proftpd+mysql用户认证+quota磁盘限额
proftpd+mysql用户认证+quota磁盘限额 整理编辑:mars (mars_diy@21cn.com) 网上关于proftpd的安装文章实在是不少,我只是稍微整理了一下,并且使用了新的 quota磁盘限额模块 由于proftpd最新版1.2.8目前还是RC版,加上有些设置不能通用, 所以在这里还是使用1.2.7版
proftpd+mysql用户认证+quota磁盘限额 整理编辑:mars (mars_diy@21cn.com) 网上关于proftpd的安装文章实在是不少,我只是稍微整理了一下,并且使用了新的 quota磁盘限额模块 由于proftpd最新版1.2.8目前还是RC版,加上有些设置不能通用, 所以在这里还是使用1.2.7版
./configure –prefix=/usr/local/proftpd \
–with-modules=mod_sql:mod_sql_mysql:mod_quotatab:mod_quotatab_sql \
–with-includes=/usr/local/mysql/include/mysql \
–with-libraries=/usr/local/mysql/lib/mysql
make
make install
修改proftpd配置
vim /usr/local/proftpd/etc/proftpd.conf
内容改为:
ServerName “mail2004.3322.org”
ServerType standalone
DefaultServer on
# 用户登陆时不显示ftp服务器版本信息
ServerIdent off
# Port 21 is the standard FTP port.
Port 21
# Umask 022 is a good standard umask to prevent new dirs and files
# from being group and world writable.
Umask 022
MaxLoginAttempts 3
TimeoutLogin 120
TimeoutIdle 600
TimeoutNoTransfer 900
TimeoutStalled 3600
MaxClients 100
# 设置每台主机最多并发连接数
MaxClientsPerHost 3
AllowOverwrite no
AllowStoreRestart on
UseReverseDNS off
# 设置如果shell为空时允许用户登录
RequireValidShell off
# 将用户限制在自己的主目录下
DefaultRoot ~
# To prevent DoS attacks, set the maximum number of child processes
# to 30. If you need to allow more than 30 concurrent connections
# at once, simply increase this value. Note that this ONLY works
# in standalone mode, in inetd mode you should use an inetd server
# that allows you to limit maximum number of processes per service
# (such as xinetd).
MaxInstances 30
# Set the user and group under which the server will run.
User nobody
Group nobody
# Normally, we want files to be overwriteable.
<Directory />
AllowOverwrite on
</Directory>
# A basic anonymous configuration, no upload directories.
# 匿名登录设置。匿名用户目录为/ftp
<Anonymous /ftp>
User ftp
Group ftp
# We want clients to be able to login with “anonymous” as well as “ftp”
# UserAlias anonymous ftp 停了它
# Limit the maximum number of anonymous logins
MaxClients 10
# We want ‘welcome.msg’ displayed at login, and ‘.message’ displayed
# in each newly chdired directory.
DisplayLogin welcome.msg
DisplayFirstChdir .message# Limit WRITE everywhere in the anonymous chroot
#<Limit WRITE>
# DenyAll
#</Limit>
</Anonymous>
以上是PROFTPD.conf下面加入sql和quota
# 数据库联接的信息,proftpdb是数据库名,localhost是主机名,proftpd是连接数据库的用户名,
#proftpdb是密码
#(如果没有密码留空)
SQLConnectInfo proftpdb@localhost proftp proftpdb
# 数据库认证的类型
SQLAuthTypes Backend Plaintext
# 数据库的鉴别
SQLAuthenticate users* groups*
# 指定用来做用户认证的表的有关信息。
SQLUserInfo ftpuser userid passwd uid gid homedir shell
SQLGroupInfo ftpgroup groupname gid members
# 如果home目录不存在,则系统会根据它的home项新建一个目录
SQLHomedirOnDemand on
这是目录所有者,我觉得这个很重要。所以我用nobody来做,在此我的nobody为99.
