vsftpd結合pam_mysql 安裝配置總結

火星人 @ 2014-03-29 , reply:0
←手機掃碼閱讀


系統環境:


RedHat AS 4
MySQL 4.1.15
pam_mysql-0.7pre3
說明一下,MySQL我是使用其官方網站的rpm包安裝的,包括下面這4個:


MySQL-server-standard-4.1.15-0.rhel4.i386.rpm
MySQL-client-standard-4.1.15-0.rhel4.i386.rpm
MySQL-devel-standard-4.1.15-0.rhel4.i386.rpm
MySQL-shared-standard-4.1.15-0.rhel4.i386.rpm
vsftpd是RedHat自帶的。


建立用於存放vsftpd虛擬用戶的Schema的過程:
mysql> create database vsftpd;

mysql> use vsftpd;

mysql> create table users (
-> id int AUTO_INCREMENT NOT NULL,
-> name char(16) binary NOT NULL,
-> passwd char(48) binary NOT NULL,
-> primary key(id)
-> );

mysql> describe users;
+--------+----------+------+-----+---------+----------------+
| Field | Type | Null | Key | Default | Extra |
+--------+----------+------+-----+---------+----------------+
| id | int(11) | | PRI | NULL | auto_increment |
| name | char(16) | | | | |
| passwd | char(48) | | | | |
+--------+----------+------+-----+---------+----------------+

mysql> create table logs (msg varchar(255),
-> user char(16),
-> pid int,
-> host char(32),
-> rhost char(32),
-> logtime timestamp
-> );

mysql> describe logs;
+---------+--------------+------+-----+-------------------+-------+
| Field | Type | Null | Key | Default | Extra |
+---------+--------------+------+-----+-------------------+-------+
| msg | varchar(255) | YES | | NULL | |
| user | varchar(16) | YES | | NULL | |
| pid | int(11) | YES | | NULL | |
| host | varchar(32) | YES | | NULL | |
| rhost | varchar(32) | YES | | NULL | |
| logtime | timestamp | YES | | CURRENT_TIMESTAMP | |
+---------+--------------+------+-----+-------------------+-------+

這裡,用戶密碼這個欄位的長度是48。這是根據MySQL加密函數的返回值的長度確定的。關於PASSWORD函數返回值的長度,可以參考這個:

http://dev.mysql.com/doc/refman/4.1/en/password-hashing.html

mysql> select encrypt('foo');
+----------------+
| encrypt('foo') |
+----------------+
| 4Wwn2AXFYb.So |
+----------------+

mysql> select password('foo');
+-------------------------------------------+
| password('foo') |
+-------------------------------------------+
| *F3A2A51A9B0F2BE2468926B4132313728C250DBF |
+-------------------------------------------+

mysql> select md5('foo');
+----------------------------------+
| md5('foo') |
+----------------------------------+
| acbd18db4cc2f85cedef654fccc4a4d8 |
+----------------------------------+

編譯安裝pam_mysql
# ./configure --with-openssl
# make
# make install
加上--with-openssl可以避免make時報有關md5.h的編譯錯誤

建立/etc/pam.d/vsftpd.mysql(因為只是想驗證pam_mysql的安裝過程,所以我不想覆蓋原有的vsftpd這個文件)。注意只有兩行,auth是一行,account是一行。

auth required /lib/security/pam_mysql.so user=root passwd=123456 host=localhost db=vsftpd table=users usercolumn=name passwdcolumn=passwd crypt=2 sqllog=1 logtable=logs logmsgcolumn=msg logusercolumn=user logpidcolumn=pid loghostcolumn=host logrhostcolumn=rhost logtimecolumn=logtime verbose=1
account required /lib/security/pam_mysql.so user=root passwd=123456 host=localhost db=vsftpd table=users usercolumn=name passwdcolumn=passwd crypt=2 sqllog=1 logtable=logs logmsgcolumn=msg logusercolumn=user logpidcolumn=pid loghostcolumn=host logrhostcolumn=rhost logtimecolumn=logtime verbose=1

注意這裡pam_mysql.so的路徑是/lib/security;指定了sqllog;加密方式是2,也就是用MySQL PASSWORD()函數;verbose=1,設置這個可以幫助調試,日誌信息輸出在/var/log/messages里。

建立/etc/vsftpd/vsftpd.mysql.conf(同樣,不影響已有的vsftpd服務,執行service vsftpd restart時會啟動兩個vsftpd服務,埠不一樣)
主要的設置如下:


pam_service_name=vsftpd.mysql
listen=YES
tcp_wrappers=YES
local_enable=YES
guest_enable=YES
guest_username=ftp
listen_port=2121

注意pam_service_name=vsftpd.mysql指定了使用剛才設置的pam_mysql。

插入用戶信息:
mysql> insert into users (name,passwd) values('tom',password('foo'));
mysql> insert into users (name,passwd) values('jerry',password('bar'));
mysql> select * from users;
+----+-------+-------------------------------------------+
| id | name | passwd |
+----+-------+-------------------------------------------+
| 1 | tom | *F3A2A51A9B0F2BE2468926B4132313728C250DBF |
| 2 | jerry | *E8D46CE25265E545D225A8A6F1BAF642FEBEE5CB |
+----+-------+-------------------------------------------+

