Chinaunix首页 | 论坛 | 博客
  • 博客访问: 5359466
  • 博文数量: 1144
  • 博客积分: 11974
  • 博客等级: 上将
  • 技术积分: 12312
  • 用 户 组: 普通用户
  • 注册时间: 2005-04-13 20:06
文章存档

2017年(2)

2016年(14)

2015年(10)

2014年(28)

2013年(23)

2012年(29)

2011年(53)

2010年(86)

2009年(83)

2008年(43)

2007年(153)

2006年(575)

2005年(45)

分类: LINUX

2006-02-15 15:09:37

vsftpd pam] pam_mysql 安装配置总结
前一段时间,论坛里总有朋友问到pam-mysql的安装问题。比较典型的有:
vsftp1.2+mysql4.1+pam_mysql0.5在RedHat AS4(32bit)下好像是有bug
还是mysql虚拟用户和vsftpd的登陆问题?
为了解答类似的问题,我动手试验了一下vsftpd+pam-mysql的配置过程,总结如下:
 
系统环境:
RedHat AS 4
MySQL 4.1.15
pam_mysql-0.7pre3
说明一下,MySQL我是使用其官方网站的rpm包安装的,包括下面这4个:
MySQL-server-standard-4.1.15-0.rhel4.i386.rpm
MySQL-client-standard-4.1.15-0.rhel4.i386.rpm
MySQL-devel-standard-4.1.15-0.rhel4.i386.rpm
MySQL-shared-standard-4.1.15-0.rhel4.i386.rpm
vsftpd是RedHat自带的。

建立用于存放vsftpd虚拟用户的Schema的过程:
mysql> create database vsftpd;
mysql> use vsftpd;
mysql> create table users (
    -> id int AUTO_INCREMENT NOT NULL,
    -> name char(16) binary NOT NULL,
    -> passwd char(48) binary NOT NULL,
    -> primary key(id)
    -> );
mysql> describe users;
+--------+----------+------+-----+---------+----------------+
| Field  | Type     | Null | Key | Default | Extra          |
+--------+----------+------+-----+---------+----------------+
| id     | int(11)  |      | PRI | NULL    | auto_increment |
| name   | char(16) |      |     |         |                |
| passwd | char(48) |      |     |         |                |
+--------+----------+------+-----+---------+----------------+
mysql> create table logs (msg varchar(255),
    -> user char(16),
    -> pid int,
    -> host char(32),
    -> rhost char(32),
    -> logtime timestamp
    -> );
mysql> describe logs;
+---------+--------------+------+-----+-------------------+-------+
| Field   | Type         | Null | Key | Default           | Extra |
+---------+--------------+------+-----+-------------------+-------+
| msg     | varchar(255) | YES  |     | NULL              |       |
| user    | varchar(16)  | YES  |     | NULL              |       |
| pid     | int(11)      | YES  |     | NULL              |       |
| host    | varchar(32)  | YES  |     | NULL              |       |
| rhost   | varchar(32)  | YES  |     | NULL              |       |
| logtime | timestamp    | YES  |     | CURRENT_TIMESTAMP |       |
+---------+--------------+------+-----+-------------------+-------+
这里,用户密码这个字段的长度是48。这是根据MySQL加密函数的返回值的长度确定的。关于PASSWORD函数返回值的长度,可以参考这个:
mysql> select encrypt('foo');
+----------------+
| encrypt('foo') |
+----------------+
| 4Wwn2AXFYb.So  |
+----------------+
mysql> select password('foo');
+-------------------------------------------+
| password('foo')                           |
+-------------------------------------------+
| *F3A2A51A9B0F2BE2468926B4132313728C250DBF |
+-------------------------------------------+
mysql> select md5('foo');
+----------------------------------+
| md5('foo')                       |
+----------------------------------+
| acbd18db4cc2f85cedef654fccc4a4d8 |
+----------------------------------+
编译安装pam_mysql
# ./configure --with-openssl
# make
# make install
加上--with-openssl可以避免make时报有关md5.h的编译错误
建立/etc/pam.d/vsftpd.mysql(因为只是想验证pam_mysql的安装过程,所以我不想覆盖原有的vsftpd这个文件)。注意只有两行,auth是一行,account是一行。
auth   required      /lib/security/pam_mysql.so user=root passwd=123456 host=localhost db=vsftpd table=users usercolumn=name passwdcolumn=passwd crypt=2 sqllog=1 logtable=logs logmsgcolumn=msg logusercolumn=user logpidcolumn=pid loghostcolumn=host logrhostcolumn=rhost logtimecolumn=logtime verbose=1
account  required      /lib/security/pam_mysql.so user=root passwd=123456 host=localhost db=vsftpd table=users usercolumn=name passwdcolumn=passwd crypt=2 sqllog=1 logtable=logs logmsgcolumn=msg logusercolumn=user logpidcolumn=pid loghostcolumn=host logrhostcolumn=rhost logtimecolumn=logtime verbose=1
注意这里pam_mysql.so的路径是/lib/security;指定了sqllog;加密方式是2,也就是用MySQL PASSWORD()函数;verbose=1,设置这个可以帮助调试,日志信息输出在/var/log/messages里。
建立/etc/vsftpd/vsftpd.mysql.conf(同样,不影响已有的vsftpd服务,执行service vsftpd restart时会启动两个vsftpd服务,端口不一样)
主要的设置如下:

