Linux下FTP服务器应用之FTPS（FTP+SSL）_xjzhujunjie的技术博客_

link之家

链接快照平台

输入网页链接，自动生成快照
标签化管理网页链接

相关文章推荐

刚分手的领结 · c语言调用openssl对内存中的pem私钥 ...· 1 年前 ·

强悍的领结 · Serverless SSR ...· 1 年前 ·

纯真的脸盆 · Python自动打码，DdddOcr通用验证 ...· 1 年前 ·

傲视众生的草稿纸 · postgres float8 ...· 2 年前 ·

©著作权归作者所有：来自51CTO博客作者xjzhujunjie的原创作品，如需转载，请注明出处，否则将追究法律责任
https://blog.51cto.com/xjzhujunjie/811673

FTPS （ FTP+SSL ）

ftps是一种多传输协议，相当于加密版的FTP。当你在FTP服务器上收发文件的时候，你面临两个风险。第一个风险是在上载文件的时候为文件加密。第二个风险是，这些文件在你等待接收方下载的时候将停留在FTP服务器上，这时你如何保证这些文件的安全。你的第二个选择(创建一个支持SSL的FTP服务器)能够让你的主机使用一个FTPS连接上载这些文件。这包括使用一个在FTP协议下面的SSL层加密控制和数据通道。一种替代FTPS的协议是安全文件传输协议(SFTP)。这个协议使用SSH文件传输协议加密从客户机到服务器的FTP连接。

FTPS是在安全套接层使用标准的FTP协议和指令的一种增强型TFP协议，为FTP协议和数据通道增加了SSL安全功能。FTPS也称作“FTP-SSL”和“FTP-over-SSL”。SSL是一个在客户机和具有SSL功能的服务器之间的安全连接中对数据进行加密和解密的协议。

和sftp连接方法类似，在windows中可以使用FileZilla等传输软件来连接FTPS进行上传，下载文件，建立，删除目录等操作,在FileZilla连接时，有显式和隐式TLS/SSL连接之分，连接时也有指纹提示。

安全：ftps ftp+ssl

准备工作：

准备一:关闭防火墙；

准备二：挂载光盘；

准备三：构建本地yum服务器。

FTP+SSL 配置详细过程:

①.安装配置FTP服务器和抓包工具： （ftp：192.168.101.210）

[root@ftp ~]# yum list all |grep vsftpd

[root@ftp ~]# yum install -y vsftpd

[root@ftp ~]# yum list all |grep wireshark

[root@ftp ~]# yum install -y wireshark

[root@ftp ~]# useradd user1

[root@ftp ~]# echo "123" |passwd --stdin user1

[root@ftp ~]# service vsftpd start

Starting vsftpd for vsftpd: [ OK ]

[root@ftp ~]# tshark -ni eth0 -R "tcp.dstport eq 21"

②.配置本地CA证书服务器：

[root@ftp ~]# cd /etc/pki/

[root@ftp pki]# ll

[root@ftp pki]# vim tls/openssl.cnf

45 dir = /etc/pki/CA

88 countryName = optional

89 stateOrProvinceName = optional

90 organizationName = optional

[root@ftp pki]# cd CA/

[root@ftp CA]# mkdir certs newcerts crl

[root@ftp CA]# touch index.txt serial

[root@ftp CA]# echo "01" >serial

[root@ftp CA]# ll

[root@ftp CA]# openssl genrsa 1024 > private/cakey.pem

Generating RSA private key, 1024 bit long modulus

...........++++++

....++++++

e is 65537 (0x10001)

[root@ftp CA]# chmod 600 private/cakey.pem

[root@ftp CA]# ll private/cakey.pem

-rw------- 1 root root 887 Feb 10 23:22 private/cakey.pem

[root@ftp CA]# openssl req -new -x509 -key private/cakey.pem -out cacert.pem -days 3650

You are about to be asked to enter information that will be incorporated

into your certificate request.

What you are about to enter is what is called a Distinguished Name or a DN.

There are quite a few fields but you can leave some blank

For some fields there will be a default value,

If you enter '.', the field will be left blank.

-----

Country Name (2 letter code) [GB]: cn

State or Province Name (full name) [Berkshire]: henan

Locality Name (eg, city) [Newbury]: zhengzhou

Organization Name (eg, company) [My Company Ltd]: junjie

Organizational Unit Name (eg, section) []: soft

Common Name (eg, your name or your server's hostname) []: ca.junjie.com

Email Address []: junjie@junjie.com

[root@ftp CA]#ll

③.为ftp服务器创建证书：

[root@ftp CA]# mkdir /etc/vsftpd/certs

[root@ftp CA]# cd /etc/vsftpd/certs

[root@ftp certs]# openssl genrsa 1024 >vsftpd.key

Generating RSA private key, 1024 bit long modulus

....++++++

...++++++

e is 65537 (0x10001)

[root@ftp certs]# openssl req -new -key vsftpd.key -out vsftpd.csr

You are about to be asked to enter information that will be incorporated

into your certificate request.

What you are about to enter is what is called a Distinguished Name or a DN.

