FTP SERVER (Proftpd) for LINUX. (Full tutorial)

PROFTPD

I. Giới thiệu.

Cài trên centOS 4.4 Final (updated PHP 5.x.x, MySQL 5.x.x, Apache 2.x.x)

II. Download.
Download gói cài đặt: proftpd-1.3.0.tar.gz (http://mirrors.ibiblio.org/pub/mirrors/proftpd/distrib/source/)

III. Cài đặt.
Copy gói cần cài đặt đến thư mục bất kỳ, chẳng hạn: /home/abc/setup/

Giải nén:
#pwd
/home/abc/setup/proftpd-1.3.0
#tar –zxf proftpd-1.3.0.tar.gz
#cd proftpd-1.3.0
# ./configure –prefix=/usr/local/proftpd \
–enable-dso \
–enable-ctrls \
–enable-ipv6 \
–with-modules=mod_sql:mod_sql_mysql:mod_quotatab:mod_quo tatab_sql \
–with-includes=/usr/local/mysql/include/mysql/ \
–with-libraries=/usr/local/mysql/lib/mysql

#make

#make install

Cài đặt thành công.

Proftpd được cài vào thư mục /usr/local/proftpd
Xem thư mục đã cài đặt ở đây. (Cấu hình nguyên bản sau khi cài đặt – chưa chỉnh sửa.)

Test thử:
#cd /usr/local/proftpd/sbin
#./proftpd

Proftpd sẽ nhận cấu hình mặc định, account để login ftp server là account hệ thống. Có thể test thử bằng account anonymous hoặc test bằng account hệ thống đều được.

IV. Cấu hình.

Tuỳ thuộc vào yêu cầu cụ thể cũng như mục đích sử dụng FTP SERVER ta có cấu hình tương ứng:

Chứng thực account qua file text.
(Cách làm khá đơn giản và hiệu quả. Tất nhiên việc xác thực qua account hệ thống sẽ đươc bỏ qua)

Cấu hình lần lượt như sau:
-Copy toàn bộ thư mục /home/tinh_cx/setup/proftpd-1.3.0/sample-configurations sang thư mục: /usr/local/proftpd/

#mkdir /usr/local/proftpd/PFTEST
#cp /home/tinh_cx/setup/proftpd-1.3.0/sample-configurations/* /usr/local/proftpd/PFTEST
#cd /usr/local/proftpd/PFTEST

-Chỉnh sửa các file cấu hình theo yêu cầu:

#nano PFTEST.install
PFTESTDIR=/usr/local/proftpd/PFTEST1
SRCDIR=/usr/local/proftpd/PFTEST
#sh PFTEST.install

Nếu có thông báo như sau:

Sample test files successfully installed in /usr/local/proftpd/PFTEST1.

Đã cấu hình thành công. Tất nhiên trong trường hợp này FTP sẽ dùng cổng 2021.

-Khởi động Proftpd:
#/usr/local/proftpd/sbin/proftpd -n -d 5 -c /usr/local/proftpd/PFTEST1/PFTEST.conf
(xem file proftpdstart trong thư mục /usr/local/proftpd/sbin. Khởi động bằng lệnh:
# proftpdstart)
OK. Quá trình khởi động thành công,

-Test thử với account (user/pass): proftpd/proftpd
% ftp -n -d
ftp> open localhost 2021
ftp> user proftpd
—> USER proftpd
331 Password required for proftpd.
Password: [proftpd]
—> PASS proftpd
230 User proftpd logged in.
ftp>
Chú ý: Account proftpd/proftpd được lưu trong file:
/usr/local/proftpd/PFTEST1/ PFTEST.passwd

-Thêm, sửa, xoá user tác động vào các file (PFTEST.passwd, PFTEST.group) qua câu lệnh ftpasswd:
• NAME
ftpasswd – manipulates ProFTPD authentication files
• SYNOPSIS
ftpasswd –help|-h|–version
ftpasswd –hash [ –des|–md5 ] [ –stdin ] [ –use-cracklib[=path] ]
ftpasswd –passwd [ -F|–force ] [ –file=filename ] [–gecos=string ]
[ –gid=gid ] [ –des | –md5 ] [ –not-system-password ]
[ –stdin ] [ –use-cracklib[=path] ] –home=path
–name=username –shell=shellpath –uid=uid
ftpasswd –group [ -F|–force ] [ –enable-group-passwd ]
[ –file=filename ] [ -m|–member ] [ –des|–md5 ]
[ –stdin ] [ –use-cracklib[=path] ] –gid=gid
–name=groupname
ftpasswd –passwd –change-password –name=username

