linux pureftp mysql_pureftpd+mysql,虚拟机ftp服务

Virtual Hosting With PureFTPd And MySQL (Incl. Quota

And Bandwidth Management) On Debian Lenny

Debian 5.05 Lenny

Linux

2010-08-30

1 Preliminary Note

In this tutorial I use the hostname server1.example.com

with the IP address 192.168.0.100. These settings might

differ for you, so you have to replace them where appropriate.

2 Install MySQL And phpMyAdmin

This can all be installed with one single command:

aptitude install mysql-server mysql-client

phpmyadmin apache2

You will be asked these questions:

New password for the MySQL

"root" user:Repeat password for the MySQL "root" user: Web server to reconfigure automatically:

3 Install PureFTPd With MySQL Support

For Debian there is a pre-configured pure-ftpd-mysql

package available. Install it like this:

aptitude install pure-ftpd-mysql

Then we create an ftp group (ftpgroup)

and user (ftpuser) that all our virtual users will be

mapped to. Replace the group- and userid 2001 with a

number that is free on your system:

groupadd -g 2001 ftpgroup

useradd -u 2001 -s /bin/false -d /bin/null -c "pureftpd user" -g

ftpgroup ftpuser

4 Create The MySQL Database For PureFTPd

Now we create a database called pureftpd

and a MySQL user named pureftpd which the PureFTPd

daemon will use later on to connect to the pureftpd

database:

mysql -u root -p

CREATE DATABASE pureftpd;

GRANT SELECT, INSERT, UPDATE, DELETE, CREATE, DROP ON pureftpd.* TO

'pureftpd'@'localhost' IDENTIFIED BY 'ftpdpass';

GRANT SELECT, INSERT, UPDATE, DELETE, CREATE, DROP ON pureftpd.* TO

'pureftpd'@'localhost.localdomain' IDENTIFIED BY 'ftpdpass';

FLUSH PRIVILEGES;

这个地方要将localhost.localdomain,换成服务器的主机名，比如ftp3.tsnc.edu.cn

Replace the string ftpdpass with

whatever password you want to use for the MySQL user pureftpd.

Still on the MySQL shell, we create the database table we need (yes, there is

only one table!):

USE pureftpd;

CREATE TABLE ftpd (

User varchar(16) NOT NULL default '',

status enum('0','1') NOT NULL default '0',

Password varchar(64) NOT NULL default '',

Uid varchar(11) NOT NULL default '-1',

Gid varchar(11) NOT NULL default '-1',

Dir varchar(128) NOT NULL default '',

ULBandwidth smallint(5) NOT NULL default '0',

DLBandwidth smallint(5) NOT NULL default '0',

comment tinytext NOT NULL,

ipaccess varchar(15) NOT NULL default '*',

QuotaSize smallint(5) NOT NULL default '0',

QuotaFiles int(11) NOT NULL default 0,

PRIMARY KEY (User),

UNIQUE KEY User (User)

) TYPE=MyISAM;

quit;

As you may have noticed, with the quit;

command we have left the MySQL shell and are back on the Linux shell.

BTW, (I'm assuming that the hostname of your ftp server

system is server1.example.com) you can access

phpMyAdmin under http://server1.example.com/phpmyadmin/

(you can also use the IP address instead of server1.example.com)

in a browser and log in as the user pureftpd. Then

you can have a look at the database. Later on you can use phpMyAdmin to

administrate your PureFTPd server.

5 Configure PureFTPd

Edit /etc/pure-ftpd/db/mysql.conf.

It should look like this:

