ftp 보안관련

ftp 취약점

스니핑시 다 보임
서버상에 계정이 있어야함  --->이는 시스템의 정보를 유출할 가능성 내포 

vsftp를 사용하자-->가상유저장점

사용가능한 용량 제한

익명사용자의 write권한 제한

PAM 유닉스 통합인증모듈

/etc/pam.d/ 안에 파일들을 살펴볼 수 있다. 

cat sshd

cat su

vsftpd에서 가상유저 만들기

vsftpd가 설치된경로 = /etc/vsftpd/~

# yum install db4-utils

# db_load -T -t hash -f virtual_user.txt /etc/vsftpd/vsftpd_login.db

# strings /etc/vsftpd/vsftpd_login.db

# chmod 600 /etc/vsftpd/vsftpd_login.db

# cp /etc/pam.d/vsftpd /etc/pam.d/vsftpd_virtual

# cat > /etc/pam.d/vsftpd_virtual

#%PAM-1.0

auth    required        pam_userdb.so   db=/etc/vsftpd/vsftpd_login

account required        pam_userdb.so   db=/etc/vsftpd/vsftpd_login

[2]+  Stopped  

# useradd -d /home/ftpsite -m virtual

# cp /etc/hosts /home/ftpsite/

# chown virtual.virtual /home/ftpsite/hosts 

# ls -l /home/ftpsite/

# vi /etc/vsftpd/vsftpd_virtual.conf

-----------------------------------

anonymous_enable=no

local_enable=YES

write_enable=YES

local_umask=022

#anon_upload_enable=YES

dirmessage_enable=YES

connect_from_port_20=YES

#chown_uploads=YES

#chown_username=whoever

xferlog_std_format=YES

xferlog_file=/var/log/xferlog

#idle_session_timeout=600

#data_connection_timeout=120

#nopriv_user=ftpsecure

#async_abor_enable=YES

#ascii_upload_enable=YES

#ascii_download_enable=YES

#ftpd_banner=Welcome to blah FTP service.

#deny_email_enable=YES

#banned_email_file=/etc/vsftpd/banned_emails

#chroot_list_enable=YES

#chroot_list_file=/etc/vsftpd/chroot_list

#ls_recurse_enable=YES

listen=YES

listen_port=1004

#listen_ipv6=YES

guest_enable=YES

guest_username=virtual

pam_service_name=vsftpd

pasv_min_port=30000

pasv_max_port=30009

virtual_use_local_privs=YES

user_sub_token=$USER

local_root=/home/ftpsite/$USER

#userlist_enable=YES

tcp_wrappers=YES