• DESCRIPTION
ftpasswd is a Perl script which can be used to manipulate the password and group files suitable for use with ProFTPD AuthUserFile and AuthGroupFile configuration directives. The idea is somewhat similar to Apache’s htpasswd program. Required options are –passwd, –group, or –hash. These specify whether ftpasswd is to operate on a passwd(5) format file, on a group(5) format file, or simply to generate a password hash, respectively. If used with –passwd, ftpasswd creates a file in the passwd(5) format, suitable for use with proftpd’s AuthUserFile configuration directive. You will be prompted for the password to use of the user, which will be encrypted, and written out as the encrypted string. By default, using –passwd will write output to “./ftpd.passwd”, If used with –hash, ftpasswd generates a hash of a password, as would appear in an AuthUserFile. The hash is written to standard out. This hash is suitable for use with proftpd’s UserPassword directive. If used with –group, ftpasswd creates a file in the group(5) format, suitable for use with proftpd’s AuthGroupFile configuration directive. By default, using –group will write output to “./ftpd.group”.
• OPTIONS
-F, –force
If the password or group file be used already exists, delete it and write a new one.
–file= filename
Write output to specified file (password or group files), rather than default one.
–gecos= string
Descriptive string for the given user (usually the user’s full name).
–gid= gid
Set primary group ID for this user (optional, will default to given –uid value if absent) when –passwd is specified.
–uid= uid
numerical group ID.
-h, –help, –version
Show usage and version of the program.
–home= path
Set the home directory for the user (required).
–des, –md5
Use the DES or MD5 algorithm for encrypting passwords. The latter is the default.
–name= username , –name= groupname
Name of the user account or group (required). If the name does not exist in the specified output-file, an entry will be created for it. Otherwise, the given fields will be updated.
–shell= path
Shell for the user (required). Recommended: /bin/false
–change-password
Update only the password field for a user. This option requires that the –name option be used, but no others. This also double-checks the given password against the user’s current password in the existing passwd file, and requests that a new password be given if the entered password is the same as the current password.
–not-system-password
Double-checks the given password against the system password for the user, and requests that a new password be given if the entered password is the same as the system password. This helps to enforce different passwords for different types of access.
–stdin
Read the password directly from standard in rather than prompting for it. This is useful for writing scripts that automate use of ftpasswd.
–use-cracklib[ =path ]
Causes ftpasswd to use Alec Muffet’s cracklib routines in order to determine and prevent the use of bad or weak passwords. The optional path to this option specifies the path to the dictionary files to use — default path is /usr/lib/cracklib_dict . This requires the Perl Crypt::Cracklib module to be installed on your system.
–enable-group-passwd
Prompt for a group password. This is disabled by default, as group passwords are not usually a good idea at all.
-m username , –member= username
user to be a member of the group. This argument may be used This argument may be used multiple times to specify the full list of users to be members of this group.

Ví dụ minh hoạ:

Thêm user:
#ftpasswd –home /home/abc –shell /bin/false/ –uid 666 -gid 666 –name abc –passwd 1234567

Sửa thông tin user: (tương tự)

Xoá user: (tương tự)

-Chỉnh sửa thông tin cấu hình qua file nằm trong thư mục /usr/local/proftpd/PFTEST1/PFTEST.conf

#
# This ProFTPD configuration is intended for unprivileged TESTING ONLY.
# See Step 4 in INSTALL.
#
ServerName “##### MY FTP SERVER#####”
ServerType standalone
DefaultServer on
# Use a non-privileged port, rather than the standard ftp port (21).
# The ftpd-data port will be one less.
Port 21
User root
Group root
###################################9:42 A 24/07/2007
# To cause every FTP user to be “jailed” (chrooted) into their home
# directory, uncomment this line.
DefaultRoot ~