SQLDefaultGID 99
SQLDefaultUID 99SQLLog PASS updatecount
SQLNamedQuery updatecount UPDATE “count=count+1,accessed=now() WHERE userid=’%u’” ftpuser
# Update modified everytime user uploads or deletes a file
SQLLog STOR,DELE modified
SQLNamedQuery modified UPDATE “modified=now() WHERE userid=’%u’” ftpuser# 启用磁盘限额
QuotaDirectoryTally on
# 磁盘限额单位 b”|”Kb”|”Mb”|”Gb”
QuotaDisplayUnits “Kb”
QuotaEngine on
# 磁盘限额日志记录
QuotaLog “/var/log/quota.log”
# 打开磁盘限额信息,当登陆FTP帐户后,使用命令 “quote SITE QUOTA” 后可显示当前用#户的磁盘限额
QuotaShowQuotas on
以下为sql语句:
SQLNamedQuery get-quota-limit SELECT “name, quota_type, per_session, limit_type, bytes_in_avail,bytes_out_ava
il, bytes_xfer_avail, files_in_avail, files_out_avail, files_xfer_avail FROM ftpquotalimits WHERE name = ‘%{0
}’AND quota_type = ‘%{1}’”SQLNamedQuery get-quota-tally SELECT “name, quota_type, bytes_in_used, bytes_out_used, bytes_xfer_used, files
_in_used, files_out_used, files_xfer_used FROM ftpquotatallies WHERE name = ‘%{0}’ AND quota_type = ‘%{1}’”
SQLNamedQuery update-quota-tally UPDATE “bytes_in_used = bytes_in_used + %{0}, bytes_out_used = bytes_out_used + %{1}, bytes_xfer_used = bytes_xfer_used + %{2}, files_in_used = files_in_used + %{3}, files_out_used = files_out_used + %{4}, files_xfer_used = files_xfer_used + %{5} WHERE name = ‘%{6}’ AND quota_type = ‘%{7}’” ftpquotatalliesSQLNamedQuery insert-quota-tally INSERT “%{0}, %{1}, %{2}, %{3}, %{4}, %{5}, %{6}, %{7}” ftpquotatallies
QuotaLimitTable sql:/get-quota-limit
QuotaTallyTable sql:/get-quota-tally/update-quota-tally/insert-quota-tally下面可以用phpmyadmin在mysql里加入,我的sql为以下
CREATE TABLE `ftpgroup` (
`groupname` varchar(16) NOT NULL default ”,
`gid` smallint(6) NOT NULL default ’99′,
`members` varchar(16) NOT NULL default ”,
KEY `groupname` (`groupname`)
) TYPE=MyISAM COMMENT=’ProFTP group table’;INSERT INTO `ftpgroup` VALUES (‘nobody’, 99, ‘nobody’);
CREATE TABLE `ftpquotalimits` (
`name` varchar(30) default NULL,
`quota_type` enum(‘user’,'group’,'class’,'all’) NOT NULL default ‘user’,
`per_session` enum(‘false’,'true’) NOT NULL default ‘false’,
`limit_type` enum(‘soft’,'hard’) NOT NULL default ‘soft’,
`bytes_in_avail` float NOT NULL default ’0′,
`bytes_out_avail` float NOT NULL default ’0′,
`bytes_xfer_avail` float NOT NULL default ’0′,
`files_in_avail` int(10) unsigned NOT NULL default ’0′,
`files_out_avail` int(10) unsigned NOT NULL default ’0′,
`files_xfer_avail` int(10) unsigned NOT NULL default ’0′
) TYPE=MyISAM;CREATE TABLE `ftpquotatallies` (
`name` varchar(30) NOT NULL default ”,
`quota_type` enum(‘user’,'group’,'class’,'all’) NOT NULL default ‘user’,
`bytes_in_used` float NOT NULL default ’0′,
`bytes_out_used` float NOT NULL default ’0′,
`bytes_xfer_used` float NOT NULL default ’0′,
`files_in_used` int(10) unsigned NOT NULL default ’0′,
`files_out_used` int(10) unsigned NOT NULL default ’0′,
`files_xfer_used` int(10) unsigned NOT NULL default ’0′
) TYPE=MyISAM;CREATE TABLE `ftpuser` (
`id` int(10) unsigned NOT NULL auto_increment,
`userid` varchar(32) NOT NULL default ”,
`passwd` varchar(32) NOT NULL default ”,
`uid` smallint(6) NOT NULL default ’99′,
`gid` smallint(6) NOT NULL default ’99′,
`homedir` varchar(255) NOT NULL default ”,
