Vsftpd is one of the most secure and fastest FTP servers for Linux. Usually vsftpd is configured to work with system users. This document describes how to install a vsftpd server that uses virtual users from a MySQL database instead of real system users. This is much more performant and allows to have thousands of ftp users on a single machine.
For the administration of the MySQL database you can use web based tools like phpMyAdmin which will also be installed in this howto. phpMyAdmin is a comfortable graphical interface which means you do not have to mess around with the command line.
This tutorial is based on Debian Etch (Debian 4.0). You should already have set up a basic Debian Etch system, as described in the first six chapters of this tutorial: http://www.howtoforge.com/perfect_setup_debian_etch
This howto is meant as a practical guide; it does not cover the theoretical backgrounds. They are treated in a lot of other documents in the web.
This document comes without warranty of any kind! I want to say that this is not the only way of setting up such a system. There are many ways of achieving this goal but this is the way I take. I do not issue any guarantee that this will work for you!
1 Preliminary Note
In this tutorial I use the hostname server1.example.com with the IP address 192.168.0.100. These settings might differ for you, so you have to replace them where appropriate.
2 Install vsftpd, MySQL And phpMyAdmin
Vsftpd has no built-in MySQL support, therefore we must use PAM to authenticate against the MySQL database. So we install libpam-mysql in addition to vsftpd, MySQL, and phpMyAdmin:
代码: 全选
apt-get install vsftpd libpam-mysql mysql-server mysql-client phpmyadmin
代码: 全选
mysqladmin -u root password yourrootsqlpassword
代码: 全选
netstat -tap | grep mysql
tcp 0 0 localhost.localdo:mysql *:* LISTEN 2713/mysqld
which means MySQL is listening on localhost.localdomain only, then you're safe with the password you set before. But if the output looks like this:
tcp 0 0 *:mysql *:* LISTEN 2713/mysqld
you should set a MySQL password for your hostname, too, because otherwise anybody can access your database and modify data:
代码: 全选
mysqladmin -h server1.example.com -u root password yourrootsqlpassword
Now we create a database called vsftpd and a MySQL user named vsftpd which the vsftpd daemon will use later on to connect to the vsftpd database:
代码: 全选
mysql -u root -p
代码: 全选
CREATE DATABASE vsftpd;
GRANT SELECT, INSERT, UPDATE, DELETE, CREATE, DROP ON vsftpd.* TO 'vsftpd'@'localhost' IDENTIFIED BY 'ftpdpass';
GRANT SELECT, INSERT, UPDATE, DELETE, CREATE, DROP ON vsftpd.* TO 'vsftpd'@'localhost.localdomain' IDENTIFIED BY 'ftpdpass';
FLUSH PRIVILEGES;
代码: 全选
USE vsftpd;
代码: 全选
CREATE TABLE `accounts` (
`id` INT NOT NULL AUTO_INCREMENT PRIMARY KEY ,
`username` VARCHAR( 30 ) NOT NULL ,
`pass` VARCHAR( 50 ) NOT NULL ,
UNIQUE (
`username`
)
) ENGINE = MYISAM ;
代码: 全选
quit;
BTW, (I'm assuming that the hostname of your ftp server system is server1.example.com) you can access phpMyAdmin under http://server1.example.com/phpmyadmin/ (you can also use the IP address instead of server1.example.com) in a browser and log in as the user vsftpd. Then you can have a look at the database. Later on you can use phpMyAdmin to administrate your vsftpd server.
4 Configure vsftpd
First we create a non-privileged user called vsftpd (with the homedir /home/vsftpd) belonging to the group nogroup. We will run vsftpd under this user, and the FTP directories of our virtual users will be in the /home/vsftpd directory (e.g. /home/vsftpd/user1, /home/vsftpd/user2, etc.).
代码: 全选
useradd --home /home/vsftpd --gid nogroup -m --shell /bin/false vsftpd
代码: 全选
cp /etc/vsftpd.conf /etc/vsftpd.conf_orig
cat /dev/null > /etc/vsftpd.conf
vi /etc/vsftpd.conf
代码: 全选
listen=YES
anonymous_enable=NO
local_enable=YES
write_enable=YES
local_umask=022
dirmessage_enable=YES
xferlog_enable=YES
connect_from_port_20=YES
nopriv_user=vsftpd
chroot_local_user=YES
secure_chroot_dir=/var/run/vsftpd
pam_service_name=vsftpd
rsa_cert_file=/etc/ssl/certs/vsftpd.pem
guest_enable=YES
guest_username=vsftpd
local_root=/home/vsftpd/$USER
user_sub_token=$USER
virtual_use_local_privs=YES
user_config_dir=/etc/vsftpd_user_conf
With the user_config_dir option you can specify a directory for per-user configuration files that override parts of the global settings. This is totally optional and up to you if you want to use this feature. However, we should create that directory now:
代码: 全选
mkdir /etc/vsftpd_user_conf
代码: 全选
cp /etc/pam.d/vsftpd /etc/pam.d/vsftpd_orig
cat /dev/null > /etc/pam.d/vsftpd
vi /etc/pam.d/vsftpd
代码: 全选
auth required pam_mysql.so user=vsftpd passwd=ftpdpass host=localhost db=vsftpd table=accounts usercolumn=username passwdcolumn=pass crypt=2
account required pam_mysql.so user=vsftpd passwd=ftpdpass host=localhost db=vsftpd table=accounts usercolumn=username passwdcolumn=pass crypt=2
Afterwards, we restart vsftpd:
/etc/init.d/vsftpd restart
5 Create The First Virtual User
To populate the database you can use the MySQL shell:
代码: 全选
mysql -u root -p
代码: 全选
USE vsftpd;
代码: 全选
INSERT INTO accounts (username, pass) VALUES('testuser', PASSWORD('secret'));
quit;
代码: 全选
mkdir /home/vsftpd/testuser
chown vsftpd:nogroup /home/vsftpd/testuser
If you are able to connect - congratulations! If not, something went wrong.