1、实现基于MysqL验证的vsftpd虚拟用户访问
首先环境说明，数据库服务器是192.168.0.10，vsftpd服务器是192.168.0.30
1）安装vsftpd
[root@test-centos7-node3 ~]# [root@test-centos7-node3 ~]# ip a s ens332: ens33: <broADCAST,MulTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000 link/ether 00:0c:29:4a:bd:74 brd ff:ff:ff:ff:ff:ff inet 192.168.0.30/24 brd 192.168.0.255 scope global ens33 valID_lft forever preferred_lft forever inet6 fe80::20c:29ff:fe4a:bd74/64 scope link valID_lft forever preferred_lft forever[root@test-centos7-node3 ~]# yum install -y vsftpdLoaded plugins: fastestmirrorbase | 3.6 kB 00:00:00 epel | 5.3 kB 00:00:00 extras | 2.9 kB 00:00:00 updates | 2.9 kB 00:00:00 Loading mirror speeds from cached hostfile * base: mirrors.aliyun.com * extras: mirrors.aliyun.com * updates: mirrors.aliyun.comResolving DependencIEs--> Running transaction check---> Package vsftpd.x86_64 0:3.0.2-25.el7 will be installed--> Finished Dependency ResolutionDependencIEs Resolved================================================================================================= Package Arch Version Repository Size=================================================================================================Installing: vsftpd x86_64 3.0.2-25.el7 base 171 kTransaction Summary=================================================================================================Install 1 PackageTotal download size: 171 kInstalled size: 353 kDownloading packages:vsftpd-3.0.2-25.el7.x86_64.rpm | 171 kB 00:00:00 Running transaction checkRunning transaction testTransaction test succeededRunning transaction Installing : vsftpd-3.0.2-25.el7.x86_64 1/1 Verifying : vsftpd-3.0.2-25.el7.x86_64 1/1 Installed: vsftpd.x86_64 0:3.0.2-25.el7 Complete![root@test-centos7-node3 ~]#
2)编译安装pam-MysqL
2.1、安装编译环境依赖包
[root@test-centos7-node3 ~]# yum groupinstall -y "development tools"Loaded plugins: fastestmirrorLoading mirror speeds from cached hostfile * base: mirrors.aliyun.com * extras: mirrors.aliyun.com * updates: mirrors.aliyun.comMaybe run: yum groups mark install (see man yum)No packages in any requested group available to install or update[root@test-centos7-node3 ~]# yum -y install mariadb-devel pam-devel Loaded plugins: fastestmirrorLoading mirror speeds from cached hostfile * base: mirrors.aliyun.com * extras: mirrors.aliyun.com * updates: mirrors.aliyun.comPackage 1:mariadb-devel-5.5.64-1.el7.x86_64 already installed and latest versionPackage pam-devel-1.1.8-22.el7.x86_64 already installed and latest versionnothing to do[root@test-centos7-node3 ~]#
说明：以上提示我们需要的包组和包都已经安装好了
2.2、上传pam_MysqL-0.7RC1.tar.gz，解压、编译安装
[root@test-centos7-node3 ~]# rzrz waiting to receive. zmodem trl+C ȡ 100% 326 KB 326 KB/s 00:00:01 0 Errorsgz...[root@test-centos7-node3 ~]# lspam_MysqL-0.7pre3.tar.gz[root@test-centos7-node3 ~]# tar xf pam_MysqL-0.7pre3.tar.gz [root@test-centos7-node3 ~]# lspam_MysqL-0.7pre3 pam_MysqL-0.7pre3.tar.gz[root@test-centos7-node3 ~]# cd pam_MysqL-0.7pre3[root@test-centos7-node3 pam_MysqL-0.7pre3]# ./configure --with-pam-mods-dir=/lib64/security checking for a BSD-compatible install... /usr/bin/install -cchecking whether build environment is sane... yeschecking whether make sets $(MAKE)... yeschecking for working aclocal-1.4... missingchecking for working autoconf... found……省略部分内容checking for crypt... yesconfigure: creating ./config.statusconfig.status: creating Makefileconfig.status: creating pam_MysqL.specconfig.status: creating config.hconfig.status: executing default-1 commands[root@test-centos7-node3 pam_MysqL-0.7pre3]#