啟動vsftpd服務,測試配置:
# ftp localhost 2121

登錄失敗,檢查/var/log/messages,發現:
# tail -f /var/log/messages
Nov 29 14:52:04 javadev vsftpd[17683]: PAM unable to dlopen(/lib/security/pam_mysql.so)
Nov 29 14:52:04 javadev vsftpd[17683]: PAM [dlerror: /lib/security/pam_mysql.so: cannot open shared object file: No such file or directory]
Nov 29 14:52:04 javadev vsftpd[17683]: PAM adding faulty module: /lib/security/pam_mysql.so

看來是沒找到pam_mysql.so,怎麼會呢?
用find(也可以用locate,不過得先updatedb一下,慢)找了一下,原來make install的時候默認安裝在/usr/local/lib下。修改/etc/pam.d/vsftpd.mysql
auth required /usr/lib/security/pam_mysql.so user=root passwd=123456 host=localhost db=vsftpd table=users usercolumn=name passwdcolumn=passwd crypt=2 sqllog=1 logtable=logs logmsgcolumn=msg logusercolumn=user logpidcolumn=pid loghostcolumn=host logrhostcolumn=rhost logtimecolumn=logtime verbose=1
account required /usr/lib/security/pam_mysql.so user=root passwd=123456 host=localhost db=vsftpd table=users usercolumn=name passwdcolumn=passwd crypt=2 sqllog=1 logtable=logs logmsgcolumn=msg logusercolumn=user logpidcolumn=pid loghostcolumn=host logrhostcolumn=rhost logtimecolumn=logtime verbose=1

在登錄,成功!換用其他加密方式,也都可以。

然後試驗pam_mysql v0.7新加的config_file配置選項。這個選項用來指定一個配置文件,可以把所有pam_mysql的配置放在這個文件中。這樣的話,/etc/pam.d/vsftpd.mysql的內容變成這樣:

auth required /usr/lib/security/pam_mysql.so config_file=/etc/security/pam_mysql.conf
account required /usr/lib/security/pam_mysql.so config_file=/etc/security/pam_mysql.conf

清爽了許多吧,

/etc/security/pam_mysql.conf的內容:

users.host=localhost
users.database=vsftpd
users.db_user=root
users.db_passwd=123456
users.table=users
users.user_column=name
users.password_column=passwd
users.password_crypt=3
verbose=1
log.enabled=1
log.table=logs
log.message_column=msg
log.pid_column=pid
log.user_column=user
log.host_column=host
log.rhost_column=rhost
log.time_column=logtime


改好這些以後,用之前建好的虛擬用戶登錄,居然不行!而且這次/var/log/messages里沒有任何錯誤消息。ls -ltr /var/log 發現secure這個文件最新,試著打開,果然發現了pam_mysql的調試信息:

Dec 26 16:18:37 javadev vsftpd[6175]: pam_mysql - option verbose is set to "1"
Dec 26 16:18:37 javadev vsftpd[6175]: pam_mysql - option log.enabled is set to "1 "
Dec 26 16:18:37 javadev vsftpd[6175]: pam_mysql - option log.table is set to "logs"
Dec 26 16:18:37 javadev vsftpd[6175]: pam_mysql - option log.message_column is set to "msg"
Dec 26 16:18:37 javadev vsftpd[6175]: pam_mysql - option log.pid_column is set to "pid"
Dec 26 16:18:37 javadev vsftpd[6175]: pam_mysql - option log.user_column is set to "user"
Dec 26 16:18:37 javadev vsftpd[6175]: pam_mysql - option log.host_column is set to "host"
Dec 26 16:18:37 javadev vsftpd[6175]: pam_mysql - option log.rhost_column is set to "rhost"
Dec 26 16:18:37 javadev vsftpd[6175]: pam_mysql - option log.time_column is set to "logtime"
Dec 26 16:18:37 javadev vsftpd[6175]: pam_mysql - pam_sm_authenticate() called.
Dec 26 16:18:37 javadev vsftpd[6175]: pam_mysql - pam_mysql_open_db() called.
Dec 26 16:18:42 javadev vsftpd[6175]: pam_mysql - MySQL error (Unknown MySQL server host 'localhost ' (3))
Dec 26 16:18:42 javadev vsftpd[6175]: pam_mysql - pam_mysql_open_db() returning 5.
Dec 26 16:18:42 javadev vsftpd[6175]: pam_mysql - pam_sm_authenticate() returning 9.
Dec 26 16:18:42 javadev vsftpd[6175]: pam_mysql - pam_mysql_release_ctx() called.
Dec 26 16:18:42 javadev vsftpd[6175]: pam_mysql - pam_mysql_destroy_ctx() called.
Dec 26 16:18:42 javadev vsftpd[6175]: pam_mysql - pam_mysql_close_db() called.

仔細檢查,發現原因在這裡:

pam_mysql - MySQL error (Unknown MySQL server host 'localhost ' (3))

原來配置文件里users.host=localhost 這行行尾多了一個空格!鬱悶!修改以後就可以登錄了。

最後,我在論壇里回復時說過不能用password這種方式,原因是

2 (or "mysql") = Use MySQL PASSWORD() function. It is possible
that the encryption function used by PAM-MySQL
is different from that of the MySQL server, as
PAM-MySQL uses the function defined in MySQL's
C-client API instead of using PASSWORD() SQL function
in the query.




[火星人 via ] vsftpd結合pam_mysql 安裝配置總結已經有287次圍觀

http://www.coctec.com/docs/linux/show-post-203636.html