Centos5.5 vsftp虚拟账户无法登陆
今天测试vsftp虚拟账户配置,到现在为止还没成功,问题是虚拟账户无法登陆,
查看日志 more /var/log/secure
Mar 23 14:42:26 localhost vsftpd: pam_unix(vsftpd:auth): authentication failure; logname= uid=0 euid=0 tty=ftp ruser=test rhost=192.168.14.24 Mar 23 14:42:26 localhost vsftpd: pam_succeed_if(vsftpd:auth): error retrieving information about user test Mar 23 14:44:29 localhost vsftpd: PAM unable to dlopen(/lib/security/pam_userdb.so) Mar 23 14:44:29 localhost vsftpd: PAM [error: /lib/security/pam_userdb.so: wrong ELF class: ELFCLASS32] Mar 23 14:44:29 localhost vsftpd: PAM adding faulty module: /lib/security/pam_userdb.so Mar 23 14:44:29 localhost vsftpd: pam_listfile(vsftpd:auth): Couldn't open /etc/vsftpd/wdftp Mar 23 14:44:29 localhost vsftpd: pam_unix(vsftpd:auth): check pass; user unknown Mar 23 14:44:29 localhost vsftpd: pam_unix(vsftpd:auth): authentication failure; logname= uid=0 euid=0 tty=ftp ruser=test rhost=192.168.14.24 Mar 23 14:44:29 localhost vsftpd: pam_succeed_if(vsftpd:auth): error retrieving information about user test
下面将我的配置过程写出来,望大家能帮我指正一下,也希望能给后来者一个提示,如有不详细处请回复:
1.环境VirtualBoax Centos5.5(64位),vsftp2.0.5
2.基础软件安装
yum -y install vsftpd*
yum -y install pam*
yum -y install db4*
3.新建useradd wdftp -s /sbin/nologin
4.新建虚拟账户用户文件
vi /etc/vsftpd/vsftpd_login
test 123456 hello 123321ab
5.生成虚拟账户DB文件
db_load -T -t hash -f /etc/vsftpd/vsftpd_login /etc/vsftpd/vsftpd_login.db
6.新建虚拟账户目录/etc/vsftpd/vsftpd_user_conf,并将第4步中用户一一创建一个文件,其中test用户的配置如下,其它账户一样
local_root=/var/ anonymous_enable=NO write_enable=YES local_umask=022 anon_upload_enable=NO anon_mkdir_write_enable=NO idle_session_timeout=600 data_connection_timeout=120 max_clients=10 max_per_ip=5 local_max_rate=50000
7.修改vi /etc/pam.d/vsftpd
#%PAM-1.0 auth sufficient /lib/security/pam_userdb.so db=/etc/vsftpd/vsftpd_login account sufficient /lib/security/pam_userdb.so db=/etc/vsftpd/vsftpd_login session optional pam_keyinit.so force revoke auth required pam_listfile.so item=user sense=deny file=/etc/vsftpd/wdftp onerr=succeed auth required pam_shells.so auth include system-auth account include system-auth session include system-auth session required pam_loginuid.so
8.vsftpd.conf 配置
# The default compiled in settings are fairly paranoid. This sample file # loosens things up a bit, to make the ftp daemon more usable. # Please see vsftpd.conf.5 for all compiled in defaults. # # READ THIS: This example file is NOT an exhaustive list of vsftpd options. # Please read the vsftpd.conf.5 manual page to get a full idea of vsftpd's # capabilities. # # Allow anonymous FTP? (Beware - allowed by default if you comment this out). anonymous_enable=NO # # Uncomment this to allow local users to log in. local_enable=YES # # Uncomment this to enable any form of FTP write command. write_enable=YES # # Default umask for local users is 077. You may wish to change this to 022, # if your users expect that (022 is used by most other ftpd's) local_umask=022 # # Uncomment this to allow the anonymous FTP user to upload files. This only # has an effect if the above global write enable is activated. Also, you will # obviously need to create a directory writable by the FTP user. anon_upload_enable=NO # # Uncomment this if you want the anonymous FTP user to be able to create # new directories. anon_mkdir_write_enable=NO # # Activate directory messages - messages given to remote users when they # go into a certain directory. dirmessage_enable=YES # # Activate logging of uploads/downloads. xferlog_enable=YES # # Make sure PORT transfer connections originate from port 20 (ftp-data). connect_from_port_20=YES # # If you want, you can arrange for uploaded anonymous files to be owned by # a different user. Note! Using "root" for uploaded files is not # recommended! #chown_uploads=YES #chown_username=whoever # # You may override where the log file goes if you like. The default is shown # below. xferlog_file=/var/log/vsftpd.log # # If you want, you can have your log file in standard ftpd xferlog format xferlog_std_format=YES # # You may change the default value for timing out an idle session. #idle_session_timeout=600 # # You may change the default value for timing out a data