tcpdump抓包看看交互情况：

1
2

15:50:39.932746 IP 192.168.168.120.21 > 192.168.168.121.39398: Flags [P.], seq 1806:1816, ack 772, win 243, options [nop,nop,TS val 513318660 ecr 1441172002], length 10: FTP: 500 OOPS: [!ftp]
15:50:39.932769 IP 192.168.168.120.21 > 192.168.168.121.39398: Flags [P.], seq 1816:1851, ack 772, win 243, options [nop,nop,TS val 513318660 ecr 1441172002], length 35: FTP: cannot change directory:/var/ftp/f1[!ftp]

提示f1的目录不存在，尝试创建f1的目录，并修改权限：

1 2	mkdir -p /var/ftp/f1 chown ftp1.ftp1 /var/ftp/f1

再次登录，正常

[root@localhost surgeftp_2.3f2_linux64]# ./sslftp 192.168.168.120
Connected to 192.168.168.120
220 (vsFTPd 3.0.2)
234 Proceed with negotiation.
starting SSL/TLS
sslinit 3
Negotiated secure protocol TLSv1.2, using an AES cipher.
200 PBSZ set to 0.
200 PROT now Private.
(secure) User: f1
331 Please specify the password.
(secure) Password: ******
230 Login successful.
Type in "save" to save login details to /root/.netrc
sslftp> ls
226 Directory send OK.
sslftp> exit
221 Goodbye.
Channel Closed.

10、新增f2用户，修改vsftpd_users.conf配置文件，添加f2用户

[root@localhost ~]# vim /etc/vsftpd/vsftpd_users.conf
#输入奇数行为账号，偶数行为密码
f1
123456
f2
123456

11、重新生成认证文件

1	[root@localhost ~]# db_load -T -t hash -f /etc/vsftpd/vsftpd_users.conf /etc/vsftpd/vsftpd_users.db

12、将f2用户加入/etc/vsftpd/chroot_list，/etc/vsftpd/vsftpd.user_list允许f2用户登录

[root@localhost vsftpd]# more /etc/vsftpd/chroot_list |grep -E "f1|f2"
f1
f2
[root@localhost vsftpd]# more /etc/vsftpd/vsftpd.user_list |grep -E "f1|f2"
f1
f2

13、添加f2配置文件

vim /etc/vsftpd/vuser_conf/f2

local_root=/var/ftp/f2
write_enable=YES
anon_umask=022
anon_world_readable_only=NO
anon_upload_enable=YES
anon_mkdir_write_enable=YES
anon_other_write_enable=YES

14、创建f2目录，并修改权限

1 2	mkdir -p /var/ftp/f2 chown ftp1.ftp1 /var/ftp/f2

15、重新启动vsftpd

1	[root@localhost ~]# systemctl vsftpd restart

16、测试登录vsftpd是否正常

[root@localhost surgeftp_2.3f2_linux64]# ./sslftp 192.168.168.120
Connected to 192.168.168.120
220 (vsFTPd 3.0.2)
234 Proceed with negotiation.
starting SSL/TLS
sslinit 3
Negotiated secure protocol TLSv1.2, using an AES cipher.
200 PBSZ set to 0.
200 PROT now Private.
(secure) User: f2 
331 Please specify the password.
(secure) Password: ******
230 Login successful.
Type in "save" to save login details to /root/.netrc
sslftp>