Tinux上构建FTP服务 -- 使用LDAP做用户验证

原本打算用MySQL(毕竟以前用过），但是考虑到MySQL体积太大以及对系统资源占用也不菲，故转用LDAP。

本文初步实现LDAP验证虚拟用户，至于Quota，还没有完成，网上资料大多关于MySQL的，看来只有自己摸索了....

安装OpenLDAP:


OpenLDAP要使用Berkeley DB或GDBM数据库做后台存储，这里我们选用Berkeley DB

安装Berkeley DB 4.4.16
======================

  # cd build_unix
  # ../dist/configure --prefix=/usr --enable-compat185 --enable-cxx
  # make LIBSO_LIBS="-lpthread" LIBXSO_LIBS="-lpthread"
  # make install

安装 OpenLDAP 2.3.11
====================
  # ./configure --prefix=/usr --libexecdir=/usr/sbin --sysconfdir=/etc 
      --localstatedir=/var/ldap --enable-dynamic --enable-debug
  # make depend
  # make
  # make install

配置 OpenLDAP 
=============
  # vi /etc/openldap/slapd.conf
  include         /etc/openldap/schema/core.schema
  include         /etc/openldap/schema/corba.schema
  include         /etc/openldap/schema/cosine.schema
  include         /etc/openldap/schema/inetorgperson.schema
  include         /etc/openldap/schema/misc.schema
  include         /etc/openldap/schema/openldap.schema
  include         /etc/openldap/schema/nis.schema

  suffix          "dc=test,dc=com"
  rootdn          "cn=manager,dc=test,dc=com"

启动 OpenLDAP
=============
# slapd
# ldapsearch -x -b '' -s base '(objectclass=*)' namingContexts

  如果正常的话，看到下面的信息：
  dn:
  namingContexts: dc=my-domain,dc=com
  # search result
  search: 2
  result: 0 Success

安装 Proftpd 1.3.0r3
====================

  到 ~jwm/software/mod_ldap/ 下载最新的mod_ldap
  # tar xfj mod_ldap-2.8.16.tar.bz2
  # mv mod_ldap-2.8.16/* proftpd-1.3.0rc/contrib
  # cd proftpd-1.3.0rc
  # ./configure --prefix=/usr --localstatedir=/var --sysconfdir=/etc/proftpd 
      --with-modules=mod_ldap:mod_quotatab:mod_quotatab_ldap:mod_quotatab_file
  # make
  # make install

配置 Proftpd
============

  LDAPServer  localhost
  LDAPDNInfo  cn=manager,dc=test,dc=com secret
  LDAPDoAuth  on  "ou=users,dc=test,dc=com"
  # 如果用户目录不存在，自动创建
  LDAPGenerateHomedir on
  CreateHome on 700

导入LDAP数据
===========

  # root.ldif
  dn: dc=test,dc=com
  objectClass: dcObject
  objectClass: organization
  dc: test
  o: test
  description: test coporation

  dn: ou=users,dc=test,dc=com
  objectClass: top
  objectClass: organizationalUnit
  ou: users
  description: user information

  dn: ou=groups,dc=test,dc=com
  objectClass: top
  objectClass: organizationalUnit
  ou: groups
  description: group information

  # users.ldif
  dn: uid=test,ou=users,dc=test, dc=com
  objectclass: posixAccount
  cn: John Morrissey
  uid: test
  uidNumber: 2000
  gidNumber: 100
  homeDirectory: /home/test
  userPassword: {crypt}test
  loginShell: /bin/bash

  # groups.ldif
  dn: cn=mygroup, ou=groups,dc=test, dc=com
  objectclass: posixGroup
  cn: mygroup
  gidNumber: 100
  memberUid: test

  导入数据：
  # ldapadd -x -D 'cn=manager,dc=test,dc=com' -w secret  -f root.ldif
  # ldapadd -x -D 'cn=manager,dc=test,dc=com' -w secret  -f users.ldif
  # ldapadd -x -D 'cn=manager,dc=test,dc=com' -w secret  -f groups.ldif

  改密码：
  # ldappasswd -x -D "cn=manager,dc=test,dc=com" -w secret "uid=test,ou=users,dc=test,dc=com" -S

调试登录
=======

  调试模式启动 proftpd： # proftpd -d 9 -n
  调试模式启动 openldap: # slapd -d 9
  客户端登录：# ftp 
  输入test以及上面的密码即可