pam_service_name=vsftpd.mysql
listen=YES
tcp_wrappers=YES
local_enable=YES
guest_enable=YES
guest_username=ftp
listen_port=2121

注意pam_service_name=vsftpd.mysql指定了使用刚才设置的pam_mysql。
插入用户信息:
mysql> insert into users (name,passwd) values('tom',password('foo'));
mysql> insert into users (name,passwd) values('jerry',password('bar'));
mysql> select * from users;
+----+-------+-------------------------------------------+
| id | name  | passwd                                    |
+----+-------+-------------------------------------------+
|  1 | tom   | *F3A2A51A9B0F2BE2468926B4132313728C250DBF |
|  2 | jerry | *E8D46CE25265E545D225A8A6F1BAF642FEBEE5CB |
+----+-------+-------------------------------------------+
启动vsftpd服务,测试配置:
# ftp localhost 2121
登录失败,检查/var/log/messages,发现:
# tail -f /var/log/messages
Nov 29 14:52:04 javadev vsftpd[17683]: PAM unable to dlopen(/lib/security/pam_mysql.so)
Nov 29 14:52:04 javadev vsftpd[17683]: PAM [dlerror: /lib/security/pam_mysql.so: cannot open shared object file: No such file or directory]
Nov 29 14:52:04 javadev vsftpd[17683]: PAM adding faulty module: /lib/security/pam_mysql.so
看来是没找到pam_mysql.so,怎么会呢?
用find(也可以用locate,不过得先updatedb一下,慢)找了一下,原来make install的时候默认安装在/usr/local/lib下。修改/etc/pam.d/vsftpd.mysql
auth   required      /usr/lib/security/pam_mysql.so user=root passwd=123456 host=localhost db=vsftpd table=users usercolumn=name passwdcolumn=passwd crypt=2 sqllog=1 logtable=logs logmsgcolumn=msg logusercolumn=user logpidcolumn=pid loghostcolumn=host logrhostcolumn=rhost logtimecolumn=logtime verbose=1
account  required    /usr/lib/security/pam_mysql.so user=root passwd=123456 host=localhost db=vsftpd table=users usercolumn=name passwdcolumn=passwd crypt=2 sqllog=1 logtable=logs logmsgcolumn=msg logusercolumn=user logpidcolumn=pid loghostcolumn=host logrhostcolumn=rhost logtimecolumn=logtime verbose=1
在登录,成功!换用其他加密方式,也都可以。
然后试验pam_mysql v0.7新加的config_file配置选项。这个选项用来指定一个配置文件,可以把所有pam_mysql的配置放在这个文件中。这样的话,/etc/pam.d/vsftpd.mysql的内容变成这样:
auth    required        /usr/lib/security/pam_mysql.so config_file=/etc/security/pam_mysql.conf
account required        /usr/lib/security/pam_mysql.so config_file=/etc/security/pam_mysql.conf
清爽了许多吧,
/etc/security/pam_mysql.conf的内容:
users.host=localhost
users.database=vsftpd
users.db_user=root
users.db_passwd=123456
users.table=users
users.user_column=name
users.password_column=passwd
users.password_crypt=3
verbose=1
log.enabled=1
log.table=logs
log.message_column=msg
log.pid_column=pid
log.user_column=user
log.host_column=host
log.rhost_column=rhost
log.time_column=logtime

