使用Jail构建安全的Vsftpd

powerbsd<Time:9:43am>[/]-root->ifconfigBSD爱好者乐园i~v5YA6sH$S
rl0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500BSD爱好者乐园6Z3yIz.Vf
inet 10.0.1.1 netmask 0xff000000 broadcast 10.255.255.255BSD爱好者乐园*y&kI L;OU`4sk-b&h
ether 00:60:67:76:fb:13
"oT#QYX2W'pmedia: Ethernet autoselect (100baseTX <full-duplex>)
R8Kap0F5btstatus: activeBSD爱好者乐园*| }i7M4U/o:KT
lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> mtu 16384
|[%yxA:Zzinet 127.0.0.1 netmask 0xff000000
w0u"nK bI3{
e!W\powerbsd<Time:9:43am>[/]-root->hostnameBSD爱好者乐园:V-r4r\{Sm2t
powerbsd.org
(T)B,\F!F/IP%rQ/Npowerbsd<Time:9:43am>[/]-root->uname -aBSD爱好者乐园9]7p)kiQIw
FreeBSD powerbsd.org 4.8-STABLE FreeBSD 4.8-STABLE #7: Mon Jun 23 08:57:32 CST 2003 root@powerbsd.org:/usr/src/sys/compile/PowerBSD i386

tar zxvf vsftpd-1.2.0.tar.gz
xT(_v3Mcd vsftpd-1.2.0
2OzwDbm,@make
2n [-B$I8~ xJ(}cp vsftpd /sbinBSD爱好者乐园"yh-G;[}T5h0@/F
cp vsftpd.conf /etc
bYC,S#d%Nmkdir /var/ftpBSD爱好者乐园;i|4?X3B B k4c$M7Z4p
mkdir /usr/share/empty
AP+cMCYpw groupadd ftp
2^[ G^!}y.wpw useradd ftp –d /var/ftp –g ftp –s /nonexistent

powerbsd<Time:9:50am>[/source/src]-root->ftp -a 10.0.1.1BSD爱好者乐园 eJ4?8['V Z
Connected to 10.0.1.1.
(GK2~#S&sm;z220 (vsFTPd 1.2.0)BSD爱好者乐园@.Tv"cpy
331 Please specify the password.BSD爱好者乐园^6BA#`*Q#Z{4@[
230 Login successful.BSD爱好者乐园u
J]!gj9c@K&?
Remote system type is UNIX.
[7M:Oq hQM,aUsing binary mode to transfer files.BSD爱好者乐园XWpZ'ls0aN8R
ftp>

mkdir-p /jail/{bin,sbin,etc,dev,var/log,var/ftp,usr/bin,usr/sbin/,usr/lib,usr/libexec,usr/share/empty}

powerbsd<Time:9:55am>[/jail/etc]-root->ldd /sbin/vsftpdBSD爱好者乐园/PpBF%w9hHV
/sbin/vsftpd:BSD爱好者乐园 a1h/|VM+L3Z |/?6}6x
libpam.so.1 => /usr/lib/libpam.so.1 (0x28076000)BSD爱好者乐园"^%T0vk V+e%H4`
M
libcrypt.so.2 => /usr/lib/libcrypt.so.2 (0x28080000)BSD爱好者乐园t0_ i,F'Z
libutil.so.3 => /usr/lib/libutil.so.3 (0x28099000)BSD爱好者乐园 R8l]5hki i
libc.so.4 => /usr/lib/libc.so.4 (0x280a2000)

cp /usr/lib/libpam.so.1 /jail/usr/lib/BSD爱好者乐园BmM#RZ%t/\ ^r6{h
cp /usr/lib/libcrypt.so.2 /jail/usr/lib/BSD爱好者乐园 l9W~}-Q4O
cp /usr/lib/libutil.so.3 /jail/usr/lib/BSD爱好者乐园 ^8bI cS4DXqX
cp /usr/lib/libc.so.4 /jail/usr/lib/
,F};ym:_(Oucp /dev/MAKEDEV* /jail/dev/
1],GYd)EbKo$oBgsh /jail/dev/MAKEDEV jailBSD爱好者乐园3v~Gm
Z
cp /sbin/vsftpd /jail/sbin/vsftpd
ze6x8|s$Kcp /etc/vsftpd.conf /jail/etc/BSD爱好者乐园4Ol5S2i/n
cp /etc/passwd /jail/etc
7JE \H Phcp /etc/group /jail/etcBSD爱好者乐园:Wi`J MT$KG?]
cp /etc/master.passwd /jail/etcBSD爱好者乐园:?1LD.y'keg
cp /etc/pwd.db /jail/etcBSD爱好者乐园2zHAy |AI
cp /etc/spwd.db /jail/etc

killall vsftpd
4M)j-]6Z.c J+U!K7[5cjail -u root /jail/ powerbsd.org 10.0.1.1 /sbin/vsftpd &

cp /usr/libexec/ld-elf.so.1 /jail/usr/libexec/

jail -u root /jail/ powerbsd.org 10.0.1.1 /sbin/vsftpd

jail -u root /jail/ powerbsd.org 10.0.1.1 /sbin/vsftpd &BSD爱好者乐园t(~ xMf-W
netstat -na