`shell` varchar(16) NOT NULL default ‘/sbin/nologin’,
`count` int(11) NOT NULL default ’0′,
`accessed` datetime NOT NULL default ’0000-00-00 00:00:00′,
`modified` datetime NOT NULL default ’0000-00-00 00:00:00′,
PRIMARY KEY (`id`)
) TYPE=MyISAM COMMENT=’ProFTP user table’ ;
启动proftpd
/usr/local/proftpd/sbin/proftpd start
在数据数中的ftpuser中加入用户,密码他路径就可以了。
以上只是一个流水笔记
看到这篇还写得不错,拿过来欣赏下,我最喜欢拿来主义了:-)
另外今天被网上的以篇文章给误导了一上午,差点发飙,居然是因为COPY得太流畅了,连小错误都没发现。就是那篇网上流传得很广的proftp配置文章,里面有个建立新用户的过程,不自主的就发扬了COPY精神,弄了过来改个名字就用上了,结果里面有笔误?或者是作者系统比较特别将false 写成了fales,哈哈,估计不只我一个中招,记录下来,万一有朋友找到这里来还能知道是啥原因 Read more…
shell>tar -zxvf proftpd-1.2.10.tar.gz
shell>./configure –prefix=/usr/local/proftp
shell>make
shell>make install
如果想让系统启动时自动启动proftpd,具体配置如下:
shell>cd proftpd-1.2.10
shell>cp contrib/dist/rpm/proftpd.init.d /etc/rc.d/init.d/proftpd
shell>chkconfig –add proftpd
Read more…
官方网站实在是太慢了,弄到这里来加快点浏览速度
Version 1.0
Author: Falko Timme <ft [at] falkotimme [dot] com>
Last edited 12/04/2007
This tutorial shows how to set up a CentOS 5.1 based server that offers all services needed by ISPs and web hosters: Apache web server (SSL-capable), Postfix mail server with SMTP-AUTH and TLS, BIND DNS server, Proftpd FTP server, MySQL server, Dovecot POP3/IMAP, Quota, Firewall, etc. This tutorial is written for the 32-bit version of CentOS 5.1, but should apply to the 64-bit version with very little modifications as well.
I will use the following software:
In the end you should have a system that works reliably, and if you like you can install the free webhosting control panel ISPConfig (i.e., ISPConfig runs on it out of the box).
I want to say first that this is not the only way of setting up such a system. There are many ways of achieving this goal but this is the way I take. I do not issue any guarantee that this will work for you!
To install such a system you will need the following:
In this tutorial I use the hostname server1.example.com with the IP address 192.168.0.100 and the gateway 192.168.0.1. These settings might differ for you, so you have to replace them where appropriate.
Boot from your first CentOS 5.1 CD (CD 1) or the CentOS 5.1 DVD. Press <ENTER> at the boot prompt:
It can take a long time to test the installation media so we skip this test here:
The welcome screen of the CentOS installer appears. Click on Next:
Choose your language next:
Select your keyboard layout:
I’m installing CentOS 5.1 on a fresh system, so I answer Yes to the question Would you like to initialize this drive, erasing ALL DATA?
Now we must select a partitioning scheme for our installation. For simplicity’s sake I select Remove linux partitions on selected drives and create default layout. This will result in a small /boot and a large / partition as well as a swap partition. Of course, you’re free to partition your hard drive however you like it. Then I hit Next:
Answer the following question (Are you sure you want to do this?) with Yes:
On to the network settings. The default setting here is to configure the network interfaces with DHCP, but we are installing a server, so static IP addresses are not a bad idea… Click on the Edit button at the top right.
