Increasingly, FTP (File TransferProtocol)is criticized for itslack of securitycompared to othertransfer protocolssecure, as scp.It is stillwidely used andFedora providesdefaultvsftpd(VerySecureFile Transfer ProtocolDaemon)as a server forthis protocol. Like mostotherFTP(ProFTPD, pure-ftpd), vsftpd runsvirtual users, that is to saythe ability tocreate user accountswithoutthemaresystem users(they arein factall "mapped" on a usersystem dedicated tothis).The peculiarityis thatvsftpduses PAMfor authenticationof users.We thereforemanyauthentication optionsthatWFPoffers. This documentationdescribesa configuration ofvsftpdin standalone mode, with user authenticationsystem andvirtual users.Thelogin informationwill be storedinthesechoices in adatabaseformatberkeley,or amysql database.This documentationhas been tested onFedora 7, Fedora8, 9andpreviewCentos5.0/5.1, but should work onearlier versions.
Connection diagrams :
Thefollowing two diagramsare intended tohighlight theconnection trackingip_conntrackfor these2 modesto better understandthe exchange ofdata between the serverandFTPclient, allowingto implementrulesforiptablesfirewall.
Thediagrams showthe use of twodistinctchannels:
controlchannel:it allows theclient and serverto exchangecommands forthe protocol,and alsoidentify.
datachannel:as the nameimplies, it isused to exchangedatabetween the twopositions.It is on theimplementation ofthischanneldifferspassive modeandactive mode.
Installation :
Preparation andpre-requisite equipment
To install avsftpd servermusthave the following:
Serveron Linux /FedoraCore.
INTERNETaccess.
Ofdisk spacefor the different areasftp (anonymous or not)that you want toimplement.
Installationpackagesin the systemyum
# yum installvsftpd
verification
AskRPMtolistto verify the installationofpackages. # rpm-qa vsftpd* vsftpd-2.0.1-5
Configuration :
Ihere area numberof configuration options, varying server behaviorin very different ways. Reading theman pagefor vsftpdis indispensableforsecure configuration. The configuration filefor vsftpdis in/ etc/ vsftpdandvsftpd.confis called. We start from anempty configuration, sowe moveto the folder, and then renamethe file:
$ Su - # Cd/ etc/ vsftpd # Mvvsftpd.confvsftpd.conf.default
We then createa folderthat will contain theuser-specificconfigurations:
# Mkdirvsftpd_user_conf
ftpusersanduser_list These twofiles have the samepurpose:banningusers.Indeed itboth containa listof users for whichthe ftp serverwill reject anyconnection.Why twofiles (with identical content)?
The first (ftpusers) is used in thePAMconfigurationmadedefaultonFedoraand CentOS.Aconnection to auser, PAMhasread this file andifthe loginisusedin this file,the connection is refused.
Thesecond (user_list) is used directly byvsftpd.It can have twouses: either only usersin this filehave the rightto connectoraccess isalwaysdenied.
We do not careto have alist of authorized users(secondcase), sincethese will bemanagedwith a base ofvirtual users.It is therefore unnecessaryto havetwo systemsof prohibition.My choicewould be tofollowthe default settingsmade byCentOS andFedora, that is to sayuse PAM, so delete the fileuser_listunnecessary.And yetthisis not thesolution Iused.In factthere is a smalldifference in howto rejectusers.Ifroot (present in both filesby default)logs:
First case (ftpusers): the PAM systemwill not react, and the password will berequested.From there, evenif it iscorrect,WFP willrefuse the connectionas"root"is present in theftpusersfile.
Second case (user_list) Vsftpdgoing toreact differently.When theloginis requested,and the userwill type"root",it will cutthe connection directly, without even asking thepassword.C'est une subtilité, mais je préfère ce comportement. Le protocole
FTP envoyant les données en clair, cela évite par exemple d'envoyer le
mot de passe root pour rien. Je vais donc utiliser le fichier user_list
plutôt que ftpusers, même si ce n'est pas le choix par défaut fait pour
Fedora et Centos.