There are quite a few fields but you can leave some blank

For some fields there will be a default value,

If you enter '.', the field will be left blank.

-----

Country Name (2 letter code) [GB]: cn

State or Province Name (full name) [Berkshire]: henan

Locality Name (eg, city) [Newbury]: zhengzhou

Organization Name (eg, company) [My Company Ltd]: junjie

Organizational Unit Name (eg, section) []: ftp

Common Name (eg, your name or your server's hostname) []: ftp.junjie.com

Email Address []: ftp@junjie.com

Please enter the following 'extra' attributes

to be sent with your certificate request

A challenge password []:

An optional company name []:

[root@ftp certs]# openssl ca -in vsftpd.csr -out vsftpd.crt

Using configuration from /etc/pki/tls/openssl.cnf

Check that the request matches the signature

Signature ok

Certificate Details:

Serial Number: 1 (0x1)

Validity

Not Before: Feb 10 15:48:55 2012 GMT

Not After : Feb 9 15:48:55 2013 GMT

Subject:

countryName = cn

stateOrProvinceName = henan

organizationName = junjie

organizationalUnitName = ftp

commonName = ftp.junjie.com

emailAddress = junjie@junjie.com

X509v3 extensions:

X509v3 Basic Constraints:

CA:FALSE

Netscape Comment:

OpenSSL Generated Certificate

X509v3 Subject Key Identifier:

33:C5:01:33:A5:CF:42:9F:24:A9:0D:E9:41:8E:26:C3:1B:7B:18:11

X509v3 Authority Key Identifier:

keyid:50:D1:A8:0A:1F:B7:CD:49:94:69:E3:70:E9:AE:93:73:2C:94:66:AC

Certificate is to be certified until Feb 9 15:48:55 2013 GMT (365 days)

Sign the certificate? [y/n]:y

1 out of 1 certificate requests certified, commit? [y/n]y

Write out database with 1 new entries

Data Base Updated

[root@ftp certs]# ll

[root@ftp certs]# chmod 600 *

[root@ftp certs]# ll

④.使ftp服务应用证书：

[root@ftp certs]# cd /etc/vsftpd/

[root@ftp vsftpd]# vim vsftpd.conf # 增加以下内容

118 rsa_cert_file=/etc/vsftpd/certs/vsftpd.crt

119 rsa_private_key_file=/etc/vsftpd/certs/vsftpd.key

120 force_local_data_ssl=YES

121 force_local_logins_ssl=YES

122 ssl_enable=YES

123 ssl_sslv2=YES

124 ssl_sslv3=YES

125 ssl_tlsv1=YES

[root@ftp vsftpd]# service vsftpd restart

Shutting down vsftpd: [ OK ]

Starting vsftpd for vsftpd: [ OK ]

⑤客户端测试（已加密传输）：

从上面看出证书名称出现问题，但可是可以使用！选择接收一次！

该次登录抓包内容如下所示：传输已经经过加密！

[root@ftp ~]# tshark -ni eth0 -R "tcp.dstport eq 21"

[root@ftp ~]# tshark -ni eth0 -R "tcp.dstport eq 21"

Running as user "root" and group "root". This could be dangerous.

Capturing on eth0

9.742109 192.168.101.113 -> 192.168.101.210 TCP 52572 > 21 [SYN] Seq=0 Win=8192 Len=0 MSS=1460 WS=2

9.742144 192.168.101.113 -> 192.168.101.210 TCP 52572 > 21 [ACK] Seq=1 Ack=1 Win=65700 Len=0

9.747458 192.168.101.113 -> 192.168.101.210 FTP Request: AUTH SSL

9.755605 192.168.101.113 -> 192.168.101.210 FTP Request: \200\310\001\003\001\000\237\000\000\000 \000\300\024\000\300

9.758795 192.168.101.113 -> 192.168.101.210 FTP Request: \026\003\001\000\206\020\000\000\202\000\200n\257\315\204\324o

9.778662 192.168.101.113 -> 192.168.101.210 FTP Request: \027\003\001\000\030\215\325t\357\277\001\376FZ\243D\373\003\367\231\207Q\324\003Q}/\335\025\027\003\001\000 \f\355b\270\355\325\020[\372\302s{^\375\307\364C\307\243\251v9\370\364\260\277\253\317\321gB]

9.779885 192.168.101.113 -> 192.168.101.210 FTP Request: \027\003\001\000\030\324\000\267\312\0320\213\266y\311\025[\371\275?\254Y\257\024[\245vjM\027\003\001\000(\236\321\221Z\321Z(\316'\343.\235?\321=8\264b\270(j\336\231\\210\265\207K\223A\037"\277\251\252t\252a`\374

9.782153 192.168.101.113 -> 192.168.101.210 FTP Request: \027\003\001\000\030\257d\313mXZT\356\2366\334q\223\017gt\371\232\207\226\325

