ftps:基於ssl的ftp

ssl_enable=YES //啟用vsftpd對ssl的支援的功能

all_anon_ssl=NO //是否啟用匿名使用者使用ssl，一般都是否定

force_local_data_ssl=YES //是否強制本地使用者資料傳輸必須基於ssl

force_local_logins_ssl=YES //是否強制本地使用者登入的時候，帳號密碼也基於ssl

ssl_tlsv1=YES //是否支援tlsv1

ssl_tlsv2=NO //是否支援tlsv2 預設情況下v2和v3都是不支援的

ssl_tlsv3=YES //是否支援ltsv3

rsa_cert_file=/etc/vsftpd/vsftpd.cert

//要想建立ssl會話，必須要有證書，給vsftpd建立一個證書

rsa_private_key_file=/etc/vsftpd/ssl/vsftp.key

建立證書：

1. [[email protected]~]#cd/etc/pki/CA/
3. [[email protected]CA]#(umask077;opensslgenrsa1024>private/cakey.pem)
5. 在建立自簽證書前首先要修改配置檔案
7. [[email protected]CA]#vim../tls/openssl.cnf
9. 修改dir=../../CA為dir=/etc/pki/CA

儲存退出

1. [[email protected]
   CA]#opensslreq-new-x509-days3650-keyprivate/cakey.pem-outcacert.pem//頒發請求
3. Youareabouttobeaskedtoenterinformationthatwillbeincorporated
5. intoyourcertificaterequest.
7. WhatyouareabouttoenteriswhatiscalledaDistinguishedNameoraDN.
9. Therearequiteafewfieldsbutyoucanleavesomeblank
11. Forsomefieldstherewillbeadefaultvalue,
13. Ifyouenter'.'
    ,thefieldwillbeleftblank.
15. -----
17. CountryName(2lettercode)[GB]:CN
19. StateorProvinceName(fullname)[Berkshire]:HA
21. LocalityName(eg,city)[Newbury]:ZZ
23. OrganizationName(eg,company)[MyCompanyLtd]:YANG
25. OrganizationalUnitName(eg,section)[]:Tech
27. CommonName(eg,yournameoryourserver'shostname)[]:ca.yang.com
29. EmailAddress[]:[email protected]

建立目錄：

1. [[email protected]CA]#mkdircrlcertsnewcerts

建立檔案

1. [[email protected]CA]#touchindex.txt
3. [[email protected]CA]#echo01>serial

下面開始為fstpd建立私鑰，建立證書，頒發請求，再由CA簽署就可以了

1. [[email protected]CA]#cd/etc/vsftpd
3. [[email protected]vsftpd]#mkdirssl
5. [[email protected]vsftpd]#cdssl
7. [[email protected]ssl]#(umask077;opensslgenrsa1024>vsftpd.key)
9. [[email protected]ssl]#opensslreq-new-keyvsftpd.key-outvsftpd.csr-days3650
11. Youareabouttobeaskedtoenterinformationthatwillbeincorporated
13. intoyourcertificaterequest.
15. WhatyouareabouttoenteriswhatiscalledaDistinguishedNameoraDN.
17. Therearequiteafewfieldsbutyoucanleavesomeblank
19. Forsomefieldstherewillbeadefaultvalue,
21. Ifyouenter'.',thefieldwillbeleftblank.
23. -----
25. CountryName(2lettercode)[GB]:CN
27. StateorProvinceName(fullname)[Berkshire]:HA
29. LocalityName(eg,city)[Newbury]:ZZ
31. OrganizationName(eg,company)[MyCompanyLtd]:YANG
33. OrganizationalUnitName(eg,section)[]:Tech
35. CommonName(eg,yournameoryourserver'shostname)[]:ftp.yang.com//此處一定要和你的主機名一致
37. EmailAddress[]:[email protected]
41. Pleaseenterthefollowing'extra'attributes
43. tobesentwithyourcertificaterequest
45. Achallengepassword[]:
47. Anoptionalcompanyname[]:

簽署證書

1. [[email protected]ssl]#opensslca-invsftpd.csr-outvsftpd.crt

一直yes就OK了

1. [[email protected]ssl]#ll
3. total24
5. -rw-r--r--1rootroot3180Oct921:49vsftpd.crt
7. -rw-r--r--1rootroot680Oct921:44vsftpd.csr
9. -rw-------1rootroot891Oct921:39vsftpd.key

證書製作完畢

定義證書的配置檔案

1. [[email protected]vsftpd]#vimvsftpd.conf
3. 新增一下內容
5. #ForSSL
7. ssl_enable=YES
9. force_local_data_ssl=YES
11. force_local_logins_ssl=YES
13. ssl_tlsv1=YES
15. ssl_sslv3=YES
17. ssl_sslv2=NO
19. rsa_cert_file=/etc/vsftpd/ssl/vsftpd.crt
21. rsa_private_key_file=/etc/vsftpd/ssl/vsftpd.key

儲存退出

重啟服務，檢視埠，觀察是否正常

1. [[email protected]vsftpd]#servicevsftpdrestart
3. Shuttingdownvsftpd:[OK]
5. Startingvsftpdforvsftpd:[OK]
7. [[email protected]vsftpd]#netstat-tnlp|grep21
9. tcp000.0.0.0:210.0.0.0:*LISTEN10671/vsftpd

效果如下所示，傳輸的報文已經加密成密文

轉載於:https://blog.51cto.com/inspriion/1050017