# Port d'ecoute
listen_port=21
# Banniere de bienvenue
ftpd_banner=Bienvenue sur mon ftp perso
# Fichier de config PAM
pam_service_name=vsftpd
# Mode "standalone"
listen=YES
# Je ne veux pas de connexion anonyme
anonymous_enable=Yes
# On autorise les connexions des utilisateurs locaux. C'est indispensable
# pour que les utilisateurs virtuels (mappes sur un utilisateur local)
# puissent se connecter (les "vrais" utilisateurs locaux sont ensuite desactives
# avec le fichier user_list
local_enable=YES
# Fichier de users
userlist_file=/etc/vsftpd/user_list
# Chargement de la liste userlist_file
userlist_enable=YES
# On refuse les utilisateurs de la liste
userlist_deny=YES
# trop restrictif, un utilisateur virtuel pourra ainsi telecharger un fichier meme s'il n'est pas world readable
anon_world_readable_only=NO
# Refus des commandes influant sur le systeme de fichier (STOR, DELE, RNFR, RNTO, MKD, RMD, APPE and SITE)
write_enable=Yes
# Refus des droits d'ecriture pour les anonymes (et donc utilisateurs virtuels) par défaut
# les autorisations seront données au cas par cas :
# pas d'upload
anon_upload_enable=NO
# pas de creation de repertoire
anon_mkdir_write_enable=NO
# pas de creation, suppression, renommage de repertoire ...
anon_other_write_enable=NO
# On fait en sorte que les utilisateurs "guest" (non-anonymes) soient mappés sur le compte local "ftp"
guest_enable=YES
guest_username=ftp
# chroot des utilisateurs
chroot_local_user=YES
# Nombre maximum de connexion simultanees
max_clients=50
# Nombre maximum de connexion venant de la meme IP
max_per_ip=4
# Dossier de configuration specifique des utilisateurs
user_config_dir=/etc/vsftpd/vsftpd_user_conf
# On active le log
xferlog_enable=YES
Petit résumé :
Itlistens onport 21
Oncethe configuration filereplaced, it restarts theFTP serverby typingas root: # / Etc /init.d /vsftpd start To start,stopandrestarttheservice,the respective commandsare(alwayssuperuser):
# service vsftpd start
# service vsftpd restart
# service vsftpd stop
Testserver
order 1-Open theprompt 2-Type -> ftp targetMachineIP I useftp192.168.1.5in this case, 3-type user nameand password I userootroot123
if whatyou provideis true thatyou are connected!
It is possibleto connect toan FTP serverusing theFTP modulecontentin Internet Explorer orFirefox To access aserverthat requiresa user nameanda password, type the address as follows: ftp://login:password @server address login:representsthe user name password: password
Exemple:
ftp://ftpclient:ftpclient@menara.ma ou Exemple: ftp://ftpclient:ftpclient@192.168.1.5
If yourloginis correct thenyou can accessyourfiles!
Well, nowyou'll haveto replace all occurrencesorappears"cn= admin, dc = lallal" with "cn = admin,dc = domain, dc = net"
access to attrs=userPassword,shadowLastChange
by dn="cn=admin,dc=domain,dc=net" write
by anonymous auth
by self write
by * none
which changesthe rights to theldapuserPasswordfor fieldsandshadowLastChange. admin hasfullaccess, itcan read and writethe owner can alsochange their ownfieldand finallyno accesstotherest of the world
and finallywe alloweveryoneto read theldap
access to *
by dn="cn=admin,dc=admin,dc=net" write
by * read
We'll do alittle testconnection. On the serverwe willrestart theLDAPso that they takeinto accountour changes.
/etc/init.d/slapd restart
thenwe will doa search in theldapconnecting with theldapadminaccount
ldapsearch -D "cn=admin,dc=domain,dc=net"-x -W
Thereisone butit does not giveerror. LDAPworks
Now we willadd fieldsinldap.To do thiswe will modifythe schema by addingthelatest version of theqmail.schemaIt is available at
LDAP
Mustcopy it into thedirectory /etc /ldap /schema.
