# W15 (2023/12/19) ## 限制使用者權限 * 此為主資料夾(設定檔), 將 `AllowOverride None` 改成 `AllowOverride All` , 下面可以新增子資料夾 ![image](https://hackmd.io/_uploads/rkV2aiA8T.png) * 新增 web dir ```bash= $ sudo mkdir /var/www/html/test $ sudo echo "aaaaa" > /var/www/html/test/a.txt ``` * 未設定規則的情況下 ![image](https://hackmd.io/_uploads/Hkt7J3RI6.png) * 編輯 /etc/httpd/conf/httpd.conf * 把允許覆寫開啟 * 新增資料夾(規則) ![image](https://hackmd.io/_uploads/Byj_Z2AU6.png) * 重讀/啟 `sudo systemctl reload httpd` `sudo systemctl restart httpd` * 最後結果 ![image](https://hackmd.io/_uploads/B1XMe3CL6.png) ## 驗證使用者 * 資料夾建立 ```bash= $ tree . ├── files │ ├── a.txt │ ├── b.txt │ └── c.txt ``` * 新增使用者 ```bash= $ sudo htpasswd -c .htpasswd user # 第一個才要加上 -c New password: Re-type new password: Adding password for user user $ sudo htpasswd .htpasswd tom New password: Re-type new password: Adding password for user tom ``` * 編輯登入資訊 ```bash= $ sudo vim .htaccess AuthType Basic AuthName "Private File Area" AuthUserFile /var/www/html/files/.htpasswd Require valid-user ``` * 受限制檔案 ```bash= $ tree -a . ├── files │ ├── a.txt │ ├── b.txt │ ├── c.txt │ ├── .htaccess │ └── .htpasswd ``` * 編輯 httpd 設定檔 ```bash= $ sudo vim httpd.conf <Directory /var/www/html/files> Options Indexes AllowOverride AuthConfig # 啟動驗證 </Directory> ``` * 重讀/啟 `sudo systemctl reload httpd` `sudo systemctl restart httpd` * 瀏覽器連線 ![photo_2023-12-19_15-04-44](https://hackmd.io/_uploads/Bk4olTA8T.jpg) * 透過前面建立的帳號密碼登入 ![photo_2023-12-19_15-04-46](https://hackmd.io/_uploads/rynCe6RUT.jpg) ## FTP server * vsftpd * 較舊 * 安全性極差 * 通常在內網用而已 * 能對單一使用者設定流量上限 * port: 20 (control & command) -> 永遠存在、21 (data) -> 只有在上傳下載時才連線 * 三項交握 * 可以用 CLI、GUI * SFTP (相對FTP安全, 基本功能加上加密而已, 功能較少, 除非額外安裝) ### ftp server 端 cmd ![image](https://hackmd.io/_uploads/H1HRVaAIT.png) * 預設檔案位置 * 執行檔 `/usr/sbin/vsftpd` * 設定檔 `/etc/vsftpd` * 主設定檔 `/etc/vsftpd/vsftpd.conf` * FTP站台 根目錄 `/var/ftp` * 安裝 `$ sudo yum install -y vsftpd` * 啟動 ```bash= $ sudo systemctl start vsftpd $ sudo systemctl status vsftpd ● vsftpd.service - Vsftpd ftp daemon Loaded: loaded (/usr/lib/systemd/system/vsftpd.service; disabled; vendor preset: disabled) Active: active (running) since Tue 2023-12-19 15:53:50 CST; 1s ago Process: 10225 ExecStart=/usr/sbin/vsftpd /etc/vsftpd/vsftpd.conf (code=exited, status=0/SUCCESS) Main PID: 10227 (vsftpd) Tasks: 1 CGroup: /system.slice/vsftpd.service └─10227 /usr/sbin/vsftpd /etc/vsftpd/vsftpd.conf Dec 19 15:53:50 centos-vm3 systemd[1]: Starting Vsftpd ftp daemon... Dec 19 15:53:50 centos-vm3 systemd[1]: Started Vsftpd ftp daemon. ``` * port check ```bash= $ sudo netstat -tunlp | grep 21 tcp6 0 0 :::21 :::* LISTEN 10227/vsftpd ``` * 匿名登入測試 ![image](https://hackmd.io/_uploads/ryf9TT0Ip.png) * Local user 登入 (登入的帳號密碼就是 Linux user 的帳號密碼) ![image](https://hackmd.io/_uploads/r1CMC6A8a.png) * CLI 登入 (Windows cmd 登入) ```bash= >ftp 192.168.68.102 已連線到 192.168.68.102。 220 (vsFTPd 3.0.2) 200 Always in UTF8 mode. 使用者 (192.168.68.102:(none)): user 331 Please specify the password. 密碼: 230 Login successful. ftp> ls 200 PORT command successful. Consider using PASV. 150 Here comes the directory listing. Desktop Documents Downloads Music Pictures Public Templates Videos nfs-data 226 Directory send OK. ftp: 88 位元組已接收，時間: 0.00秒數 22.00KB/sec。 