改好这些以后,用之前建好的虚拟用户登录,居然不行!而且这次/var/log/messages里没有任何错误消息。ls -ltr /var/log 发现secure这个文件最新,试着打开,果然发现了pam_mysql的调试信息:
Dec 26 16:18:37 javadev vsftpd[6175]: pam_mysql - option verbose is set to "1"
Dec 26 16:18:37 javadev vsftpd[6175]: pam_mysql - option log.enabled is set to "1 "
Dec 26 16:18:37 javadev vsftpd[6175]: pam_mysql - option log.table is set to "logs"
Dec 26 16:18:37 javadev vsftpd[6175]: pam_mysql - option log.message_column is set to "msg"
Dec 26 16:18:37 javadev vsftpd[6175]: pam_mysql - option log.pid_column is set to "pid"
Dec 26 16:18:37 javadev vsftpd[6175]: pam_mysql - option log.user_column is set to "user"
Dec 26 16:18:37 javadev vsftpd[6175]: pam_mysql - option log.host_column is set to "host"
Dec 26 16:18:37 javadev vsftpd[6175]: pam_mysql - option log.rhost_column is set to "rhost"
Dec 26 16:18:37 javadev vsftpd[6175]: pam_mysql - option log.time_column is set to "logtime"
Dec 26 16:18:37 javadev vsftpd[6175]: pam_mysql - pam_sm_authenticate() called.
Dec 26 16:18:37 javadev vsftpd[6175]: pam_mysql - pam_mysql_open_db() called.
Dec 26 16:18:42 javadev vsftpd[6175]: pam_mysql - MySQL error (Unknown MySQL server host 'localhost ' (3))
Dec 26 16:18:42 javadev vsftpd[6175]: pam_mysql - pam_mysql_open_db() returning 5.
Dec 26 16:18:42 javadev vsftpd[6175]: pam_mysql - pam_sm_authenticate() returning 9.
Dec 26 16:18:42 javadev vsftpd[6175]: pam_mysql - pam_mysql_release_ctx() called.
Dec 26 16:18:42 javadev vsftpd[6175]: pam_mysql - pam_mysql_destroy_ctx() called.
Dec 26 16:18:42 javadev vsftpd[6175]: pam_mysql - pam_mysql_close_db() called.
仔细检查,发现原因在这里:
pam_mysql - MySQL error (Unknown MySQL server host 'localhost ' (3))
原来配置文件里users.host=localhost 这行行尾多了一个空格!郁闷!修改以后就可以登录了。
最后,我在论坛里回复时说过不能用password这种方式,原因是
2 (or "mysql") = Use MySQL PASSWORD() function. It is possible
                        that the encryption function used by PAM-MySQL
                        is different from that of the MySQL server, as
                        PAM-MySQL uses the function defined in MySQL's
                        C-client API instead of using PASSWORD() SQL function
                        in the query.
事实证明我说错了。
还有,两个log可以帮助分析故障(当然可能仅在RedHat下),/var/log/messages和/var/log/secure