connection. #data_connection_timeout=120 # # It is recommended that you define on your system a unique user which the # ftp server can use as a totally isolated and unprivileged user. nopriv_user=vsftpd # # Enable this and the server will recognise asynchronous ABOR requests. Not # recommended for security (the code is non-trivial). Not enabling it, # however, may confuse older FTP clients. async_abor_enable=YES # # By default the server will pretend to allow ASCII mode but in fact ignore # the request. Turn on the below options to have the server actually do ASCII # mangling on files when in ASCII mode. # Beware that on some FTP servers, ASCII support allows a denial of service # attack (DoS) via the command "SIZE /big/file" in ASCII mode. vsftpd # predicted this attack and has always been safe, reporting the size of the # raw file. # ASCII mangling is a horrible feature of the protocol. ascii_upload_enable=YES ascii_download_enable=YES # # You may fully customise the login banner string: ftpd_banner=Welcome to FTP service. # # You may specify a file of disallowed anonymous e-mail addresses. Apparently # useful for combatting certain DoS attacks. #deny_email_enable=YES # (default follows) #banned_email_file=/etc/vsftpd/banned_emails # # You may specify an explicit list of local users to chroot() to their home # directory. If chroot_local_user is YES, then this list becomes a list of # users to NOT chroot(). #chroot_list_enable=YES # (default follows) #chroot_list_file=/etc/vsftpd/chroot_list # # You may activate the "-R" option to the builtin ls. This is disabled by # default to avoid remote users being able to cause excessive I/O on large # sites. However, some broken FTP clients such as "ncftp" and "mirror" assume # the presence of the "-R" option, so there is a strong case for enabling it. #ls_recurse_enable=YES # # When "listen" directive is enabled, vsftpd runs in standalone mode and # listens on IPv4 sockets. This directive cannot be used in conjunction # with the listen_ipv6 directive. listen=YES # # This directive enables listening on IPv6 sockets. To listen on IPv4 and IPv6 # sockets, you must run two copies of vsftpd whith two configuration files. # Make sure, that one of the listen options is commented !! #listen_ipv6=YES chroot_local_user=YES pam_service_name=vsftpd userlist_enable=YES tcp_wrappers=YES guest_enable=YES guest_username=wdftp virtual_use_local_privs=YES user_config_dir=/etc/vsftpd/vsftpd_user_conf
9.重启service vsftpd restart
如果你对这篇内容有疑问,欢迎到本站社区发帖提问 参与讨论,获取更多帮助,或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱,如果其他用户或者作者回复了您的评论,将不能在第一时间通知您!
发布评论
评论(7)
兄台,多谢。正是此问题。
太感谢你了 专门注册帐号 等待一小时 感谢你
觉得使用mysql建立帐号比较方便
1.建立系统帐户virtual, 不设立密码,加入ROOT组,SHELL为NOLOGIN,使不能SHELL登录系统。
useradd -d /var/www/html -s /sbin/nologin -g root virtual
2.ldd /usr/sbin/vsftpd
libpam.so.0 => /lib/libpam.so.0 (0x00d7b000)
3.rpm -qa db4
db4-devel-4.2.52-7.1
db4-4.2.52-7.1
db4-utils-4.2.52-7.1
4.建立一个/etc/vsftpd/users.txt的文件,单行为用户名,双行为密码.
upload
123456
5.db_load -T -t hash -f /etc/vsftpd/users.txt /etc/vsftpd_login.db
chmod 600 /etc/vsftpd_login.db
6.vi /etc/pam.d/ftp.virtual
auth required /lib/security/pam_userdb.so db=/etc/vsftpd_login
account required /lib/security/pam_userdb.so db=/etc/vsftpd_login
7.编写配置文件
guest_enable=YES
guest_username=virtual //这两行的意思是采用虚拟用户形式
anonymous_enable=NO //禁用匿名账户
virtual_use_local_privs=YES //虚拟用户和本地用户权限相同
local_umask=011
file_open_mode=0777
user_config_dir=/etc/vsftpd/vsftpd_user_conf //定义虚拟用户配置文件目录
local_enable=YES //PAM方式此处必须为YES
write_enable=NO //全局控制不可以上传
anon_upload_enable=NO //匿名用户不可以上传
xferlog_enable=YES //开启日志记录
xferlog_file=/var/log/vsftpd.log //日志存放文件位置
anon_mkdir_write_enable=NO //匿名用户不可以建目录
anon_other_write_enable=NO //匿名用户不可以修改
chroot_local_user=YES //不充许用户更改根目录
pam_service_name=ftp.virtual
8.vi /etc/vsftpd/vsftpd_user_conf/upload !!!注意:每行的等号前后都不要有空格,否则启动时会出现错误!!! 如(bad bool value in config file for:anon_world_readable_only)!!!!
local_root=/var/www/html
write_enable=YES
anon_world_readable_only=NO
anon_upload_enable=YES
anon_mkdir_write_enable=YES
anon_other_write_enable=YES
参照一下,我配了没问题。
先解决这个问题,把i386的包都去掉,只留下x86_64的相关包
引用来自#2楼“G”的帖子
selinux 呢? 可能被它给阻止掉了.
selinux 呢? 可能被它给阻止掉了.