ftpd chroot的实现

最新推荐文章于 2022-04-14 19:03:28 发布

hit_fantasy

最新推荐文章于 2022-04-14 19:03:28 发布

阅读量2.3k

点赞数

分类专栏：安全

本文链接：https://blog.youkuaiyun.com/hit_fantasy/article/details/17960829

版权

安全专栏收录该内容

11 篇文章

订阅专栏

本文介绍如何在Ubuntu系统中安装并配置Pure-FTPd服务，并实现通过Chroot方式限制用户的访问范围，提高FTP服务器的安全性。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

首先安装pure-ftpd:

Sudo apt-getinstall pure-ftpd

配置过程：

fantasy@hp:~$ suroot

密码：

root@hp:/home/fantasy#groupadd ftpgroup

groupadd：“ftpgroup”组已存在

root@hp:/home/fantasy#useradd -g ftpgroup -d /home/ftpuser -s /sbin/nologin ftpuser

useradd：用户“ftpuser”已存在

root@hp:/home/fantasy#pure-pw useradd majiaji -u ftpuser -d /home/ftpuser/majiaji

Password:

Enter it again:

root@hp:/home/fantasy#pure-pw mkdb

测试一下ubuntu下的ftp服务器：

root@hp:/home/fantasy#service pure-ftpd start

Starting ftpserver: Running: /usr/sbin/pure-ftpd -l pam -8 UTF-8 -u 1000 -Oclf:/var/log/pure-ftpd/transfer.log -9 gbk -E -B

root@hp:/home/fantasy#ftp 127.0.0.1

Connected to127.0.0.1.

220----------Welcome to Pure-FTPd [privsep] [TLS] ----------

220-You are usernumber 1 of 50 allowed.

220-Local time isnow 07:08. Server port: 21.

220-This is aprivate system - No anonymous login

220-IPv6connections are also welcome on this server.

220 You will bedisconnected after 15 minutes of inactivity.

Name(127.0.0.1:fantasy): fantasy

331 User fantasyOK. Password required

Password:

230 OK. Currentdirectory is /home/fantasy

Remote system typeis UNIX.

Using binary modeto transfer files.