作者: wolfg ( CU论坛 ) :: 回复 (3) :: 静态链接网址 :: 引用 (0)
3 Responses to “[vsftpd pam] pam_mysql 安装配置总结”
1
twty 2006-01-03 17:17 Say: [回复]
让FTP服务器实现本地用户和MySQL用户都可以登陆时,不像文章所介绍的用两个FTP服务,pam文件怎么写?
2
wolfg 2006-01-03 18:31 Say:
按照本文介绍的方法修改你现有的pam文件就可以。
3
ccxxx 2006-01-07 11:15 Say: [回复]
不知何故,登陸失敗,但可寫入mysql.請你幫忙幫忙,謝謝.
[root@linux ~]# ftp localhost 2121
Connected to linux.localdomain
220 FTP Server.
530 Please login with USER and PASS.
530 Please login with USER and PASS.
KERBEROS_V4 rejected as an authentication type
Name (localhost:root): tom
331 Please specify the password.
Password:
530 Login incorrect.
Login failed.
ftp>
auth required /usr/lib/security/pam_mysql.so verbose=1 user=vsftpd passwd=123456 host=localhost db=vsftpd table=users usercolumn=name passwdcolumn=passwd crypt=2 sqllog=1 logtable=logs logmsgcolumn=msg logusercolumn=user logpidcolumn=pid loghostcolumn=host logrhostcolumn=rhost logtimecolumn=logtime
account required /usr/lib/security/pam_mysql.so verbose=1 user=vsftpd passwd=123456 host=localhost db=vsftpd table=users usercolumn=name passwdcolumn=passwd crypt=2 sqllog=1 logtable=logs logmsgcolumn=msg logusercolumn=user logpidcolumn=pid loghostcolumn=host logrhostcolumn=rhost logtimecolumn=logtime
| AUTHENTICATION FALURE (FIRST_PASS) | tom | 2986 | 127.0.0.1 | 127.0.0.1 | 2006-01-07 04:58:58 |
| AUTHENTICATION FAILURE | tom | 2986 | 127.0.0.1 | 127.0.0.1 | 2006-01-07 04:58:59 |
Jan 7 11:32:22 linux vsftpd[9142]: pam_mysql - option verbose is set to "1"
Jan 7 11:32:22 linux vsftpd[9142]: pam_mysql - option user is set to "vsftpd"
Jan 7 11:32:22 linux vsftpd[9142]: pam_mysql - option passwd is set to "vsFtp123"
Jan 7 11:32:22 linux vsftpd[9142]: pam_mysql - option host is set to "localhost"
Jan 7 11:32:22 linux vsftpd[9142]: pam_mysql - option db is set to "vsftpd"
Jan 7 11:32:22 linux vsftpd[9142]: pam_mysql - option table is set to "users"
Jan 7 11:32:22 linux vsftpd[9142]: pam_mysql - option usercolumn is set to "name"
Jan 7 11:32:22 linux vsftpd[9142]: pam_mysql - option passwdcolumn is set to "passwd"
Jan 7 11:32:22 linux vsftpd[9142]: pam_mysql - option crypt is set to "1"
Jan 7 11:32:22 linux vsftpd[9142]: pam_mysql - option sqllog is set to "1"
Jan 7 11:32:22 linux vsftpd[9142]: pam_mysql - option logtable is set to "logs"
Jan 7 11:32:22 linux vsftpd[9142]: pam_mysql - option logmsgcolumn is set to "msg"
Jan 7 11:32:22 linux vsftpd[9142]: pam_mysql - option logusercolumn is set to "user"
Jan 7 11:32:22 linux vsftpd[9142]: pam_mysql - option logpidcolumn is set to "pid"
Jan 7 11:32:22 linux vsftpd[9142]: pam_mysql - option loghostcolumn is set to "host"
Jan 7 11:32:22 linux vsftpd[9142]: pam_mysql - option logrhostcolumn is set to "rhost"
Jan 7 11:32:22 linux vsftpd[9142]: pam_mysql - option logtimecolumn is set to "logtime"
Jan 7 11:32:22 linux vsftpd[9142]: pam_mysql - pam_mysql_close_db() called.