Thenit must be declaredin the file /etc /ldap /slapd
afterthe blockisavailable
# Schema and objectClass definitions
include /etc/ldap/schema/core.schema
include /etc/ldap/schema/cosine.schema
include /etc/ldap/schema/nis.schema
include /etc/ldap/schema/inetorgperson.schema
Mustadd a line
include /etc/ldap/schema/qmail.schema
save andreboot creatingusers
wellourLDPworks but itis empty.We'll fill it witha filein ldif format. forexamplebraveo.ldif
eruserhere hasmore information thanis needed, but it serves to illustratethe content of aldap
Samba is a popular open-source program, which provides file and print services to Microsoft® Windows® clients. With
users, groups, resources are created and managed on a Samba server. As a
Linux client, you can use Calculate Linux Desktop or another
gentoo-based distribution with the installed calculate-client package. As a Windows client various Windows OSes can be used. To configure the server and the client see Migration to Linux. Any program configured with calculate-server is named "service".
The samba service configures Samba.
This service must be explicitly specified for calculate-server.
Example of adding the test user:
cl-useradd test samba
For users, access rights for server's file resources are the same for Linux and Windows systems.
Samba is included in Directory Server. If you use another gentoo system, Samba can be installed with portage: just run emerge net-fs/samba.
Configuring the server
To configure your server, you should use the calculate-server utilities. Begin by making sure that you have configured the LDAP and the Unix servers.
To configure the Samba server execute:
cl-setup [parameters] samba
Possible parameters are netbios and workgroup.
"-n name" sets the NetBIOS name, that will be used by the Samba server. It defaults to the first component of the DNS host name.
"-w workgroup" is the domain name or the NT workgroup name, for computers that will access the server.
If the Samba server is a PDC (Primary Domen Controller), you should set the administrator's password, i.e. the password for the admin user.
cl-passwd --smb admin samba
If you need domain administrator for windows computers, add new user
which will be included into domain group "Domain Admins", or include in
this group existing user.
The admin user only connects the client Windows machine to the domain and has no home directory.
If you need a domain administrator to manage Windows computers, add a
new user that will be added in the domain group "Domain Admins"; an
existing user might as well be added to this group.
Example of creating the domain administrator:
If you want to connect Unix clients, set the password for the client service user.
cl-passwd --smb client samba
Add and remove users
To manage users, the following commands are used: cl-useradd, cl-userdel, cl-usermod, cl-passwd, cl-groupadd, cl-groupdel, cl-groupmod. Their syntax is the same as for the analagous Unix commands.
Instead of smbpasswd, use cl-passwd for changing users' passwords, including the one for the administrator of Windows computers.
Example of adding the test user:
cl-useradd test samba
Example of changing password for the test user:
cl-passwd test samba
Example of adding a user to the primary group Domain Admins:
cl-useradd -g 'Domain Admins' test samba
Note that the samba option is appended to the command.
Set permissions
Setting access rights to the filesystem
To set file permissions on the server, use the ACL (Access Control
List). By changing files permissions, you can restrict access to them;
this applies both to Windows and Linux clients.
Access rights apply to files as well as to directories. You can
specify the permissions on the file's owner or the group. While the
Windows client will only recognize the Samba group, the Linux system
will display the names of both Unix and Samba groups. Therefore, is preferable to use the Samba group to set access rights.
To create a Samba group, named "manager", type:
cl-groupadd manager samba
To create a Unix group, named "job", execute:
cl-groupadd job unix
Detailed configuration of access rights using ACL is described in "Setting filesystem ACL"
Configuring access rights for Windows users
How to change access rights to shared files on the server is described above.
To configure additional rights on Windows machines, such as: the ability to install programs, to exit the domain, etc., use the Samba group.
Example of granting the test user with the domain administrator rights:
cl-groupmod -a test 'Domain Admins' samba
Structure of Samba groups
Samba groups can be of the following types:
Domain Groups (type 2)
Local groups (type 4)
Built-in groups (type 5)
Groups created default
Domain groups
Domain groups are Global groups that operate in the domain.
Domain Admins have full access to the domain computers.
Domain Guests have minimal rights.
Domain Users
Domain Computers
Local groups
Local groups are used locally on the computer.
There are no local groups.