# These must be absolute paths.
AuthUserFile /usr/local/proftpd/PFTEST1/PFTEST.passwd
AuthGroupFile /usr/local/proftpd/PFTEST1/PFTEST.group
PidFile /usr/local/proftpd/PFTEST1/PFTEST.pid
ScoreboardFile /usr/local/proftpd/PFTEST1/PFTEST.score
SystemLog /usr/local/proftpd/PFTEST1/PFTEST.syslog
TransferLog /usr/local/proftpd/PFTEST1/PFTEST.xferlog
# Disable some checks.
IdentLookups off
RequireValidShell off
UseFtpUsers off
UseReverseDNS off
WtmpLog off
# Umask 022 is a good standard umask to prevent new dirs and files
# from being group and world writable.
Umask 022
# To prevent DoS attacks, set the maximum number of child processes to 5.
MaxInstances 5
# Normally, we want files to be overwriteable.
<DIRECTORY />
AllowOverwrite on
</DIRECTORY>
###################################9:18 A 24/07/2007
#<ANONYMOUS ~ftp>
<ANONYMOUS home pub>
User ftp
# Group ftp
Group nogroup
# We want clients to be able to login with “anonymous” as well as “ftp”
UserAlias anonymous ftp
DirFakeUser on ftp
DirFakeGroup on ftp
RequireValidShell off
# Limit the maximum number of anonymous logins
MaxClients 10
# We want ‘welcome.msg’ displayed at login, and ‘.message’ displayed
# in each newly chdired directory.
DisplayLogin welcome.msg
DisplayFirstChdir .message
# Limit WRITE everywhere in the anonymous chroot
<LIMIT WRITE>
#DenyAll
AllowAll
</LIMIT>
</ANONYMOUS>

[B][COLOR=red]Chứng thực account qua database MySQL.[/COLOR][/B]

Sau khi cài đặt theo hướng dẫn sử dụng xong, copy các file module PAM cần thiết vào theo cấu trúc của thư mục: proftpd_usr_local_proftpd. Cấu hình file proftpd.conf theo dưới đây.

#nano /usr/local/proftpd/etc/proftpd.conf
ServerName “MY FTP SERVER”
ServerType standalone
ServerIdent on “Servers identifying string”
DeferWelcome on
DefaultServer on
#########################9:03 A 02/08/2007
MultilineRFC2228 on
ShowSymlinks on
TimeoutNoTransfer 600
TimeoutStalled 600
TimeoutIdle 1200
#########################9:03 A 02/08/2007

DisplayLogin .welcome # Textfile to display on login
DisplayConnect .connect # Textfile to display on connection
DisplayFirstChdir .firstchdir # Textfile to display on first changedir
UseReverseDNS off
IdentLookups off
Port 21
Umask 022
MaxInstances 15
MaxClientsPerHost 100 “Only %m connections per host allowed”
MaxClients 100 “Only %m total simultanious logins allowed”
MaxHostsPerUser 100
User nobody
Group nobody
#ScoreboardFile /var/log/scoreboard
ScoreboardFile /usr/local/proftpd/log/scoreboard
# Some logging formats
LogFormat default “%h %l %u %t \”%r\” %s %b”
LogFormat auth “%v [%P] %h %t \”%r\” %s”
LogFormat write “%h %l %u %t \”%r\” %s %b”
# Define log-files to use
TransferLog /usr/local/proftpd/log/proftpd.xferlog
ExtendedLog /usr/local/proftpd/log/proftpd.access_log WRITE,READ write
ExtendedLog /usr/local/proftpd/log/proftpd.auth_log AUTH auth
ExtendedLog /usr/local/proftpd/log/proftpd.paranoid_log ALL default
SQLLogFile /usr/local/proftpd/log/proftpd.mysql
QuotaLog /usr/local/proftpd/log/proftpd.quota
# Set up authentication via SQL
# ===========
AuthOrder mod_sql.c
SQLAuthTypes Backend