Jan 7 11:32:22 linux vsftpd[9142]: pam_mysql - pam_sm_authenticate() called.
Jan 7 11:32:22 linux vsftpd[9142]: pam_mysql - pam_mysql_open_db() called.
Jan 7 11:32:22 linux vsftpd[9142]: pam_mysql - pam_mysql_open_db() returning 0.
Jan 7 11:32:22 linux vsftpd[9142]: pam_mysql - pam_mysql_check_passwd() called.
Jan 7 11:32:22 linux vsftpd[9142]: pam_mysql - pam_mysql_format_string() called
Jan 7 11:32:22 linux vsftpd[9142]: pam_mysql - pam_mysql_quick_escape() called.
Jan 7 11:32:22 linux vsftpd[9142]: pam_mysql - SELECT passwd FROM users WHERE name = 'tom'
Jan 7 11:32:22 linux vsftpd[9142]: pam_mysql - pam_mysql_check_passwd() returning 6.
Jan 7 11:32:22 linux vsftpd[9142]: pam_mysql - pam_mysql_sql_log() called.
Jan 7 11:32:22 linux vsftpd[9142]: pam_mysql - pam_mysql_format_string() called
Jan 7 11:32:22 linux vsftpd[9142]: pam_mysql - pam_mysql_quick_escape() called.
Jan 7 11:32:22 linux last message repeated 3 times
Jan 7 11:32:22 linux vsftpd[9142]: pam_mysql - INSERT INTO logs (msg, user, host, rhost, pid, logtime) VALUES ('AUTHENTICATION FALURE (FIRST_PASS)', 'tom', '127.0.0.1', '127.0.0.1', '9142', NOW())
Jan 7 11:32:22 linux vsftpd[9142]: pam_mysql - pam_mysql_sql_log() returning 0.
Jan 7 11:32:22 linux vsftpd[9142]: pam_mysql - pam_mysql_converse() called.
Jan 7 11:32:22 linux vsftpd[9142]: pam_mysql - pam_mysql_open_db() called.
Jan 7 11:32:22 linux vsftpd[9142]: pam_mysql - pam_mysql_check_passwd() called.
Jan 7 11:32:22 linux vsftpd[9142]: pam_mysql - pam_mysql_format_string() called
Jan 7 11:32:22 linux vsftpd[9142]: pam_mysql - pam_mysql_quick_escape() called.
Jan 7 11:32:22 linux vsftpd[9142]: pam_mysql - SELECT passwd FROM users WHERE name = 'tom'
Jan 7 11:32:22 linux vsftpd[9142]: pam_mysql - pam_mysql_check_passwd() returning 6.
Jan 7 11:32:22 linux vsftpd[9142]: pam_mysql - pam_mysql_sql_log() called.
Jan 7 11:32:22 linux vsftpd[9142]: pam_mysql - pam_mysql_format_string() called
Jan 7 11:32:22 linux vsftpd[9142]: pam_mysql - pam_mysql_quick_escape() called.
Jan 7 11:32:22 linux last message repeated 3 times
Jan 7 11:32:22 linux vsftpd[9142]: pam_mysql - INSERT INTO logs (msg, user, host, rhost, pid, logtime) VALUES ('AUTHENTICATION FAILURE', 'tom', '127.0.0.1', '127.0.0.1', '9142', NOW())
Jan 7 11:32:22 linux vsftpd[9142]: pam_mysql - pam_mysql_sql_log() returning 0.
Jan 7 11:32:22 linux vsftpd[9142]: pam_mysql - pam_sm_authenticate() returning 7.
Jan 7 11:32:22 linux vsftpd[9142]: pam_mysql - pam_mysql_release_ctx() called.
Jan 7 11:32:22 linux vsftpd[9142]: pam_mysql - pam_mysql_destroy_ctx() called.
Jan 7 11:32:22 linux vsftpd[9142]: pam_mysql - pam_mysql_close_db() called.
 
阅读(2258) | 评论(1) | 转发(0) |
给主人留下些什么吧!~~

chinaunix网友2009-12-07 09:20:50

牛人!!正解!!我也遇到 hos=localhsot 问题,一直在找答案!! 版主 是真正动手做了,比起那些抄别人的或想当然的人,在下佩服!! 顶!顶!