在LINUX系統(tǒng)上建立FTP加密傳輸

作者：llzqq
聯(lián)系：llzqq@126.com
來自：www.chinaunix.net

在眾多的FTP服務(wù)器中PROFTPD由于它的配置靈活，安裝簡便。近年來一直受到人們的喜愛。通常情況下FTP包括認(rèn)證過程，傳輸是明文傳輸?shù)?，在傳輸一些敏感?shù)據(jù)時總是不能讓人放心。今天我在網(wǎng)上找了一些零散的資料結(jié)合自己的實作寫了個帖子貢獻(xiàn)給大家。

下載最新的軟件版本：

# wget ftp://ftp.proftpd.org/distrib/source/proftpd-1.3.0rc3.tar.gz

首先創(chuàng)建ROFTPD運行的用戶和組：

# groupadd nogroup
# useradd –g nogroup –d /dev/null –s /sbin/nologin nobody

首先創(chuàng)建上傳下載的用戶和組：

# groupadd ftp
# useradd –g ftp –d /home/down –s /sbin/nologin down
# useradd –g ftp –d /home/upload –s /sbin/nologin upload
用戶密碼設(shè)置略

編譯安裝PROFRPD:

# tar –zxvf proftpd-1.3.0rc3.tar.gz
# cd proftpd-1.3.0rc3
# ./configure
--prefix=/usr/local/proftpd
--sysconfdir=/etc
--enable-autoshadow
--localstatedir=/var/run
--enable-ctrls
--with-modules=mod_tls

# make
# make install

配置PROFTPD服務(wù)器：

# vi /etc/proftpd.conf
================+================+=================
# This is a basic ProFTPD configuration file (rename it to
# 'proftpd.conf' for actual use. It establishes a single server
# and a single anonymous login. It assumes that you have a user/group
# nobody and ftp for normal operation and anon.
ServerName llzqq
ServerType standalone
DefaultServer on
AllowRetrieveRestart on
AllowStoreRestart on
ServerType standalone
ServerIdent on
SystemLog /var/log/proftpd.log
UseReverseDNS off
IdentLookups off
RequireValidShell off
# Port 21 is the standard FTP port.
Port 21
# Umask 022 is a good standard umask to prevent new dirs and files
# from being group and world writable.
Umask 022
MaxInstances 100
# Set the user and group under which the server will run.
User nobody
Group nogroup
# To cause every FTP user to be jailed (chrooted) into their home
# directory, uncomment this line.
DefaultRoot ~
# Normally, we want files to be overwriteable.
Directory />
AllowOverwrite on
/Directory>
# We want 'welcome.msg' displayed at login, and '.message' displayed
# in each newly chdired directory.
DisplayLogin .welcome
DisplayFirstChdir .message
# Limit User of being enbled login ftp server
Limit LOGIN>
AllowGroup ftp
DenyAll
/Limit>
#########################ssl/tls############################
# MOD_TLS SETTING
IfModule mod_tls.c>
TLSEngine on
TLSLog /var/log/proftpd-tls.log
TLSProtocol SSLv23
# Are clients required to use FTP over TLS when talking to this server?
TLSRequired ctrl
# Server's certificate
TLSRSACertificateFile /etc/proftpd.crt
TLSRSACertificateKeyFile /etc/proftpd.key
# Authenticate clients that want to use FTP over TLS
TLSVerifyClient off
#########################ssl/tls############################
Directory /home/down>
Limit WRITE>
DenyGroup ftp
/Limit>
TransferRate RETR 150 group ftp
/Directory>
Directory /home/upload>
Limit RMD RNFR DELE RETR>
DenyGroup ftp
/Limit>
TransferRate STOR 150 group ftp
/Directory>
MaxClientsPerHost 200
PassivePorts 55000 56000
================+================+=================

創(chuàng)建PROFTPD的日志文件：

# touch /var/log/proftpd.log
# touch /var/log/proftpd-tls.log
# chown nobody:nogroup /var/log/proftpd.log /var/log/proftpd-tls.log

創(chuàng)建SSL傳輸?shù)淖C書和密匙：

# cp /usr/share/ssl/openssl.cnf ./
# openssl req -new -x509 -nodes -config openssl.cnf -out proftpd.crt –keyout proftpd.key
這里安裝提示需要輸入證書信息略

把證書和密匙復(fù)制到指定目錄：
# cp proftpd.crt proftpd.key /etc/

最后創(chuàng)建PROFTPD啟動教本：

# vi /etc/init.d/proftpd
================+================+=================
#!/bin/sh
# Startup script for ProFTPD
# chkconfig: 345 85 15
# description: ProFTPD is an enhanced FTP server
# processname: proftpd
# config: /etc/proftpd.conf
# Source function library.
. /etc/rc.d/init.d/functions

if [ -f /etc/sysconfig/proftpd ]; then
. /etc/sysconfig/proftpd
fi
PATH=$PATH:/usr/local/proftpd/sbin
# See how we were called.
case $1 in
start)
echo -n Starting proftpd:
daemon proftpd $OPTIONS
echo
touch /var/lock/subsys/proftpd
;;
stop)
echo -n Shutting down proftpd:
killproc proftpd
echo
rm -f /var/lock/subsys/proftpd
;;
status)
status proftpd
;;
restart)
$0 stop
$0 start
;;
reread)
echo -n Re-reading proftpd config:
killproc proftpd -HUP
echo
;;
suspend)
hash ftpshut >/dev/null 2>1
if [ $? = 0 ]; then
if [ $# -gt 1 ]; then
shift
echo -n Suspending with '$*'
ftpshut $*
else
echo -n Suspending NOW
ftpshut now Maintanance in progress
fi
else
echo -n No way to suspend
fi
echo
;;
resume)
if [ -f /etc/shutmsg ]; then
echo -n Allowing sessions again
rm -f /etc/shutmsg
else
echo -n Was not suspended
fi
echo
;;
*)
echo -n Usage: $0 {start|stop|restart|status|reread|resume
hash ftpshut
if [ $? = 1 ]; then
echo '}'
else
echo '|suspend}'
echo 'suspend accepts additional arguments which are passed to ftpshut(8)'
fi
exit 1
esac

if [ $# -gt 1 ]; then
shift
$0 $*
fi
exit 0
================+================+=================

# chomd 755 /etc/init.d/proftpd
# chkconfig –-add proftpd
# chkconfig proftpd on

到這里ftp服務(wù)器端安裝設(shè)置完畢，登陸服務(wù)器的客戶端我用了完全免費的FileZilla（前兩天網(wǎng)上看到說FileZilla支持SSL不錯）。FileZilla的設(shè)置也比較簡單。本服務(wù)器支持兩種客戶端加密連接方式：

1. FTP over ssl (顯示加密)方式連接。
2. FTP over tls (顯示加密) 方式連接