该文档主要是记录 proftpd 配置 SSL/TSL 的安装部署配置文档
下载最新版的 proftpd
wget https://github.com/proftpd/proftpd/archive/master.zip
安装
unzip mastercd proftpd-master./configure --with-modules=mod_tls --prefix=/apps/svr/proftpdmake && sudo make install
sudo yum -y install gnutls*
下载 openssl-1.0.2
wget http://www.openssl.org/source/openssl-1.0.2.tar.gz
解压编译安装
tar -zxvf openssl-1.0.2.tar.gzcd openssl-1.0.2./configmake && sudo make install
下载 lftp
wget http://lftp.yar.ru/ftp/lftp-4.6.1.tar.gz
解压编译安装
./configure --without-gnutls --with-openssl=/usr/local/sslmake && sudo make install
mkdir -p /home/test/proftpd/etc/ftpcertopenssl genrsa 1024 > /home/test/proftpd/etc/ftpcert/host.keyopenssl req -new -x509 -nodes -sha1 -days 365 -key host.key > /home/test/proftpd/etc/ftpcert/host.cert2
### 配置 proftpd
配置文件如下,/home/test/proftpd/etc/proftpd.conf
ServerName "ProFTPD Default Installation"ServerType standaloneDefaultServer onPort 21 UseIPv6 offUmask 022#日志格式LogFormat default "%h %l %u %t \"%r\" %s %b"LogFormat auth "%v [%P] %h %t \"%r\" %s"LogFormat write "%h %l %u %t \"%r\" %s %b"DefaultTransferMode binaryServerIdent offMaxInstances 50User nobodyGroup nobodyDefaultRoot ~RootLogin offRequireValidShell offAllowOverwrite on#加快 ftp 的连接效率,去掉 DNS反向查询UseReverseDNS offIdentLookups offTransferLog /tmp/logs/ftpd/xferlogExtendedLog /tmp/logs/ftpd/access.log WRITE,READ writeExtendedLog /tmp/logs/ftpd/auth.log AUTH authExtendedLog /tmp/logs/ftpd/paranoid.log ALL default<Limit SITE_CHMOD> DenyAll</Limit>###匿名用户,全局<Anonymous ~ftp> User ftp Group ftp UserAlias anonymous ftp MaxClients 10 DisplayLogin welcome.msg DisplayChdir .message <Limit WRITE> DenyAll </Limit></Anonymous>#### 配置 TLS 部分<IfModule mod_tls.c> TLSEngine on TLSLog /tmp/logs/ftpd/proftpd-tls.log TLSProtocol SSLv3 TLSv1 TLSRequired on TLSRSACertificateFile /home/test/proftpd/etc/ftpcert/host.cert TLSRSACertificateKeyFile /home/test/proftpd/etc/ftpcert/host.key TLSVerifyClient off TLSRenegotiate required off</IfModule>####对ftp的登录用户做限制<Limit LOGIN> AllowUser test DenyAll</Limit>#### 对 FTP 的访问 IP 做限制<Limit LOGIN> Allow from 192.168.xx.xx DenyAll</Limit><Directory /> <Limit ALL> AllowUser test DenyAll </Limit></Directory>
后台启动命令
sudo /apps/svr/proftpd/sbin/proftpd -c /apps/svr/proftpd/etc/proftpd.conf
调试命令
sudo /apps/svr/proftpd/sbin/proftpd -c /apps/svr/proftpd/etc/proftpd.conf -d 10 -n
注:上面的 -n 选项是表示不后台启动,-d 选项是 debug 级别,从 0-10 级别,10 是最高级别
lftp -u test 192.168.xx.xxPassword: (这里输入 test 的密码)lftp apps@192.168.44.105:~> ls -rw-rw-r-- 1 apps apps 70305 Jun 17 2014 MySQL-python-1.2.3.tar.gzdrwxr-xr-x 19 root root 4096 Jul 25 2013 Python-2.7-rw-rw-r-- 1 apps apps 256862 Jun 17 2014 setuptools-0.6c11.tar.gzdrwxr-xr-x 15 root root 4096 Jun 20 2014 softwaredrwxr-xr-x 8 root root 4096 Jul 23 2014 tornado-2.0
联系客服