Proftpd 지시자설정 10_29 페이지 년 10 월 29 일목요일 오후 2:08

Transcription

1 Proftpd 지시자설정 2009 년 10 월 29 일목요일 오후 2:08 루트로접속막기 sbin]# cd /usr/local/ftp/etc/ etc]# vi proftpd.conf IP 대역접속제한 Order 는앞에서부터적용 (apache 와반대 ) 유저제한 디렉토리접근제한 젂송파일사이즈제한 버젂정보숨기기 10_29 페이지 1

2 Ftp 접속젂경고메시지출력 접속후메시지출력 Ftp 로그설정 등등책참조 (p291~) 문법설정확인 sbin]#./proftpd -td5 메시지파일생성 sbin]# cd /etc/ etc]# vi warning.txt etc]# vi welcome.msg 로그파일생성 etc]# touch /var/log/ftp.log etc]# chown ftpuser.ftpuser /var/log/ftp.log etc]# chmod 600 /var/log/ftp.log etc]# ln -s /usr/local/ftp/sbin/proftpd /usr/sbin/ 10_29 페이지 2

3 etc]# proftpd --help usage: proftpd [options] -h, --help Display proftpd usage -N, --nocollision Disable address/port collision checking -n, --nodaemon Disable background daemon mode (and send all output to stderr) -q, --quiet Don't send output to stderr when running with -n or --nodaemon -d [level], --debug Set debugging level (0-10, 10 = most debugging) -D [definition], --define Set arbitrary IfDefine definition -c [config-file], --config Specify alternate configuration file -p [0 1], --persistent Enable/disable default persistent passwd support -l, --list List all compiled-in modules -t, --configtest Test the syntax of the specified config -V, --settings Print compile-time settings and exit -v, --version Print version number and exit -vv, --version-status 실행가능 Print extended version information and exit -4, --ipv4 Support IPv4 connections only -6, --ipv6 Support IPv6 connections [root@ruffy&15:18& etc]# proftpd -vv ProFTPD Version: 1.3.2b (maint) Scoreboard Version: Built: Thu Oct 29 13:31:44 KST 2009 Loaded modules: mod_cap/1.0 mod_tls/2.2.1 mod_auth_pam/1.1 mod_ident/1.0 mod_facts/0.1 mod_delay/0.6 mod_site.c 10_29 페이지 3

4 mod_log.c mod_ls.c mod_auth.c mod_auth_file/0.8.3 mod_auth_unix.c mod_xfer.c mod_core.c /usr/local/ftp/etc/proftpd.conf 의 DenyAll 주석처리후실행 etc]# proftpd & [3] [3]+ Done proftpd etc]# ps -ef grep pro ftpuser :32? 00:00:00 proftpd: ( accepting connections) [root@ruffy&15:32& etc]# ftp localhost Connected to ruffy.eun.iss. 220-################################## # S E C U R E F T P D # ################################# FTP server ready KERBEROS_V4 rejected as an authentication type Name (localhost:root): root 331 Password required for root Password: 530 Login incorrect. Login failed. root는막아놔서로그인불가 Remote system type is UNIX. Using binary mode to transfer files. ftp> quit [root@ruffy&15:39& etc]# cat /var/log/ftp.log ruffy.eun.iss UNKNOWN ftpuser [29/Oct/2009:15:35: ] "USER usera" ruffy.eun.iss UNKNOWN usera [29/Oct/2009:06:35: ] "PASS (hidden)" ruffy.eun.iss UNKNOWN ftpuser [29/Oct/2009:15:36: ] "USER root" ruffy.eun.iss UNKNOWN ftpuser [29/Oct/2009:15:36: ] "PASS (hidden)" ruffy.eun.iss UNKNOWN ftpuser [29/Oct/2009:15:39: ] "USER root" ruffy.eun.iss UNKNOWN ftpuser [29/Oct/2009:15:39: ] "PASS (hidden)" SSL/TLS 패치서버에대해서암호로보호된 RSA 비밀키를생성후인증서요청 (CSR) 을생성하고, CA를사용하여자체적으로사인 (self sign) 하는단계. [root@ruffy&15:39& etc]# cd /usr/local/ftp/ 10_29 페이지 4

5 ftp]# mkdir pki ftp]# ls bin etc include lib libexec pki sbin share var ftp]# cd pki pki]# openssl req -new > proftp.csr Generating a 1024 bit RSA private key writing new private key to 'privkey.pem' Enter PEM pass phrase: 패스워드지정 Verifying - Enter PEM pass phrase: You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank Country Name (2 letter code) [GB]:KR State or Province Name (full name) [Berkshire]: SEOUL Locality Name (eg, city) [Newbury]:SEOUL Organization Name (eg, company) [My Company Ltd]: ITHRD Organizational Unit Name (eg, section) []:Security Common Name (eg, your name or your server's hostname) []: ftp.eun.iss 반드시정확한호스트네임 Address []:usera@eun.iss 관리자이메일 Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []: An optional company name []: [root@ruffy&15:42& pki]# ls privkey.pem proftp.csr [root@ruffy&15:42& pki]# openssl rsa -in privkey.pem -out proftp.cert.key Enter pass phrase for privkey.pem: writing RSA key [root@ruffy&15:44& pki]# ls privkey.pem proftp.cert.key proftp.csr [root@ruffy&15:44& pki]# openssl x509 -in proftp.csr -out proftp.crt -req -signkey proftp.cert.key - days 365 Signature ok subject=/c=kr/st=seoul/l=seoul/o=ithrd/ou=security/cn=ftp.eun.iss/ address=usera@eun.iss Getting Private key [root@ruffy&15:47& pki]# ls privkey.pem proftp.cert.key proftp.crt proftp.csr 서버인증서생성. 10_29 페이지 5

6 pki]# pwd /usr/local/ftp/pki pki]# cd../etc/ etc]# vi proftpd.conf 마지막에추가 etc]# pkill -9 proftp etc]# ps -ef grep proftp etc]# proftpd & [3] [3]+ Done proftpd etc]# ps -ef grep proftp ftpuser :55? 00:00:00 proftpd: (accepting connections) [root@ruffy&15:55& etc]# ftp localhost Connected to ruffy.eun.iss. 220-################################## # S E C U R E F T P D # ################################# FTP server ready KERBEROS_V4 rejected as an authentication type Name (localhost:root): usera 550 SSL/TLS required on the control channel Login failed. SSL 호환클라이언트가아닌경우접속종료. Remote system type is UNIX. Using binary mode to transfer files. ftp> 10_29 페이지 6