SQLConnectInfo <DB>@<IP> <USER DB>

SQLUserInfo usertable userid passwd uid gid homedir shell
SQLGroupInfo grouptable groupname gid members
SQLUserWhereClause “disabled=0 and (NOW()<=expiration or expiration=-1 or expiration=0)”
# Log the user logging in
SQLLog PASS counter
SQLNamedQuery counter UPDATE “lastlogin=now(), count=count+1 WHERE userid=’%u'” usertable
# logout log
SQLLog EXIT time_logout
SQLNamedQuery time_logout UPDATE “lastlogout=now() WHERE userid=’%u'” usertable
# display last login time when PASS command is given
SQLNamedQuery login_time SELECT “lastlogin from usertable where userid=’%u'”
SQLShowInfo PASS “230” “Last login was: %{login_time}”
# xfer Log in mysql
SQLLog RETR,STOR transfer1
SQLNamedQuery transfer1 INSERT “‘%u’, ‘%f’, ‘%b’, ‘%h’, ‘%a’, ‘%m’, ‘%T’, now(), ‘c’, NULL” xfer_stat
SQLLOG ERR_RETR,ERR_STOR transfer2
SQLNamedQuery transfer2 INSERT “‘%u’, ‘%f’, ‘%b’, ‘%h’, ‘%a’, ‘%m’, ‘%T’, now(), ‘i’, NULL” xfer_stat
# User quotas
# ===========
QuotaEngine on
QuotaDirectoryTally on
QuotaDisplayUnits Mb
QuotaShowQuotas on
SQLNamedQuery get-quota-limit SELECT “name, quota_type, per_session, limit_type, bytes_in_avail, bytes_out_avail, bytes_xfer_avail, files_in_avail, files_out_avail, files_xfer_avail FROM ftpquotalimits WHERE name = ‘%{0}’ AND quota_type = ‘%{1}'”
SQLNamedQuery get-quota-tally SELECT “name, quota_type, bytes_in_used, bytes_out_used, bytes_xfer_used, files_in_used, files_out_used, files_xfer_used FROM ftpquotatallies WHERE name = ‘%{0}’ AND quota_type = ‘%{1}'”
SQLNamedQuery update-quota-tally UPDATE “bytes_in_used = bytes_in_used + %{0}, bytes_out_used = bytes_out_used + %{1}, bytes_xfer_used = bytes_xfer_used + %{2}, files_in_used = files_in_used + %{3}, files_out_used = files_out_used + %{4}, files_xfer_used = files_xfer_used + %{5} WHERE name = ‘%{6}’ AND quota_type = ‘%{7}'” ftpquotatallies
SQLNamedQuery insert-quota-tally INSERT “%{0}, %{1}, %{2}, %{3}, %{4}, %{5}, %{6}, %{7}” ftpquotatallies
QuotaLimitTable sql:/get-quota-limit
QuotaTallyTable sql:/get-quota-tally/update-quota-tally/insert-quota-tally

AllowStoreRestart on
AllowRetrieveRestart on
RequireValidShell off
PathDenyFilter “\\.ftp)|\\.ht) (file://\\.ftp)|\\.ht))[a-z]+$”
DefaultRoot ~
DenyFilter \*.*/

#<DIRECTORY ftp *>
<DIRECTORY home ftp *>
AllowOverwrite off
HideNoAccess off
<LIMIT READ>
AllowAll
</LIMIT>
<LIMIT WRITE>
DenyGroup !admins
</LIMIT>
</DIRECTORY>
#<DIRECTORY ftp * incoming>
<DIRECTORY home ftp incoming*>
AllowOverwrite on
HideNoAccess on
<LIMIT READ>
DenyGroup !admins
</LIMIT>
<LIMIT STOR MKD>
AllowAll
</LIMIT>
</DIRECTORY>
DB MySQL 5.x.xx:

DROP DATABASE IF EXISTS `proftpdaccount`;
CREATE DATABASE `proftpdaccount`;
USE `proftpdaccount`;
CREATE TABLE `ftpquotalimits` (
`name` varchar(30) character set latin1 NOT NULL default ”,
`quota_type` enum(‘user’,’group’,’class’,’all’) character set latin1 NOT NULL default ‘user’,
`per_session` enum(‘false’,’true’) character set latin1 NOT NULL default ‘false’,
`limit_type` enum(‘soft’,’hard’) character set latin1 NOT NULL default ‘hard’,
`bytes_in_avail` float NOT NULL default ‘0’,
`bytes_out_avail` float NOT NULL default ‘0’,
`bytes_xfer_avail` float NOT NULL default ‘0’,
`files_in_avail` int(10) unsigned NOT NULL default ‘0’,
`files_out_avail` int(10) unsigned NOT NULL default ‘0’,
`files_xfer_avail` int(10) unsigned NOT NULL default ‘0’,
PRIMARY KEY (`name`)
) ENGINE=MyISAM DEFAULT CHARSET=utf8 COLLATE=utf8_unicode_ci;