Proto Recv-Q Send-Q Local Address Foreign Address (state)
X)?M w9YNtcp4 0 0 10.0.1.1.21 *.* LISTEN

ps auxww | grep vsftpd
8y9nr \$Y @DO
_qroot 455 0.0 0.2 1132 628 p0 IJ 8:31下午 0:00.01 /sbin/vsftpd(IJ表示是在jail环境中运行)BSD爱好者乐园w!bdpvQ.pb
ftp -a 10.0.1.1 测试通过！

cp /bin/ls /jail/bin
~9~J'D.kz'dcp /bin/mkdir /jail/bin
#h7cPl6KA%G#Dt/Rcp /bin/rmdir /jail/binBSD爱好者乐园5@S6s7yS R
cp /bin/sh /jail/bin
/FG2?K5s k ucp /bin/csh /jail/binBSD爱好者乐园N1} e0KM f*x
cp /usr/sbin/pw /jail/usr/sbin
Y+b B!vqZ-v5vcp /usr/lib/libcrypt.so.2 /jail/usr/lib/BSD爱好者乐园:BZQ:c {
b3H
cp /usr/sbin/pwd_mkdb /jail/usr/sbin/
-pl RP;l)cmu#fcp /usr/sbin/vipw /jail/usr/sbin/
CE4e-d @*vcp /usr/bin/chgrp /jail/usr/bin/
5o,\`-\U1q(j!acp /usr/sbin/chown /jail/usr/sbin/BSD爱好者乐园l x2X _S3P-\
cp /bin/chmod /jail/bin/BSD爱好者乐园#nLkw6Li,Fj-Dd;a
cp adduser.conf /jail/etc/BSD爱好者乐园8R8]p)Ce
cp adduser.message /jail/etc/
*q9?
y&@&Eycp /usr/bin/passwd /jail/usr/bin/BSD爱好者乐园[Nj1K)y4ZB"jj4W
cp /usr/lib/librpcsvc.so.2 /jail/usr/lib/BSD爱好者乐园:L5fT!_-HA
MG5oF
cp /usr/lib/libutil.so.3 /jail/usr/lib/
@/_zuWa`ywRcp /etc/pam.conf /jail/etc
6fJ)ZF rJ0Ms#i!qPscp /usr/lib/pam_skey.so /jail/usr/lib/BSD爱好者乐园s{J2T"Qs/Q
cp /usr/lib/pam_opie.so /jail/usr/lib/BSD爱好者乐园pA} wZ"}.m0y7f8V%b+h
cp /usr/lib/pam_opieaccess.so /jail/usr/lib/BSD爱好者乐园`]9T)t+c
cp /usr/lib/pam_cleartext_pass_ok.so /jail/usr/lib/
5Vy1gp&Acp /usr/lib/pam_unix.so /jail/usr/lib/

jail /jail/ powerbsd.org 10.0.1.1 /bin/sh

powerbsd<Time:10:10am>[/]-root->jail /jail/ powerbsd.org 10.0.1.1 /bin/shBSD爱好者乐园b ]J2z n
# pw user show -a
t`6k\:Dm
vHroot:*:0:0::0:0:Charlie &:/root:/bin/cshBSD爱好者乐园|{oNv3E$O]2[
nobody:*:65534:65534::0:0:Unprivileged user:/nonexistent:/sbin/nologin
8G0b&y2qoJ+?~(KYJ`ftp:*:1004:1002::0:0:User &:/var/ftp:/nonexitent
;eoc"eMm0H#^Ag_# pw group show -a
{U|!^7vl+r5@9Jwheel:*:0:root
LR.H9dw[nobody:*:65534:BSD爱好者乐园&VcJ-NJ(D;T8A}
ftp:*:1002:
w5uW/XI# pw groupadd ftpgroup
jq`$M"w# pw useradd test -d /home/test -g ftpgroup -s /nonexistend
Q P$@DXSdF# pw user show -a
d@*p e)Tm(P0R.d6_root:*:0:0::0:0:Charlie &:/root:/bin/cshBSD爱好者乐园&xEn%nuh.vH
nobody:*:65534:65534::0:0:Unprivileged user:/nonexistent:/sbin/nologinBSD爱好者乐园}ye9~]l2B
ftp:*:1004:1002::0:0:User &:/var/ftp:/nonexitent
*{cX:I3D;\1xMtest:*:1005:1003::0:0:User &:/home/test:/nonexistendBSD爱好者乐园!^\(|IN6BzD$c
# pw group show -aBSD爱好者乐园/n"A3wi5AGdg
wheel:*:0:root
sl)Z{$Sj$Rmnobody:*:65534:BSD爱好者乐园c0FT;W{ E,V$~
ftp:*:1002:
+C~EP@.H d ^MR"}ftpgroup:*:1003:
%z8n y)v?$M# passwd test
SpszF!V8BChanging local password for test.BSD爱好者乐园*fNR$^x0\4Y
New password:
-IZ#o bYG0_Retype new password:BSD爱好者乐园E V\a1F%Frq
passwd: updating the database...
w/K'_:`]4? q2zpasswd: done