9.793165 192.168.101.113 -> 192.168.101.210 FTP Request: \027\003\001\000\0301\020S\237\372\210\004N4\370\366\377\2213m\356\233w:\275)>@%\027\003\001\000 Y\032\275BM=3J\313\240\241\372Z\371@\335\262\252\240\235\021\345\271\305\223\211\020\340\332\323Q\251

9.795630 192.168.101.113 -> 192.168.101.210 FTP Request: \027\003\001\000\030\302\016=LR\272\030{\034\277V\256]\230\247\363\355M\241\327U\207k\032\027\003\001\000 OYi\216=S\322\212)\271V\016\2519w\332f\213\222S\244\275M\316\025N\302:k\312b\331

9.796727 192.168.101.113 -> 192.168.101.210 TCP 52572 > 21 [ACK] Seq=741 Ack=1260 Win=64440 Len=0

9.797542 192.168.101.113 -> 192.168.101.210 TCP 52572 > 21 [ACK] Seq=741 Ack=1334 Win=64364 Len=0

9.798327 192.168.101.113 -> 192.168.101.210 TCP 52572 > 21 [ACK] Seq=741 Ack=1408 Win=64292 Len=0

9.798775 192.168.101.113 -> 192.168.101.210 TCP 52572 > 21 [ACK] Seq=741 Ack=1482 Win=65700 Len=0

9.799387 192.168.101.113 -> 192.168.101.210 TCP 52572 > 21 [ACK] Seq=741 Ack=1564 Win=65616 Len=0

9.799910 192.168.101.113 -> 192.168.101.210 TCP 52572 > 21 [ACK] Seq=741 Ack=1638 Win=65544 Len=0

9.805078 192.168.101.113 -> 192.168.101.210 FTP Request: \027\003\001\000\030G}\305\210\021s\244q\023k=\345R\232A\366B\360\202\320\361(x\344\027\003\001\000 \351W\350\377\362\2756\334\303\035+1l|{\304\277\224\326n\036d\213\217\b\216\023N\225\003a\274

9.810763 192.168.101.113 -> 192.168.101.210 FTP Request: \027\003\001\000\030\203\354F\302\253\205\212\355\334$\321=\303h\276\302\350\320.\346\223\337BG\027\003\001\000 73\027\372#\232

9.813350 192.168.101.113 -> 192.168.101.210 FTP Request: \027\003\001\000\030\203x`k\337RM\341w\022N\255|f\260U ?\354)A\301^\251\027\003\001\000 \031`\366\364He\030\266z)\373\265\237\261\\3430\220\331\340Kv[\033\347\tXj\344\314\236\242

9.814073 192.168.101.113 -> 192.168.101.210 FTP Request: \027\003\001\000\030\307\2126sY\a\237\034\321\277!j\320\213\235\032\277e\345\361E>|)\027\003\001\000 \256\304}:-\365\034\aD~\fk`]\\314\b\207\365-\217\305\244

9.838659 192.168.101.113 -> 192.168.101.210 FTP Request: \027\003\001\000\030\300\272t&\t(\262\243\361\210\263\343\326\261\017$\317V\002\354\325\271\250\366\027\003\001\000 \350F\305\360\363\365\033\274W\207M\006\216\255\016\365\205z\033\002\032B\345,\3712\034\377\327[\272P

9.851675 192.168.101.113 -> 192.168.101.210 TCP 52572 > 21 [ACK] Seq=1071 Ack=2041 Win=65140 Len=0

9.856073 192.168.101.113 -> 192.168.101.210 FTP Request: \027\003\001\000\030\f\357\000E/\372\333\247\016\344\315\345\346\271L\327\214CE0*i\316\332\027\003\001\000(8\220\341\316.*\234dM\235

10.061779 192.168.101.113 -> 192.168.101.210 TCP 52572 > 21 [ACK] Seq=1145 Ack=2094 Win=65088 Len=0

39.978110 192.168.101.113 -> 192.168.101.210 FTP Request: \027\003\001\000\030=\032\322\022\216B\025O\016\034

39.980672 192.168.101.113 -> 192.168.101.210 TCP 52572 > 21 [FIN, ACK] Seq=1211 Ack=2139 Win=65040 Len=0

39.980725 192.168.101.113 -> 192.168.101.210 TCP 52572 > 21 [RST, ACK] Seq=1212 Ack=2149 Win=0 Len=0

27 packets captured

[root@ftp ~]#

ftps （ ftp+ssl ）

FTPS （ FTP+SSL ）

FTPS （ FTP+SSL ）

Linux 下 ftp+ssl 实现 ftps

Linux 下 ftp+ssl 实现 ftps

ftp+ssl

FTP+SSL (加密的 ftp )

ftp+ssl (证书）

ftps = ssl + ftp 实现

ftp+ssl 证书安全认证

linux ftps ftp -over- ssl 配置实验

ftp + ftps

linux 下 ftp 和 ftps 以及 ftp 基于mysql虚拟用户认证服务器的搭建

ftps --实现安全登录 ftp 服务器

linux 下构建 ftp 服务器

LINUX 下搭建 FTP 服务器

LINUX 下 FTP 服务器架构

linux 下建立 FTP 服务器

linux 下 FTP 服务器搭建