ftp> ls

200 PORT commandsuccessful

150 Connecting toport 49261

-rw-r----- 1 root shadow 1196 Nov 15 06:59aaa

-rw-r----- 1 root shadow 1204 Nov 9 10:34 aaa~

-rw-rw-r-- 1 fantasy fantasy 1204 Nov 8 21:12 bbb~

-rwxrwxrwx 1 fantasy fantasy 90 Nov 15 06:47bianyi.sh

-rwxrwxrwx 1 fantasy fantasy 90 Nov 15 06:47bianyi.sh~

-rw-rw-r-- 1 fantasy fantasy 4115 Nov 8 23:15 ccc~

-rwxrwxr-x 1 fantasy fantasy 23105 Nov 11 13:20client

-rw-rw-r-- 1 fantasy fantasy 700 Nov 11 13:22client.c

-rw-rw-r-- 1 fantasy fantasy 700 Nov 11 13:20client.c~

drwx------ 2 fantasy fantasy 4096 Nov 9 14:37 conf

-rw-r--r-- 1 fantasy fantasy 8942 Nov 7 00:28 examples.desktop

-rw-rw-r-- 1 fantasy fantasy 6924522 Nov 10 20:41gcc-3.4-ubuntu.tar.gz

drwxr-xr-x 9 root root 4096 Nov 10 09:41hell

-rwSr-xr-x 1 root root 11979 Nov 15 06:47lab2

-rw-rw-r-- 1 fantasy fantasy 4166 Nov 10 13:56 lab2.c

-rw-rw-r-- 1 fantasy fantasy 4166 Nov 10 13:15lab2.c~

-rw-rw-r-- 1 fantasy fantasy 26 Nov 8 19:31 ln.txt~

drwxr-xr-x 5 fantasy fantasy 4096 Nov 12 08:20oslab

-rw------- 1 fantasy fantasy 21586449 Sep 7 22:47 oslab.tar.gz

-rw-rw-r-- 1 fantasy fantasy 854 Nov 12 22:04proc.c

-rw-rw-r-- 1 fantasy fantasy 854 Nov 12 22:04proc.c~

-rwxrwxr-x 1 fantasy fantasy 1760 Nov 9 12:55 pure~

-rwxr-xr-x 1 root root 63637 Nov 10 22:34server

-rw-rw-r-- 1 fantasy fantasy 780 Nov 10 22:39server.c

-rw-rw-r-- 1 fantasy fantasy 780 Nov 10 22:39server.c~

-rw-rw-r-- 1 fantasy fantasy 212 Nov 7 20:53 sha512.c~

-rw-rw-r-- 1 fantasy fantasy 303 Nov 10 20:02test.c~

drwxrwxr-x 39 fantasy fantasy 4096 Nov 10 21:15unpv13e

-rw-rw-r-- 1 fantasy fantasy 427480 Nov 6 20:38 unpv13e.tar.gz

drwxr-xr-x 4 fantasy fantasy 4096 Nov 10 21:14????

drwxr-xr-x 2 fantasy fantasy 4096 Nov 7 00:34 ??????

-rw-rw-r-- 1 fantasy fantasy 991 Nov 8 20:43 ????????????????~

drwxr-xr-x 2 fantasy fantasy 4096 Nov 15 07:00????

drwxr-xr-x 2 fantasy fantasy 4096 Nov 7 00:34 ????

drwxr-xr-x 7 fantasy fantasy 4096 Nov 13 10:12????

drwxr-xr-x 2 fantasy fantasy 4096 Nov 7 00:34 ????

-rw-rw-r-- 1 fantasy fantasy 1302 Nov 8 23:50 ??

drwxr-xr-x 2 fantasy fantasy 4096 Nov 7 00:34 ????

226-Options: -l

226 39 matchestotal

ftp> exit

221-Goodbye. Youuploaded 0 and downloaded 0 kbytes.

221 Logout.

发现ubuntu下好使，关闭ubuntu下的ftp服务，在要chroot的文件夹myftp中进行配置。

root@hp:/home/fantasy#service pure-ftpd stop

Stopping ftpserver: pure-ftpd.

root@hp:/home/fantasy#mkdir myftp

root@hp:/home/fantasy#ll myftp

总用量 8

drwxr-xr-x 2 root root 4096 11月 15 07:11 ./

drwxr-xr-x 28fantasy fantasy 4096 11月15 07:11 ../

root@hp:/home/fantasy#whereis bash

bash: /bin/bash/etc/bash.bashrc /usr/share/man/man1/bash.1.gz

root@hp:/home/fantasy#cd myftp/

root@hp:/home/fantasy/myftp#cp /bin/bash ./ --parent

root@hp:/home/fantasy/myftp#ldd /bin/bash

linux-gate.so.1 => (0xb77a4000)

libtinfo.so.5 =>/lib/i386-linux-gnu/libtinfo.so.5 (0xb7770000)

libdl.so.2 =>/lib/i386-linux-gnu/libdl.so.2 (0xb776b000)

libc.so.6 =>/lib/i386-linux-gnu/libc.so.6 (0xb75b6000)

/lib/ld-linux.so.2 (0xb77a5000)

root@hp:/home/fantasy/myftp#cp /lib/i386-linux-gnu/libtinfo.so.5 ./ --parent

root@hp:/home/fantasy/myftp#cp /lib/i386-linux-gnu/libdl.so.2 ./ --parent

root@hp:/home/fantasy/myftp#cp /lib/i386-linux-gnu/libc.so.6 ./ --parent

root@hp:/home/fantasy/myftp#cp /lib/ld-linux.so.2 ./ --parent

root@hp:/home/fantasy/myftp#chroot ./

bash-4.2#

bash-4.2# exit

root@hp:/home/fantasy/myftp#whereis pure-ftpd

pure-ftpd:/usr/sbin/pure-ftpd /etc/pure-ftpd /usr/share/man/man8/pure-ftpd.8.gz

root@hp:/home/fantasy/myftp#cp /usr/s

sbin/ share/ src/

root@hp:/home/fantasy/myftp#cp /usr/sbin/pure-ftpd ./ --parent

root@hp:/home/fantasy/myftp#cp -r /etc/pure-ftpd/* ./ --parent

root@hp:/home/fantasy/myftp#ldd /usr/sbin/pure-ftpd

linux-gate.so.1 => (0xb771c000)