cp /etc/pure-ftpd/db/mysql.conf

/etc/pure-ftpd/db/mysql.conf_orig

cat /dev/null > /etc/pure-ftpd/db/mysql.conf

vi /etc/pure-ftpd/db/mysql.conf

MYSQLSocket/var/run/mysqld/mysqld.sock#MYSQLServerlocalhost#MYSQLPort3306MYSQLUserpureftpdMYSQLPasswordftpdpassMYSQLDatabasepureftpd#MYSQLCrypt md5, cleartext, crypt() or password() - md5 is VERY RECOMMENDABLE uppon cleartextMYSQLCryptmd5MYSQLGetPWSELECT Password FROM ftpd WHERE User="\L" AND status="1" AND (ipaccess = "*" OR ipaccess LIKE "\R")MYSQLGetUIDSELECT Uid FROM ftpd WHERE User="\L" AND status="1" AND (ipaccess = "*" OR ipaccess LIKE "\R")MYSQLGetGIDSELECT Gid FROM ftpd WHERE User="\L"AND status="1" AND (ipaccess = "*" OR ipaccess LIKE "\R")MYSQLGetDirSELECT Dir FROM ftpd WHERE User="\L"AND status="1" AND (ipaccess = "*" OR ipaccess LIKE "\R")MySQLGetBandwidthUL SELECT ULBandwidth FROM ftpd WHERE User="\L"AND status="1" AND (ipaccess = "*" OR ipaccess LIKE "\R")MySQLGetBandwidthDL SELECT DLBandwidth FROM ftpd WHERE User="\L"AND status="1" AND (ipaccess = "*" OR ipaccess LIKE "\R")MySQLGetQTASZSELECT QuotaSize FROM ftpd WHERE User="\L"AND status="1" AND (ipaccess = "*" OR ipaccess LIKE "\R")MySQLGetQTAFSSELECT QuotaFiles FROM ftpd WHERE User="\L"AND status="1" AND (ipaccess = "*" OR ipaccess LIKE "\R")

Make sure that you replace the string ftpdpass

with the real password for the MySQL user pureftpd in

the line MYSQLPassword! Please note that we use md5

as MYSQLCrypt method, which means we will store the

users' passwords as an MD5 string in the database which is far more secure than

using plain text passwords!

Then create the file /etc/pure-ftpd/conf/ChrootEveryone

which simply contains the string yes:

echo "yes" > /etc/pure-ftpd/conf/ChrootEveryone

This will make PureFTPd chroot every virtual user in his

home directory so he will not be able to browse directories and files outside

his home directory.

Also create the file /etc/pure-ftpd/conf/CreateHomeDir

which again simply contains the string yes:

echo "yes" >

/etc/pure-ftpd/conf/CreateHomeDir

This will make PureFTPd create a user's home directory when

the user logs in and the home directory does not exist yet.

Now we must configure PureFTPd as a standalone daemon (it

is currently controlled by inetd). To do this, we open /etc/default/pure-ftpd-common

and change the value of the parameter STANDALONE_OR_INETD

to standalone:

vi /etc/default/pure-ftpd-common

# Configuration for pure-ftpd# (this file is sourced by /bin/sh, edit accordingly)# STANDALONE_OR_INETD# valid values are "standalone" and "inetd".# Any change here overrides the setting in debconf.STANDALONE_OR_INETD=standalone# VIRTUALCHROOT:# whether to use binary with virtualchroot support# valid values are "true" or "false"# Any change here overrides the setting in debconf.VIRTUALCHROOT=false# UPLOADSCRIPT: if this is set and the daemon is run in standalone mode,# pure-uploadscript will also be run to spawn the program given below# for handling uploads. see /usr/share/doc/pure-ftpd/README.gz or# pure-uploadscript(8)# example: UPLOADSCRIPT=/usr/local/sbin/uploadhandler.plUPLOADSCRIPT=# if set, pure-uploadscript will spawn $UPLOADSCRIPT running as the# given uid and gidUPLOADUID=UPLOADGID=

Next, we modify /etc/inetd.conf and comment out the ftp line:

vi /etc/inetd.conf

[...]#:STANDARD: These are standard services.#ftpstreamtcpnowaitroot/usr/sbin/tcpd /usr/sbin/pure-ftpd-wrapper[...]

Afterwards, we restart Inetd and PureFTPd:

/etc/init.d/openbsd-inetd restart

/etc/init.d/pure-ftpd-mysql restart

6 Populate The Database And Test

To populate the database you can use the MySQL shell:

mysql -u root -p

USE pureftpd;

Now we create the user exampleuser

with the status 1 (which means his ftp account is

active), the password secret (which will be stored

encrypted using MySQL's MD5 function), the UID and GID 2001

(use the userid and groupid of the user/group you created at the end of step

two!), the home directory /home/www.example.com, an

upload and download bandwidth of 100 KB/sec. (kilobytes per second), and a

quota of 50 MB:

INSERT INTO `ftpd` (`User`, `status`, `Password`, `Uid`,

`Gid`, `Dir`, `ULBandwidth`, `DLBandwidth`, `comment`, `ipaccess`,

`QuotaSize`, `QuotaFiles`) VALUES ('exampleuser', '1', MD5('secret'), '2001',

'2001', '/home/www.example.com', '100', '100', '', '*', '50', '0');

quit;

Now open your FTP client program on your work station

(something like WS_FTP or SmartFTP if you are on a Windows system or gFTP on a

Linux desktop) and try to connect. As hostname you use server1.example.com

(or the IP address of the system), the username is exampleuser,

and the password is secret.