In the window that pops up uncheck Use dynamic IP configuration (DHCP) and Enable IPv6 support and give your network card a static IP address (in this tutorial I’m using the IP address 192.168.0.100 for demonstration purposes) and a suitable netmask (e.g. 255.255.255.0; if you are not sure about the right values, http://www.subnetmask.info might help you):
Set the hostname manually, e.g. server1.example.com, and enter a gateway (e.g. 192.168.0.1) and up to two DNS servers (e.g. 145.253.2.75 and 193.174.32.18):
Choose your time zone:
Give root a password:
Now we select the software we want to install. Select nothing but Server (uncheck everything else). Also don’t check Packages from CentOS Extras. Then check Customize now, and click on Next:
Now we must select the package groups we want to install. Select Editors, Text-based Internet, Development Libraries, Development Tools, DNS Name Server, FTP Server, Mail Server, MySQL Database, Server Configuration Tools, Web Server, Administration Tools, Base, and System Tools (unselect all other package groups) and click on Next:
The installer checks the dependencies of the selected packages:
Click on Next to start the installation:
The hard drive is being formatted:
The installation begins. This will take a few minutes:
Finally, the installation is complete, and you can remove your CD or DVD from the computer and reboot it:
After the reboot, you will see this screen. Select Firewall configuration and hit Run Tool:
I want to install ISPConfig at the end of this tutorial which comes with its own firewall. That’s why I disable the default CentOS firewall now. Of course, you are free to leave it on and configure it to your needs (but then you shouldn’t use any other firewall later on as it will most probably interfere with the CentOS firewall).
SELinux is a security extension of CentOS that should provide extended security. In my opinion you don’t need it to configure a secure system, and it usually causes more problems than advantages (think of it after you have done a week of trouble-shooting because some service wasn’t working as expected, and then you find out that everything was ok, only SELinux was causing the problem). Therefore I disable it, too (this is a must if you want to install ISPConfig later on). Hit OK afterwards:
Then leave the Setup Agent by selecting Exit:
Then log in as root and reboot the system so that your changes can be applied:
shutdown -r now
Now, on to the configuration…
空闲的时间安装VHCS,这个是用来做虚拟主机管理的,和CPANEL相比,VHCS是开源的,阿建用得着。 根据VHCS的安装文档重写如下,以方便安装 1. 安装OS choose "server" option during install firewall: open ssh/http/https/ftp/smtp ports selinux: disable (warn still generates errors in VHCS) select minimum install 安装类型选“自定义” 手动分区(4G虚拟硬盘) / ext3 2000M swap 2*mem /var ext3 剩余空间(用户数据在此分区上) eth0 关闭DHCP,10.10.10.180/255.255.255.0 hostname: srv180.capno.com gateway: 10.10.10.1 dns: 202.106.0.20/202.106.196.115 Enable firewall,默认的四个服务全允许(SSH/HTTP,HTTPS/FTP/SMTP) SELinux: Disable 安装包选择:Minimal最小化安装(676M) 2. 