CREATE TABLE `ftpquotatallies` (
`name` varchar(30) character set latin1 NOT NULL default ”,
`quota_type` enum(‘user’,’group’,’class’,’all’) character set latin1 NOT NULL default ‘user’,
`bytes_in_used` float NOT NULL default ‘0’,
`bytes_out_used` float NOT NULL default ‘0’,
`bytes_xfer_used` float NOT NULL default ‘0’,
`files_in_used` int(10) unsigned NOT NULL default ‘0’,
`files_out_used` int(10) unsigned NOT NULL default ‘0’,
`files_xfer_used` int(10) unsigned NOT NULL default ‘0’
) ENGINE=MyISAM DEFAULT CHARSET=utf8 COLLATE=utf8_unicode_ci;

CREATE TABLE `grouptable` (
`groupname` text character set latin1,
`gid` int(11) NOT NULL auto_increment,
`members` text character set latin1,
`description` tinytext character set latin1,
PRIMARY KEY (`gid`),
UNIQUE KEY `gid_2` (`gid`),
KEY `gid` (`gid`)
) ENGINE=MyISAM AUTO_INCREMENT=10006 DEFAULT CHARSET=utf8 COLLATE=utf8_unicode_ci;

CREATE TABLE `usertable` (
`userid` varchar(254) collate utf8_unicode_ci default NULL,
`passwd` varchar(254) collate utf8_unicode_ci default NULL,
`homedir` varchar(254) collate utf8_unicode_ci default NULL,
`shell` varchar(254) collate utf8_unicode_ci default NULL,
`uid` int(11) NOT NULL auto_increment,
`gid` int(11) default NULL,
`count` int(11) NOT NULL default ‘0’,
`lastlogin` datetime NOT NULL default ‘0000-00-00 00:00:00’,
`lastlogout` datetime NOT NULL default ‘0000-00-00 00:00:00’,
`expiration` datetime NOT NULL default ‘0000-00-00 00:00:00’,
`disabled` tinyint(4) default ‘0’,
`det_name` tinytext character set latin1,
`det_mail` tinytext character set latin1,
`det_adress` tinytext character set latin1,
`det_notes` tinytext character set latin1,
PRIMARY KEY (`uid`)
) ENGINE=MyISAM AUTO_INCREMENT=10011 DEFAULT CHARSET=utf8 COLLATE=utf8_unicode_ci;

CREATE TABLE `vhtable` (
`servername` varchar(255) character set latin1 NOT NULL default ”,
`docroot` varchar(255) character set latin1 NOT NULL default ”,
`user_id` int(10) NOT NULL default ‘0’,
PRIMARY KEY (`servername`)
) ENGINE=MyISAM DEFAULT CHARSET=utf8 COLLATE=utf8_unicode_ci;

CREATE TABLE `xfer_stat` (
`userid` text character set latin1,
`file` text character set latin1,
`size` bigint(20) default ‘0’,
`address_full` text character set latin1,
`address_ip` text character set latin1,
`command` text character set latin1,
`timespent` text character set latin1,
`time` text character set latin1,
`cmd` text character set latin1,
`dunno` text character set latin1
) ENGINE=MyISAM DEFAULT CHARSET=utf8 COLLATE=utf8_unicode_ci;

V. Tài liệu tham khảo.
http://en.wikipedia.org/wiki/ProFTPd

[B]Download tài liệu hướng dẫn:[/B]

1. Bộ cài (http://mirrors.ibiblio.org/pub/mirrors/proftpd/distrib/source/):
2. Tài liệu hướng dẫn cấu hình: (http://www.harmonysoft.com.vn/tinh_cx/ProFTPD – Documentation.pdf)
3. Other: (http://www.harmonysoft.com.vn/tinh_cx/proftpd1.3.xx.zip)

Post a Comment

Required fields are marked *

*
*

%d bloggers like this: