proftp + mysql 配置管理

浏览数：33 / 时间：2015年06月12日

一、下载安装proftp mysql

下载 wget ftp://ftp.proftpd.org/distrib/source/proftpd-1.3.4d.tar.gz

tar zxf proftpd-1.3.4d.tar.gz

INSTALLATION Mod_Clamav

To install Mod_Clamav, download and unpack the Mod_Clamav source code.

wget http://www.thrallingpenguin.com/resources/mod_clamav-0.10.tar.gz

tar xzvf mod_clamav-0.10.tar.gz

Download the latest proftpd source code, and prepare it for building Mod_Clamav.

wget ftp://ftp.proftpd.org/distrib/source/proftpd-1.3.1.tar.gz

tar xzvf proftpd-1.3.1.tar.gz

cp mod_clamav-0.10/mod_clamav.* proftpd-1.3.1/contrib

Apply the required patch:

cd proftpd-1.3.1

patch -p1 < ../mod_clamav-0.10/proftpd.patch

Now the usual steps for building ProFTPd, using third-party modules, apply. Additionally, you may change any configure arguments to meet your needs.

cd proftpd-1.3.4d

--prefix=/usr/local/proftpd-1.3.4d --enable-ctrls --with-mysql-config=/usr/local/mysql/bin/mysql_config --with-libraries=/usr/local/mysql/lib

--with-includes=/usr/local/mysql/include --enable-shadow --enable-autoshadow --enable-openssl --enable-pool-size --enable-dso

--with-modules=mod_ratio:mod_readme:mod_wrap2:mod_wrap2_sql:mod_ifsession:mod_sql:mod_sql_mysql:mod_sql_passwd:mod_quotatab:mod_quotatab_sql:mod_quotatab_file:mod_clamav

--with-include=/usr/local/lab/unixODBC-2.3.2/includes:/usr/local/mysql/include --with-libraries=/usr/local/lab/unixODBC-2.3.2/lib:/usr/local/mysql/lib

make && make install

说明：

--with-modules=mod_sql:mod_sql_mysql:mod_quotatab:mod_quotatab_sql 这句是让编译ProFTPD 支持MySQL的模块，并有磁盘限额支持；

--with-includes= 这是来指定MySQL服务器includes所在的位置；在这里我设置的是/usr/include/mysql，因为我的MySQL服务器的includes的确在这个目录；你可以根据自己的机器环境来调整；

--with-libraries= 这是来指定MySQL服务器libraries所在的位置；在这里我设置的是/usr/lib/mysql，因为我的MySQL服务器的libraries的确在这个目录；你可以根据自己的机器环境来调整；

到此proftp已安装结束

主要配置文件如下:

[root@server:/usr/local/proftpd/etc]# cat proftpd.conf

# This is a basic ProFTPD configuration file (rename it to

# ‘proftpd.conf‘ for actual use. It establishes a single server

# and a single anonymous login. It assumes that you have a user/group

# "nobody" and "ftp" for normal operation and anon.

ServerName "ProFTPD Default Installation"

ServerType standalone

DefaultServer on

# Port 21 is the standard FTP port.

Port 21

# Don‘t use IPv6 support by default.

UseIPv6 off

# Umask 022 is a good standard umask to prevent new dirs and files

# from being group and world writable.

Umask 022

TimeoutLogin 120

TimeoutIdle 600

TimeoutNoTransfer 900

TimeoutStalled 3600

# Where do we put the pid files?

#ScoreboardPath /var/run/proftpd

# To prevent DoS attacks, set the maximum number of child processes

# to 30. If you need to allow more than 30 concurrent connections

# at once, simply increase this value. Note that this ONLY works

# in standalone mode, in inetd mode you should use an inetd server

# that allows you to limit maximum number of processes per service

# (such as xinetd).

MaxInstances 30

MaxLoginAttempts 3

# Set the user and group under which the server will run.

User apache

Group users

# To cause every FTP user to be "jailed" (chrooted) into their home

# directory, uncomment this line.

#DefaultRoot ~

# Normally, we want files to be overwriteable.

AllowOverwrite on

# 上传断点续传

AllowRetrieveRestart on

AllowStoreRestart on

# Bar use of SITE CHMOD by default

DenyAll

</Limit>

# A basic anonymous configuration, no upload directories. If you do not

# want anonymous users, simply delete this entire <Anonymous> section.

#<Anonymous ~ftp>

# User ftp

# Group ftp

# We want clients to be able to login with "anonymous" as well as "ftp"

# UserAlias anonymous ftp

# Limit the maximum number of anonymous logins

# MaxClients 10

# We want ‘welcome.msg‘ displayed at login, and ‘.message‘ displayed

# in each newly chdired directory.

# DisplayLogin welcome.msg

# DisplayChdir .message

# Limit WRITE everywhere in the anonymous chroot

# <Limit WRITE>

# DenyAll

# </Limit>

#</Anonymous>

#设置MySQL认证：

#数据库联接的信息，DatabaseName是数据库名， HostName是主机名，

#Port是端口号，UserName是连接数据库的用户名，Password是密码。

SQLConnectInfo [email protected] proftpd 123456 #用户名与密码

#数据库认证的类型：

SQLAuthTypes OpenSSL

#指定用来做用户认证的表的有关信息。("FTPUSERS"和"FTPGRPS"是数据表名字，等一会而在下面建立)

SQLUserInfo FTPUSERS userid passwd uid gid home shell

SQLGroupInfo FTPGRPS grpname gid members

#设置如果shell为空时允许用户登录：

RequireValidShell off

#数据库的鉴别

SQLAuthenticate users groups usersetfast groupsetfast

#如果home目录不存在，则系统会为根据它的home项新建一个目录：

CreateHome off

#判断这个用户是否允许登录本机

#SQLUserWhereClause "accesshost like‘%10.10.26.195%‘" #这里的%号ProFtp不识别, 妈的!所以用下面的方法.

SQLUserWhereClause "0 !=FIND_IN_SET(‘192.168.1.1‘,accesshost)"

#SQL验证日志

#SQLLog

SQLLogFile /usr/local/proftpd/var/sql.log

#SQL验证用户的UID和GID

SQLMinUserUID 500

SQLMinUserGID 100

SQLDefaultUID 500

SQLDefaultGID 100

##### #####

MaxClients 50

UseReverseDNS off

IdentLookups off

#QuotaLimitTable file:/usr/local/proftpd/etc/ftpquota.limittab

#QuotaTallyTable file:/usr/local/proftpd/etc/ftpquota.tallytab

QuotaDirectoryTally on

QuotaDisplayUnits Mb

QuotaEngine on

QuotaLog /usr/local/proftpd/var/quota.log

QuotaShowQuotas on

QuotaOptions ScanOnLogin

SQLNamedQuery get-quota-limit SELECT "name, quota_type, per_session, limit_type, bytes_in_avail, bytes_out_avail, bytes_xfer_avail, files_in_avail, files_out_avail, files_xfer_avail FROM quotalimits WHERE name = ‘%{0}‘ AND quota_type = ‘%{1}‘"

SQLNamedQuery get-quota-tally SELECT "name, quota_type, bytes_in_used, bytes_out_used, bytes_xfer_used, files_in_used, files_out_used, files_xfer_used FROM quotatallies WHERE name = ‘%{0}‘ AND quota_type = ‘%{1}‘"

SQLNamedQuery update-quota-tally UPDATE "bytes_in_used = bytes_in_used + %{0}, bytes_out_used = bytes_out_used + %{1}, bytes_xfer_used = bytes_xfer_used + %{2},files_in_used = files_in_used + %{3}, files_out_used = files_out_used + %{4}, files_xfer_used = files_xfer_used + %{5} WHERE name = ‘%{6}‘ AND quota_type = ‘%{7}‘" quotatallies

SQLNamedQuery insert-quota-tally INSERT "%{0}, %{1}, %{2}, %{3}, %{4}, %{5}, %{6}, %{7}" quotatallies

QuotaLimitTable sql:/get-quota-limit

QuotaTallyTable sql:/get-quota-tally/update-quota-tally/insert-quota-tally

DefaultRoot ~

DisplayLogin welcome to ftp server !

AllowStoreRestart on

############ Fixed Log Format #########

LogFormat awstats "%t %h %u %m %f %s %b"

ExtendedLog /usr/local/proftpd/var/transfer.log read,write awstats

TransferLog /usr/local/proftpd/var/transfer.log

ServerLog /usr/local/proftpd/var/server.log

#Single system with both ProFTPd and Clamd utilizing TCP sockets. Additionally, only files who‘s size is less than 250MB will be scanned.

ClamAV on

ClamServer localhost

ClamPort 3310

ClamMaxSize 250 Mb

</IfModule>

数据库设置:

注：数据库与proftpd 程序可以位于不同的服务器上面．可实现需要部署proftpd 程序的服务器都统一使用数据库用户认证，便于ftp账号的统一管理．一个ftp 账号也可以指定在多台proftpd 部署的程序主要上面登录．

例如：

mysql> select * from FTPUSERS;

+--------+--------------------------+-----+-----+-----------------------------+---------------+--------------------------+-------------------+

+--------+--------------------------+-----+-----+--------------------------------------------+---------------+--------------------------+-----------

| user01 | bog7BizRhTQS0p9qVroQ==yyyyyyy | 500 | 100 | /data/mysql | /sbin/nologin | 192.168.1.1,192.168.1.2 | |

| user02 | 6+CETb6sIYZfbVNt3sSIS4444rrrr | 500 | 100 | /opt | /sbin/nologin | 192.168.1.1 | |

用户user01 在主机(192.168.1.1,192.168.1.2)部署好程序设置后,都可以使用FTP进行登录.

创建用户:

mysql>create database proftpd;

mysql>Grant select,insert,update,delete,create,drop,index,alter,create temporary tables,lock tables on proftpd.* to proftpd@localhost Identified by "123456";

mysql>flush privileges;

导入以下数据库表结构:

-- Current Database: `proftpd`

CREATE DATABASE /*!32312 IF NOT EXISTS*/ `ftp_db` /*!40100 DEFAULT CHARACTER SET latin1 */;

USE `proftpd`;

-- Table structure for table `FTPGRPS`

DROP TABLE IF EXISTS `FTPGRPS`;

/*!40101 SET @saved_cs_client = @@character_set_client */;

/*!40101 SET character_set_client = utf8 */;

CREATE TABLE `FTPGRPS` (

`grpname` text NOT NULL,

`gid` smallint(6) NOT NULL,

`members` text NOT NULL

) ENGINE=InnoDB DEFAULT CHARSET=utf8;

/*!40101 SET character_set_client = @saved_cs_client */;

-- Table structure for table `FTPUSERS`

DROP TABLE IF EXISTS `FTPUSERS`;

/*!40101 SET @saved_cs_client = @@character_set_client */;

/*!40101 SET character_set_client = utf8 */;

CREATE TABLE `FTPUSERS` (

`userid` text NOT NULL,

`passwd` text NOT NULL,

`uid` int(11) NOT NULL,

`gid` int(11) NOT NULL,

`home` text,

`shell` text,

`accesshost` text,

`coment` text

) ENGINE=MyISAM DEFAULT CHARSET=utf8;

/*!40101 SET character_set_client = @saved_cs_client */;

-- Table structure for table `quotalimits`

DROP TABLE IF EXISTS `quotalimits`;

/*!40101 SET @saved_cs_client = @@character_set_client */;

/*!40101 SET character_set_client = utf8 */;

CREATE TABLE `quotalimits` (

`name` varchar(30) DEFAULT NULL,

`quota_type` enum(‘user‘,‘group‘,‘class‘,‘all‘) NOT NULL DEFAULT ‘user‘,

`per_session` enum(‘false‘,‘true‘) NOT NULL DEFAULT ‘false‘,

`limit_type` enum(‘soft‘,‘hard‘) NOT NULL DEFAULT ‘soft‘,

`bytes_in_avail` float NOT NULL DEFAULT ‘0‘,

`bytes_out_avail` float NOT NULL DEFAULT ‘0‘,

`bytes_xfer_avail` float NOT NULL DEFAULT ‘0‘,

`files_in_avail` int(10) unsigned NOT NULL DEFAULT ‘0‘,

`files_out_avail` int(10) unsigned NOT NULL DEFAULT ‘0‘,

`files_xfer_avail` int(10) unsigned NOT NULL DEFAULT ‘0‘

) ENGINE=MyISAM DEFAULT CHARSET=utf8;

/*!40101 SET character_set_client = @saved_cs_client */;

-- Table structure for table `quotatallies`

DROP TABLE IF EXISTS `quotatallies`;

/*!40101 SET @saved_cs_client = @@character_set_client */;

/*!40101 SET character_set_client = utf8 */;

CREATE TABLE `quotatallies` (

`name` varchar(30) NOT NULL DEFAULT ‘‘,

`quota_type` enum(‘user‘,‘group‘,‘class‘,‘all‘) NOT NULL DEFAULT ‘user‘,

`bytes_in_used` float NOT NULL DEFAULT ‘0‘,

`bytes_out_used` float NOT NULL DEFAULT ‘0‘,

`bytes_xfer_used` float NOT NULL DEFAULT ‘0‘,

`files_in_used` int(10) unsigned NOT NULL DEFAULT ‘0‘,

`files_out_used` int(10) unsigned NOT NULL DEFAULT ‘0‘,

`files_xfer_used` int(10) unsigned NOT NULL DEFAULT ‘0‘

) ENGINE=MyISAM DEFAULT CHARSET=utf8;

/*!40101 SET character_set_client = @saved_cs_client */;

/*!40103 SET TIME_ZONE=@OLD_TIME_ZONE */;

proftpd 程序启动文件配置:

ln -s /usr/local/proftpd/proftpd.sh /etc/init.d/proftpd

chkconfig --add proftpd

/etc/init.d/proftpd stop

启动文件内容:

[root@server:/usr/local/proftpd]# cat proftpd.sh

#!/bin/sh

# Startup script for ProFTPD

# chkconfig: 345 85 15

# description: ProFTPD is an enhanced FTP server with \

# a focus toward simplicity, security, and ease of configuration. \

# It features a very Apache-like configuration syntax, \

# and a highly customizable server infrastructure, \

# including support for multiple ‘virtual‘ FTP servers, \

# anonymous FTP, and permission-based directory visibility.

# processname: proftpd

# config: /usr/local/proftpd/etc/proftpd.conf

# By: Osman Elliyasa <[email protected]>

# $Id: proftpd.init.d,v 1.7 2002/12/07 21:50:27 jwm Exp $

# Source function library.

. /etc/rc.d/init.d/functions

if [ -f /etc/sysconfig/proftpd ]; then

. /etc/sysconfig/proftpd

PATH="$PATH:/usr/local/proftpd/sbin"

# See how we were called.

case "$1" in

start)

echo -n "Starting proftpd: "

daemon proftpd $OPTIONS

echo

touch /var/lock/subsys/proftpd

;;

stop)

echo -n "Shutting down proftpd: "

killproc proftpd

echo

rm -f /var/lock/subsys/proftpd

;;

status)

status proftpd

;;

restart)

$0 stop

$0 start

;;

reread)

echo -n "Re-reading proftpd config: "

killproc proftpd -HUP

echo

;;

suspend)

hash ftpshut >/dev/null 2>&1

if [ $? = 0 ]; then

if [ $# -gt 1 ]; then

shift

echo -n "Suspending with ‘$*‘ "

ftpshut $*

else

echo -n "Suspending NOW "

ftpshut now "Maintanance in progress"

else

echo -n "No way to suspend "

echo

;;

resume)

if [ -f /etc/shutmsg ]; then

echo -n "Allowing sessions again "

rm -f /etc/shutmsg

else

echo -n "Was not suspended "

echo

;;

echo -n "Usage: $0 {start|stop|restart|status|reread|resume"

hash ftpshut

if [ $? = 1 ]; then

echo ‘}‘

else

echo ‘|suspend}‘

echo ‘suspend accepts additional arguments which are passed to ftpshut(8)‘

exit 1

esac

if [ $# -gt 1 ]; then

shift

$0 $*

exit 0

添加用户相关脚本:

[root@server:/usr/local/proftpd]# cat adduser_dir.sh

#!/bin/bash

usage () {

echo ""

echo " Please Input Correct infomation!"

echo ""

echo " USAGE: `basename $0` username /dir ftp_server_ip"

echo " Exp: `basename $0` Lee /data/lee/home 1.1.1.1,2.2.2.2"

echo ""

echo " Result:"

echo " UserName: Lee"

echo " UserHome: /data/lee/home"

echo " PassWord: N1Jy3Fqol"

echo ""