If you are able to connect - congratulations! If not,

something went wrong.

Now, if you run

ls -l /home

you should see that the directory /home/www.example.com

(exampleuser's home directory) has been automatically

created, and it is owned by ftpuser and ftpgroup (the user/group we created at the end of step

three):

server1:~# ls -l /home

total 8

drwxr-xr-x 2 administrator administrator 4096 2009-02-16 13:18 administrator

drwxr-xr-x 2 ftpuser       ftpgroup      4096 2009-06-05 16:09 www.example.com

server1:~#

7 Database Administration

For most people it is easier if they have a graphical

front-end to MySQL; therefore you can also use phpMyAdmin (in this example

under http://server1.example.com/phpmyadmin/) to

administrate the pureftpd database.

Whenever you want to create a new user, you have to create

an entry in the table ftpd so I will explain the

columns of this table here:

ftpd Table:

User: The

name of the virtual PureFTPd user (e.g. exampleuser).

status: 0 or

1. 0 means the account is disabled, the user cannot login.

Password: The

password of the virtual user. Make sure you use MySQL's MD5 function to save

the password encrypted as an MD5 string:

·UID: The userid of the ftp user

you created at the end of step two (e.g. 2001).

·GID: The groupid of the ftp group

you created at the end of step two (e.g. 2001).

·Dir: The home directory of the

virtual PureFTPd user (e.g. /home/www.example.com). If it does not exist, it

will be created when the new user logs in the first time via FTP. The virtual

user will be jailed into this home directory, i.e., he cannot access other directories

outside his home directory.

·ULBandwidth: Upload bandwidth of

the virtual user in KB/sec. (kilobytes per second). 0 means unlimited.

·DLBandwidth: Download bandwidth of

the virtual user in KB/sec. (kilobytes per second). 0 means unlimited.

·comment: You can enter any comment

here (e.g. for your internal administration) here. Normally you leave this

field empty.

·ipaccess: Enter IP addresses here

that are allowed to connect to this FTP account. * means any IP address is

allowed to connect.

·QuotaSize: Storage space in MB (not

KB, as in ULBandwidth and DLBandwidth!) the virtual user is allowed to use on

the FTP server. 0 means unlimited.

·QuotaFiles: amount of files

the virtual user is allowed to save on the FTP server. 0 means unlimited.

8 Anonymous FTP

If you want to create an anonymous ftp account (an ftp account that

everybody can login to without a password), you can do it like this:

First create a user ftp (with the homedir /home/ftp) and group ftp:

groupadd ftp

useradd -s /bin/false -d /home/ftp -m -c "anonymous ftp" -g ftp ftp

Then create the file /etc/pure-ftpd/conf/NoAnonymous which contains the

string no:

echo "no" > /etc/pure-ftpd/conf/NoAnonymous

With this configuration, PureFTPd will allow anonymous logins.

Restart PureFTPd:

/etc/init.d/pure-ftpd-mysql restart

Then we create the directory /home/ftp/incoming which will allow anonymous

users to upload files. We will give the /home/ftp/incoming directory

permissions of 311 so that users can upload, but not see or download any files

in that directory. The /home/ftp directory will have permissions of 555 which

allows seeing and downloading of files:

cd /home/ftp

mkdir incoming

chown ftp:nogroup incoming/

chmod 311 incoming/

cd ../

chmod 555 ftp/

Now anonymous users can login, and they can download files from /home/ftp,

but uploads are limited to /home/ftp/incoming (and once a file is uploaded into

/home/ftp/incoming, it cannot be read nor downloaded from there; the server

admin has to move it into /home/ftp first to make it available to others).

9 Links