Built-in groups
Built-in groups are groups built into the system.
Administrators have full rights.
Account Operators create and manage user account information, create and manage groups, backup files and directories.
Backup Operators backup, restore from a backup, halt the system.
Print Operators manage printers and make backups.
Replicators. This group is used by FRS File Replication on domain controllers.
System Operators change the system time, halt the system,
shutdown from a remote system, backup, restore from backup, lock the
server or override the server lock, format the hard disk when needed,
manage network directories, handle printers.
Creating a Samba group
Creating the domain group test. By default, a domain group is created, group type 2.
cl-groupadd test samba
Creating a built-in group Power Users for users with additional rights:
DNS (Domain Name System) is used to make the correspondence between the
IP address and machine name, it is called name resolution (to resolve
into English). More
concretely without DNS you would have to directly type the IP addresses
of machines on which you want to access (web, ftp, telnet and others). If
you are connected to an internet service provider (ISP) intermittently
by PPP, ADSL or other, it's usually your ISP's DNS servers that provide
name resolution, they usually go in pairs, one finds a primary DNS server and a secondary that is there in case of failure of the first.Now
why configuring a DNS server on an isolated post, even on a small
network of machines, because it can be used to solve a number of very
annoying problems mostly found in off-line mode (not connected to the
ISP ) including:- Launch of endless netscape or blocking at boot (for a period of 3min)- Sending mails in the folder waiting for sendmail that lasts more than a minute.But
also if you have enabled ipmasquerade to share your Internet connection
for your client, a DNS server allows them to surf and use the network
tools (telnet, ftp, ...). Assume
that your Linux machine, is called myhost and has IP address
192.168.13.10 (your private domain and not assigned by ISP) and your
privacy mondomaine.fr. Trees presented (especially in the autostart) are those of a Mandrake (a priori as a RedHat).I
will not go into details of the configuration files that you have the
DNS-HOWTO (linux section and HOW-TO) which is a good introduction. This
page is not intended to substitute for that document, it produces a
summary to install a DNS server quickly, for detailed explanations see
the HOWTO. It is primarily intended to an isolated post or even a small network connected in a non-permanent Internet.Note:
If you do not know the IP addresses of DNS servers of your ISP, if
automatic assignment of these addresses, for example, just log in and
read the addresses at the nameserver lines.
Installingand configuring the server:
hasset upa DNS serverrequires the installation oftwo toolsbindand named.It concernsa Mandrakepackagesbind,caching-nameserverand bind-utils. Linuxfor a clientit will onlybenefitfrom thelatest packageforthehostor digcommands. The installationcreateda file/etc /named.confwhich is as follows: // generated by named-bootconf.pl
// secret must be the same as in /etc/rndc.conf key "key" { algorithm hmac-md5; secret "c3Ryb25nIGVub3VnaCBmb3IgYSBtYW4gYnV0IG1hZGUgZm9yIGEgd29tYW4K"; }; controls { inet 127.0.0.1 allow { any; } keys { "key"; }; };
options { pid-file "/var/run/named/named.pid"; directory "/var/named"; /* * If there is a firewall between you and nameservers you want * to talk to, you might need to uncomment the query-source * directive below. Previous versions of BIND always asked * questions using port 53, but BIND 8.1 uses an unprivileged * port by default. */ // query-source address * port 53; }; // // a caching only nameserver config // zone "." { type hint; file "named.ca"; }; zone "0.0.127.in-addr.arpa" { type master; file "named.local"; };
On va le modifier pour lire: // secret must be the same as in /etc/rndc.conf key "key" { algorithm hmac-md5; secret "c3Ryb25nIGVub3VnaCBmb3IgYSBtYW4gYnV0IG1hZGUgZm9yIGEgd29tYW4K"; }; controls { inet 127.0.0.1 allow { any; } keys { "key"; }; }; options { pid-file "/var/run/named/named.pid"; directory "/var/named"; /* * If there is a firewall between you and nameservers you want * to talk to, you might need to uncomment the query-source * directive below. Previous versions of BIND always asked * questions using port 53, but BIND 8.1 uses an unprivileged * port by default. */ // query-source address * port 53; // on va mettre ici l'adresses IP des serveurs DNS de vos FAI, votre serveur relaiera les requêtes à ceux-ci // s'il n'est pas capable de les résoudre forward first; forwarders { 194.149.160.9; 194.149.160.1; }; }; // // a caching only nameserver config // zone "." { type hint; file "named.ca"; }; zone "0.0.127.in-addr.arpa" { type master; file "named.local"; }; zone "mondomaine.fr" { type master; file "mondomaine.fr"; };
The installationcreated a directory/var/ namedcontainingnamed.local @ IN SOA localhost. root.localhost. ( 1997022700 ; Serial 28800 ; Refresh 14400 ; Retry 3600000 ; Expire 86400 ) ; Minimum IN NS localhost. 1 IN PTR localhost.