ftp> ``` * 目前位置(Windows) ```bash= # server 位置 ftp> pwd 257 "/home/user" # client 位置 ftp> !echo %cd% C:\Users\f1314 ``` * CLI 登入 (Linux 登入) ![image](https://hackmd.io/_uploads/HyUTQCCLa.png) * 目前位置(Linux) ```bash= # server 位置 ftp> pwd 257 "/home/user" # client 位置 ftp> !pwd /home/user ``` ### 測試上傳下載 **promot(互動式) -> 避免每個檔案上傳時都詢問** * 上傳 * Client 資料夾 (要上傳) ```bash= $ tree . ├── test │ ├── a │ ├── b │ ├── c │ ├── d │ ├── e │ └── f ``` ```bash= ftp> bin # 切換2進位 200 Switching to Binary mode. ftp> prompt # 關閉互動式 Interactive mode off. ftp> mput a b c d e f # 多檔案上傳 local: a remote: a 227 Entering Passive Mode (192,168,68,102,51,164). 150 Ok to send data. 226 Transfer complete. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . local: f remote: f 227 Entering Passive Mode (192,168,68,102,72,148). 150 Ok to send data. 226 Transfer complete. ftp> ls # server 檔案確認 227 Entering Passive Mode (192,168,68,102,250,121). 150 Here comes the directory listing. -rw-r--r-- 1 1000 1000 0 Dec 19 08:32 a -rw-r--r-- 1 1000 1000 0 Dec 19 08:32 b -rw-r--r-- 1 1000 1000 0 Dec 19 08:32 c -rw-r--r-- 1 1000 1000 0 Dec 19 08:32 d -rw-r--r-- 1 1000 1000 0 Dec 19 08:32 e -rw-r--r-- 1 1000 1000 0 Dec 19 08:32 f ``` * 下載 * client dir ```bash= $ ls calico.yaml Docker_All_test Downloads Music Pictures Templates Desktop Documents harbor myweb Public Videos ``` ```bash= 226 Directory send OK. ftp> bin 200 Switching to Binary mode. ftp> prompt Interactive mode off. ftp> mget a b c d e f local: a remote: a 227 Entering Passive Mode (192,168,68,102,182,97). 150 Opening BINARY mode data connection for a (0 bytes). 226 Transfer complete. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 226 Transfer complete. local: f remote: f 227 Entering Passive Mode (192,168,68,102,66,27). 150 Opening BINARY mode data connection for f (0 bytes). 226 Transfer complete. ftp> !ls a calico.yaml Docker_All_test e Music Public b d Documents f myweb Templates c Desktop Downloads harbor Pictures Videos ``` * local_umask ![image](https://hackmd.io/_uploads/By11u11Da.png) * 上傳的檔案會有 "x" 權限 * 最大權限為 666 ( rw-rw-rw- ) * server 端 ```bash= $ ls -l total 0 -rw-r--r-- 1 user user 0 Dec 19 16:32 a -rw-r--r-- 1 user user 0 Dec 19 16:32 b -rw-r--r-- 1 user user 0 Dec 19 16:32 c -rw-r--r-- 1 user user 0 Dec 19 16:32 d -rw-r--r-- 1 user user 0 Dec 19 16:32 e -rw-r--r-- 1 user user 0 Dec 19 16:32 f ``` * client 端 ```bash= $ ls -l total 236 -rw-rw-r-- 1 user user 0 Dec 19 16:38 a -rw-rw-r-- 1 user user 0 Dec 19 16:38 b -rw-rw-r-- 1 user user 0 Dec 19 16:38 c -rw-rw-r-- 1 user user 0 Dec 19 16:38 d -rw-rw-r-- 1 user user 0 Dec 19 16:38 e -rw-rw-r-- 1 user user 0 Dec 19 16:38 f ``` * 匿名登入設定 **改為 NO 之後無法匿名登入** ![image](https://hackmd.io/_uploads/ryv99JyP6.png) * 限制本機帳號權限 * 未限制情況下, 一般使用者也能輕易抵達重要檔案的位置 ![image](https://hackmd.io/_uploads/SknDiJyPT.png) * 限制權限 **上面那行的註解拿掉** **加上下面那行** ![image](https://hackmd.io/_uploads/SJcHblyPa.png) * 重啟 FTP server `sudo systemctl restart vsftpd` * 測試 ![1702982031122](https://hackmd.io/_uploads/H1k2beyPa.gif)