}

if [[ $3 == "" ]];then

usage;

exit 1;

datetime=`date +%Y%m%d" "%H:%M:%S`

userid=$1

passwd=`mkpasswd -l 9 -d 2 -c 3 -C 3 -s 0`

home=$2

dst_passwd=‘{md5}‘`/bin/echo -n "$passwd" | openssl dgst -binary -md5 | openssl enc -base64`

shell=‘/sbin/nologin‘

accesshost=$3

/usr/local/mysql/bin/mysql -u ftp_user -p‘ws&&**ftp‘ -h 192.168.254.101 -e "\

use proftpd;insert into FTPUSERS VALUES(‘$userid‘,‘$dst_passwd‘,500,100,‘$home‘,‘/sbin/nologin‘,‘$accesshost‘,‘$datetime‘);"

echo "UserName: $userid"

echo "PassWord: $passwd"

echo "userHome: $home"

echo "FTP IPs: $accesshost"

echo ""

[root@server:/usr/local/proftpd]# cat adduser_domain.sh

#!/bin/bash

usage () {

echo ""

echo " Please Input Correct infomation!"

echo ""

echo " USAGE: `basename $0` domainname ftp_server_ip"

echo " Exp: `basename $0` www.test.com 1.1.1.1,2.2.2.2"

echo ""

echo " Result:"

echo " UserName: www.test.com"

echo " PassWord: N1Jy3Fqol"

echo ""

}

if [[ $2 == "" ]];then

usage;

exit 1;

datetime=`date +%Y%m%d" "%H:%M:%S`

userid=$1

passwd=`mkpasswd -l 9 -d 2 -c 3 -C 3 -s 0`

domain=$userid

if [[ $1 =~ ^www ]];then

domain=${1#www.}

dst_passwd=‘{md5}‘`/bin/echo -n "$passwd" | openssl dgst -binary -md5 | openssl enc -base64`

home="/data/www/vhosts/$domain"

shell=‘/sbin/nologin‘

accesshost=$2

/usr/local/mysql/bin/mysql -u ftp_user -p‘ws&&**ftp‘ -h 192.168.254.101 -e "\

use proftpd;insert into FTPUSERS VALUES(‘$userid‘,‘$dst_passwd‘,500,100,‘$home‘,‘/sbin/nologin‘,‘$accesshost‘,‘$datetime‘);"

echo "UserName: $userid"

echo "PassWord: $passwd"

echo "FTP IPs: $accesshost"

echo ""

关于用户限额配置:

quotalimits

name - username

quota_type - user, group, class, all (we use user)

per_session - true or false (we use false)

limit_type - quota limit type - hard or soft (we use soft)

bytes_in_avail - upload limit in bytes - allowed bytes on disk (eg diskquota)

bytes_out_avail - download limit in bytes - allowed bytes a user can download

bytes_xfer_avail - allowed bytes a user can transfer in/out

files_in_avail - upload limit in files - allowed number of uploaded files

files_out_avail - allowed number of downloaded files

files_xfer_avail - allowed number of files a user can transfer in/out

name 应该这样理解，既能表示单个用户，也能表示用户组名；如果我们在quota_type（限额类型）中使用group来认证的话，那就得在这里设置组名，这样整组都具有统一的磁盘限额的特性；当然您要在ftpgroups表中插入组纪录；并且在member字段中得把用户一个一个的列进去，这是后话了；先自己研究一下，只是插入纪录的事；我们只说最简单的单个用户的磁盘限额；默认值可以为空NULL，如果为空则针对所在有quota_type中设置的类型，比如在quota_type中设置为user ，就是针对所有ftpusers 中的用户起作用；如果是group名，也是对ftpgroups 所有组作用；

quota_type 磁盘限额类型，可以设置为用户，也可以设置为用户组group ；如果您的name写的是用户组，那在这里就得设置为group来认定；默认为user认证；

per_session 默认为false；

limit_type 默认为soft；

bytes_in_avail 用户占用空间大小，也就是家目录的空间最大可以让用户占用多少，单位是byte；默认为0，0是不受限制，以下同理；

bytes_out_avail 注；所有下载文件的总和，默认为0；

bytes_xfer_avail 注；一个用户上传下载流量总和，默认为0

files_in_avail 注：限制上传文件总数，默认为0；

files_out_avail 注；限制下载文件个数总计，默认为0

files_xfer_avail 注：允许下载和上传的文件总和我，默认为0；

由此看来，我们比如想让test用户，约束空间大小为100M，其它不受限制；则可用下面的mysql命令添加；

先让我们对照quotalimits表的结构，然后根据表的结构来添加；

mysql> describe quotalimits;