On le modifiera pour lire: @ IN SOA mamachine.mondomaine.fr. root.mamachine.mondomaine.fr. ( 1997022700 ; Serial 28800 ; Refresh 14400 ; Retry 3600000 ; Expire 86400 ) ; Minimum IN NS mamachine.mondomaine.fr. 1 IN PTR localhost.
On créera sous /var/named un fichier mondomaine.fr contenant: @ IN SOA mamachine.mondomaine.fr. root.mondomaine.fr. ( 1997022700 ; Serial 28800 ; Refresh 14400 ; Retry 3600000 ; Expire 86400 ) ; Minimum TXT "mondomaine.fr mon ch'tit domaine" NS mamachine NS mamachine.mondomaine.fr. MX 10 mamachine MX 20 mamachine.mondomaine.fr.
localhost A 127.0.0.1 mamachine A 192.168.13.10 Givethis filenamedgroupnamed chown named:named mondomaine.fr FYIMXthuscorrespondsto the SMTP serverto your machineif youare runningsendmail. Nowinthe / etc/nsswitch.confmust haveittothe hosts line: hosts: files dns The DNS-HOWTOrequestthe creationof a file/etc /host.confcontaining order hosts,bind
multi on
I donot know if itis absolutely necessary, itseemsredundant withnsswitch.conf, butjust in case. To complete the/etc /resolv.conf: search mondomaine.fr nameserver 127.0.0.1 nameserver 194.149.160.9 nameserver 194.149.160.1 The last twoIP addressesare obviouslythose ofyourfavoriteISP. Note thatin the case ofan intermittent connectionwith pppwith automatic assignment ofIP addresses ofDNS servers, you cannotchangethe last two lines, they are automaticallypopulated when theconnection.
Autostartof named
Foraserver installationon Mandrake, the configuration of theDNSserver startautomaticinstallation, youcan skipthis chapter. Thedefaultinstallof bindandnamedautomatically generatesstartup files, just in case here are the details. You will findin/etc /rc.d/init.dnamedfilehas thefollowing contents: #!/bin/sh # # named This shell script takes care of starting and stopping # named (BIND DNS server). # # chkconfig: 345 55 45 # description: named (BIND) is a Domain Name Server (DNS) \ # that is used to resolve host names to IP addresses. # probe: true # Source function library. . /etc/rc.d/init.d/functions # Source networking configuration. . /etc/sysconfig/network # Check that networking is up. [ ${NETWORKING} = "no" ] && exit 0 [ -f /usr/sbin/named ] || exit 0 [ -f /etc/named.conf ] || exit 0 # See how we were called. case "$1" in start) # Start daemons. echo -n "Starting named: " daemon named echo touch /var/lock/subsys/named ;; stop) # Stop daemons. echo -n "Shutting down named: " killproc named rm -f /var/lock/subsys/named echo ;; status) /usr/sbin/ndc status exit $? ;; restart) /usr/sbin/ndc restart exit $? ;; reload) /usr/sbin/ndc reload exit $? ;; probe) # named knows how to reload intelligently; we don't want linuxconf # to offer to restart every time /usr/sbin/ndc reload >/dev/null 2>&1 || echo start exit 0 ;; *) echo "Usage: named {start|stop|status|restart}" exit 1 esac exit 0 The DNS serveris automatically startedatpower-on state3, 4and 5. It will stillrun aftertheinstallationby typing
/etc/rc.d/init.d/named start
Torestart named(after a file change), you would type: /etc /rc.d/init.d/named restart The other argumentsarestart, stop,restartandstatus.