libssl.so.1.0.0 =>/lib/i386-linux-gnu/libssl.so.1.0.0 (0xb7669000)

libcrypto.so.1.0.0 =>/lib/i386-linux-gnu/libcrypto.so.1.0.0 (0xb74be000)

libcrypt.so.1 =>/lib/i386-linux-gnu/libcrypt.so.1 (0xb748b000)

libcap.so.2 =>/lib/i386-linux-gnu/libcap.so.2 (0xb7485000)

libpam.so.0 =>/lib/i386-linux-gnu/libpam.so.0 (0xb7476000)

libc.so.6 =>/lib/i386-linux-gnu/libc.so.6 (0xb72c2000)

libdl.so.2 =>/lib/i386-linux-gnu/libdl.so.2 (0xb72bd000)

libz.so.1 => /lib/i386-linux-gnu/libz.so.1(0xb72a3000)

libaudit.so.1 =>/lib/i386-linux-gnu/libaudit.so.1 (0xb7284000)

/lib/ld-linux.so.2 (0xb771d000)

root@hp:/home/fantasy/myftp#cp /lib/i386-linux-gnu/libssl.so.1.0.0 ./ --parent

root@hp:/home/fantasy/myftp#cp /lib/i386-linux-gnu/libcrypto.so.1.0.0 ./ --parent

root@hp:/home/fantasy/myftp#cp /lib/i386-linux-gnu/libcrypt.so.1 ./ --parent

root@hp:/home/fantasy/myftp#cp /lib/i386-linux-gnu/libcap.so.2 ./ --parent

root@hp:/home/fantasy/myftp#cp /lib/i386-linux-gnu/libpam.so.0 ./ --parent

root@hp:/home/fantasy/myftp#cp /lib/i386-linux-gnu/libc.so.6 ./ --parent

root@hp:/home/fantasy/myftp#cp /lib/i386-linux-gnu/libdl.so.2 ./ --parent

root@hp:/home/fantasy/myftp#cp /lib/i386-linux-gnu/libz.so.1 ./ --parent

root@hp:/home/fantasy/myftp#cp /lib/i386-linux-gnu/libaudit.so.1 ./ --parent

root@hp:/home/fantasy/myftp#cp /lib/ld-linux.so.2 ./ --parent

root@hp:/home/fantasy/myftp#mkdir dev

root@hp:/home/fantasy/myftp#ls

bin dev etc lib usr

root@hp:/home/fantasy/myftp#mknod -m 666 dev/null c 1 3

root@hp:/home/fantasy/myftp#mknod dev/urandom c 1 9

配置结束。

下面来测试一下在chroot的文件夹中中开启ftp服务器后的效果：

root@hp:/home/fantasy/myftp#chroot ./

bash-4.2#pure-ftpd -j -lpuredb:/etc/pure-ftpd/pureftpd.pdb

另开一个终端：

fantasy@hp:~$ ftp127.0.0.1

Connected to 127.0.0.1.

220----------Welcome to Pure-FTPd [privsep] [TLS] ----------

220-You are usernumber 1 of 50 allowed.

220-Local time isnow 23:22. Server port: 21.

220-IPv6connections are also welcome on this server.

220 You will bedisconnected after 15 minutes of inactivity.

Name(127.0.0.1:fantasy): majiaji

331 User majiajiOK. Password required

Password:

230 OK. Currentdirectory is /

Remote system typeis UNIX.

Using binary modeto transfer files.

ftp> ls

200 PORT commandsuccessful

150 Connecting toport 44810

226-Options: -l

226 0 matchestotal

ftp> mkdir test

257"test" : The directory was successfully created

ftp> exit

221-Goodbye. Youuploaded 0 and downloaded 0 kbytes.

221 Logout.

fantasy@hp:~$

在浏览器中连接ftp服务器：

尝试查看上一层目录：

发现不能向上，表明这时ftp服务器的根目录为myftp，实现了chroot的功能,达到了增强系统安全的效果。