基本配置 # useradd admin;passwd admin(以下操作凡未说明的都以root身份执行) 使用ssh客户端连接server # vi /etc/fstab LABEL=/var /var ext3 defaults,usrquota 1 2 # touch /var/aquota.user; chmod 600 /var/aquota.user; mount -o remount /var; quotacheck -avugm # server iptables stop; mv /etc/rc.d/rc3.d/S08iptables /etc/rc.d/rc3.d/K08iptables # vi /etc/grub.conf timeout=1 删除以下无用的软件包(iiimf-server,iiimf-csconv,iiimf-docs,iiimf-libs,xorg-x11-xfs并未安装) # yum remove apmd autofs bluez-utils cups irda-utils isdn4k-utils pcmcia-cs sendmail ypbind xinetd 上传需要的软件包VHCS至/home/admin/ 包含vhcs安装包,yum安装和升级包(节约yum升级时间),编译好的包(节约编译时间,第一次需要按官方文档自行编译) # cd /home/admin/VHCS/; cp -p yum_base/* /var/cache/yum/base/packages/; cp -p yum_update/* /var/cache/yum/update/packages/ # rpm --import <a href="http://dag.wieers.com/packages/RPM-GPG-KEY.dag.txt">http://dag.wieers.com/packages/RPM-GPG-KEY.dag.txt</a> # vi /etc/yum.repos.d/CentOS-Base.repo的[base]和[update]项,设置为较快的镜象,如: baseurl=http://mirror.secuidc.com/centos/$releasever/os/$basearch/ baseurl=http://mirror.secuidc.com/centos/$releasever/update/$basearch/ # cat <<EOF > /etc/yum.repos.d/dag.repo [dag] name=Dag RPM Repository for Red Hat Enterprise Linux baseurl=http://apt.sw.be/redhat/el$releasever/en/$basearch/dag gpgcheck=1 enabled=1 exclude=proftpd* EOF # yum install perl-libwww-perl perl-HTML-Parser perl-HTML-Tagset perl-URI perl-Crypt-Blowfish perl-Crypt-CBC perl-Date-Calc perl-MIME-tools perl-Convert-BinHex perl-IO-stringy perl-MailTools perl-TimeDate # yum install rpm-build bind # rpm -Uvh cpan2rpm-2.028-1.noarch.rpm # tar vxfz Crypt-PasswdMD5-1.3.tgz; cd Crypt-PasswdMD5-1.3; perl Makefile.PL; make; make install; cd .. # tar vxfz Term-ReadPassword-0.07.tgz; cd Term-ReadPassword-0.07; perl Makefile.PL; make; make install; cd .. # rpm --import <a href="http://mirror.centos.org/centos/RPM-GPG-KEY-CentOS-4">http://mirror.centos.org/centos/RPM-GPG-KEY-CentOS-4</a> # yum install bison bzip2-devel cyrus-sasl cyrus-sasl-plain expect fam-devel flex freetype-devel gcc gcc-c++ gdbm-devel httpd httpd-devel iptables libc-client-devel libjpeg-devel libmcrypt libmcrypt-devel libpng-devel libtool libxslt-devel make mod_ssl mysql mysql-devel mysql-server ncurses-devel net-snmp-devel openssl openssl-devel openssl-perl pam-devel php php-imap php-gd php-mysql php-pgsql php-snmp pkgconfig postgresql-devel zlib-devel (删掉了mysql-admin这个包,不存在。) # ln -s /usr/lib/perl5/5.8.5/i386-linux-thread-multi/CORE/libperl.so /lib/ # rpm -Uvh proftpd-1.2.10-8_mysql.dag.i386.rpm; rpm -Uvh postfix-2.2.5-1.mysql.sasl2.vda.rhel4.i386.rpm; rpm -Uvh courier-authlib-*.rpm; rpm -Uvh courier-mysql-0*.rpm courier-0*.rpm courier-imapd-0*.rpm courier-pop3d-0*.rpm; rpm -Uvh php-mcrypt-4.3.9-3.1.1.i386.rpm # vi /etc/postfix/main.cf myhostname = srv180.capno.com # vi /etc/httpd/conf/httpd.conf ServerName srv180.capno.com:80 # chkconfig --add courier; service courier start; chkconfig proftpd on; service proftpd start; service mysqld start; service httpd start; service named start # mysql mysql> create database vhcs2;use mysql; mysql> update user set password=password('DB_PASSWORD') where User='root'; mysql> flush privileges; # cd /home/admin/VHCS/; tar -xjpvf vhcs2-2.4.7.1.tar.bz2; cd vhcs2-2.4.7.1/configs/vhcs2.conf SERVER_HOSTNAME = srv180 BASE_SERVER_IP = 10.10.10.180 MR_LOCK_FILE = /var/run/vhcs2.lock DATABASE_NAME = vhcs2 DATABASE_PASSWORD = **** BIND_CONF_FILE = /etc/named.conf BIND_DB_DIR = /var/named/chroot/var/named APACHE_CMD = /etc/init.d/httpd APACHE_NAME = httpd APACHE_LOG_DIR = /var/log/httpd APACHE_USERS_LOG_DIR = /var/log/httpd/users APACHE_BACKUP_LOG_DIR = /var/log/httpd/backup APACHE_CONF_FILE = /etc/httpd/conf.d/vhcs2.conf APACHE_USER = apache APACHE_GROUP = apache MTA_SASLDB_FILE = /etc/sasldb2 CMD_NAMED = /etc/init.d/named CMD_HTTPD = /etc/init.d/httpd CMD_AUTHD = /etc/init.d/courier-authlib CMD_IMAP = /etc/init.d/courier CMD_POP = /etc/init.d/courier CMD_VHCS2D = /etc/init.d/vhcs2 MAIL_TRAFF_LOG = maillog # sed -i "s#/usr/lib/postfix#/usr/libexec/postfix#g" /home/admin/VHCS/vhcs2-2.4.7.1/configs/postfix/main.cf # cd /home/admin/VHCS/vhcs2-2.4.7.1; make install # mkdir /var/named/chroot; mkdir /var/named/chroot/var; mkdir /var/named/chroot/var/named; chown -R named:named /var/named/chroot # cp --reply=yes -R /tmp/vhcs-2.4.7.1/* /; cp -pR /tmp/vhcs-2.4.7.1/var/mail/* /var/mail/; cp -pR /tmp/vhcs-2.4.7.1/etc/init.d/vhcs2_* /etc/init.d/; rmdir /etc/courier/userdb; touch /etc/courier/userdb;chmod 600 /etc/courier/userdb; cp -p /etc/courier/userdb /etc/authlib/userdb makeuserdb # cd /var/www/vhcs2/engine/setup/ # ./vhcs2-setup hostname: srv180 system network address: 10.10.10.180 SQL server host: localhost SQL database: vhcs2 SQL user: root SQL password: ******* VHCS ftp SQL user: vftp admin name: admin admin password: ******* admin e-mail: <a href="mailto:webmaster@capno.com">webmaster@capno.com</a> # sed -i "s/nogroup/nobody/" /etc/proftpd.conf # chmod u+w -R /var/www/vhcs2/gui/tools/webmail/ # cd /etc/vhcs2/bind/parts/ # cp -p cfg_entry.tpl cfg_entry.tpl.bak # vi cfg_entry.tpl original line: file "{DB_DIR}/{DMN_NAME}.db"; replacement line: file "{DMN_NAME}.db"; # sed -i "s/0700/0755/" /var/www/vhcs2/engine/vhcs2-* # touch /etc/sasldb2 (test with /usr/sbin/sasldblistusers2) # vi /etc/init.d/vhcs2 #!/bin/sh # # vhcs2 Start or stop the vhcs2 daemon # # chkconfig: - 95 5 # processname: vhcs2 # description: Start or stop the vhcs2 daemon # name='vhcs2' lockfile=/var/lock/subsys/vhcs2 confFile=/etc/vhcs2/vhcs2.conf pidFile=/var/log/vhcs2/vhcs2.pid daemon=/var/www/vhcs2/daemon/vhcs2_daemon name=vhcs2_daemon case "$1" in 'start') $daemon >/dev/null 2>&1 </dev/null RETVAL=$? if [ "$RETVAL" = "0" ]; then touch $lockfile >/dev/null 2>&1 fi ;; 'stop') pidfile=`grep "^pidfile=" $confFile | sed -e 's/pidfile=//g'` kill `cat $pidfile` RETVAL=$? if [ "$RETVAL" = "0" ]; then rm -f $lockfile fi ;; 'status') pidfile=`grep "^pidfile=" $confFile | sed -e 's/pidfile=//g'` if [ "$pidfile" = "" ]; then pidfile=$pidFile fi if [ -s $pidfile ]; then pid=`cat $pidfile` kill -0 $pid >/dev/null 2>&1 if [ "$?" = "0" ]; then echo "$name (pid $pid) is running" RETVAL=0 else echo "$name is stopped" RETVAL=1 fi else echo "$name is stopped" RETVAL=1 fi ;; 'restart') $stop && $start RETVAL=$? ;; *) echo "Usage: $0 { start | stop | restart }" RETVAL=1 ;; esac exit $RETVAL # chmod +x /etc/init.d/vhcs2 # chkconfig --add vhcs2 # cd /etc/rc.d/rc3.d # mv S35courier K35courier; mv S13portmap K13portmap; mv S14nfslock K14nfslock; mv S18rpcidmapd K18rpcidmapd; mv S19rpcgssd K19rpcgssd; mv S25netfs K25netfs; mv S40smartd K40smartd; mv S44acpid K44acpid; mv S80proftpd K80proftpd; mv S85gpm K85gpm; mv S95anacron K95anacron; mv S95atd K95atd; mv S97messagebus K97messagebus; mv S98haldaemon K98haldaemon # service httpd stop; service mysqld stop; service proftpd stop; service courier stop; service named stop; # service named start; service courier start; service proftpd start; service mysqld start; service httpd start; service vhcs2 start 访问<a href="http://10.10.10.180/vhcs2">http://10.10.10.180/vhcs2</a> admin登录后修改默认语言 Genaral -> Muiltlanguage -> Chinese, Save 修改/etc/php.ini, defaultcharset = "gb2312", 重启httpd |