Client Configuration:
Linuxfor a client, just createan / etc/resolv.confcontaining
domain mondomaine.fr
nameserver 192.168.13.10
You replaceitby theaddressof your server.
Do the sameforwindows clients, at thePanel and thenNetworkicon.
Function tests:
From aLinuxclientor serverhosttype the commandin a shell, controls typingappearin italics:host -a mamachine Trying "mamachine.mondomaine.fr" ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 33741 ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 0 ;; QUESTION SECTION: ;mamachine.mondomaine.fr. IN ANY ;; ANSWER SECTION: mamachine.mondomaine.fr. 86400 IN A 192.168.25.75 ;; AUTHORITY SECTION: mondomaine.fr. 86400 IN NS mamachine.mondomaine.fr. Received 65 bytes from 127.0.0.1#53 in 15 ms Then type: host -a mondomaine.fr Trying "mondomaine.fr" ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 47095 ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 5, AUTHORITY: 0, ADDITIONAL: 1 ;; QUESTION SECTION: ;mondomaine.fr. IN ANY ;; ANSWER SECTION: mondomaine.fr. 86400 IN SOA
mamachine.mondomaine.fr. root.mondomaine.fr. 1997022700 28800 14400
3600000 86400 mondomaine.fr. 86400 IN TXT "mondomaine.fr mon ch'tit domaine" mondomaine.fr. 86400 IN NS mamachine.mondomaine.fr. mondomaine.fr. 86400 IN MX 10 mamachine.mondomaine.fr. mondomaine.fr. 86400 IN MX 20 mamachine.mondomaine.fr. ;; ADDITIONAL SECTION: mamachine.mondomaine.fr. 86400 IN A 192.168.25.75 Received 179 bytes from 127.0.0.1#53 in 21 ms Once connected,aclientor servertype host -a www.shom.fr Trying "www.shom.fr." ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 12287 ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 3, ADDITIONAL: 3 ;; QUESTION SECTION: ;www.shom.fr. IN ANY ;; ANSWER SECTION: www.shom.fr. 217813 IN CNAME cyclone.shom.fr. ;; AUTHORITY SECTION: shom.fr. 330241 IN NS neree.shom.fr. shom.fr. 330241 IN NS resone.univ-rennes1.fr. shom.fr. 330241 IN NS dns.univ-lyon1.fr. ;; ADDITIONAL SECTION: dns.univ-lyon1.fr. 317766 IN A 134.214.100.6 neree.shom.fr. 330241 IN A 194.57.228.65 resone.univ-rennes1.fr. 300271 IN A 129.20.254.1 Received 182 bytes from 192.168.25.75#53 in 157 ms
Le ping should workalso.
Froma positionofwindowsto test yourserverin a Windowscommand prompt type nslookup At the prompt,type the name ofmachine under test >www.shom.fr Serveur: Unknown Address: 192.168.26.75 Réponse de source secondaire : Nom: cyclone.shom.fr Address: 194.57.228.1 Aliases: www.shom.fr Type CTRL+Cto exitpromptlyat t
Createvirtual hosts
You cancreatevirtual hosts withyour DNS server, in other words,your servermaybeidentiiféby severalnames, it isparticularly interestingfor apache. With a different namethat pointstothe same machine, however, wecanpointto different locations. Supposewewant tocreatevirtual hostswww.idefix.mondomaine.fr et www.asterix.mondomaine.fr, on rajoutera à la fin du fichier /var/named/mondomaine.fr, the following lines:www.asterix A 192.168.13.11 www.idefix A 192.168.13.11 Restart the serverby typing: /etc/rc.d/init.d/named restart To testa customertypein a shell: pingwww.asterix.mondomaine.fr It should work.
Après avoir configuré les fichiers de notre site en demarre notre navigateur et en tape localhost
Dans la barre d’adresses
Et en voie notre site web.