提示：如果预编译的环境检查没有ERROR的错误出现，接下来我们就可以编译和安装了。预编译选项 就只需要指定模块的存放位置即可，pam相关的模块存放路径都是lib64/security目录下，我们指定其存放位置即可
2.3、编译、安装pam-MysqL
[root@test-centos7-node3 pam_MysqL-0.7pre3]# make -j 4 && make install
提示：-j表示指定几个进程来同时编译，如果不指定默认是1个进程
[root@test-centos7-node3 pam_MysqL-0.7pre3]# make -j 4 && make install/bin/sh ./libtool --mode=compile gcc -DHAVE_CONfig_H -I. -I. -I. -I/usr/include/security -I/usr/include -g -O2 -I/usr/include/MysqL -c pam_MysqL.cmkdir .libs gcc -DHAVE_CONfig_H -I. -I. -I. -I/usr/include/security -I/usr/include -g -O2 -I/usr/include/MysqL -c pam_MysqL.c -fPIC -DPIC -o .libs/pam_MysqL.opam_MysqL.c: In function 'pam_MysqL_converse':pam_MysqL.c:3179:4: warning: passing argument 2 of 'conv->conv' from incompatible pointer type [enabled by default] conv->appdata_ptr))) { ^pam_MysqL.c:3179:4: note: expected 'const struct pam_message **' but argument is of type 'struct pam_message **'/bin/sh ./libtool --mode=link gcc -g -O2 -I/usr/include/MysqL -o pam_MysqL.la -rpath /lib64/security -module -avoID-version pam_MysqL.lo -L/usr/lib64/MysqL -lMysqLclIEnt -lpthread -lz -lm -ldl -lssl -lcrypto -lcryptgcc -shared .libs/pam_MysqL.o -L/usr/lib64/MysqL -lMysqLclIEnt -lpthread -lz -lm -ldl -lssl -lcrypto -lcrypt -Wl,-soname -Wl,pam_MysqL.so -o .libs/pam_MysqL.socreating pam_MysqL.la(cd .libs && rm -f pam_MysqL.la && ln -s ../pam_MysqL.la pam_MysqL.la)make[1]: Entering directory `/root/pam_MysqL-0.7pre3'/bin/sh ./mkinstalldirs /lib64/security/bin/sh ./libtool --mode=install /usr/bin/install -c pam_MysqL.la /lib64/security/pam_MysqL.la/usr/bin/install -c .libs/pam_MysqL.so /lib64/security/pam_MysqL.so/usr/bin/install -c .libs/pam_MysqL.lai /lib64/security/pam_MysqL.laPATH="$PATH:/sbin" ldconfig -n /lib64/security----------------------------------------------------------------------librarIEs have been installed in: /lib64/securityIf you ever happen to want to link against installed librarIEsin a given directory,liBDIR,you must either use libtool,andspecify the full pathname of the library,or use the `-LliBDIR'flag during linking and do at least one of the following: - add liBDIR to the `LD_liBRARY_PATH' environment variable during execution - add liBDIR to the `LD_RUN_PATH' environment variable during linking - use the `-Wl,--rpath -Wl,liBDIR' linker flag - have your system administrator add liBDIR to `/etc/ld.so.conf'See any operating system documentation about shared librarIEs formore information,such as the ld(1) and ld.so(8) manual pages.----------------------------------------------------------------------make[1]: nothing to be done for `install-data-am'.make[1]: Leaving directory `/root/pam_MysqL-0.7pre3'[root@test-centos7-node3 pam_MysqL-0.7pre3]# 提示：当然这个编译速度很快，我们可以去对应的目录看看是不是我们需要的模块已经安装对应的目录了
[root@test-centos7-node3 pam_MysqL-0.7pre3]# ll /lib64/security/ |grep pam_MysqL-rwxr-xr-x 1 root root 882 Feb 16 02:57 pam_MysqL.la-rwxr-xr-x 1 root root 140904 Feb 16 02:57 pam_MysqL.so[root@test-centos7-node3 pam_MysqL-0.7pre3]#
到此，vsftpd基于MysqL认证的模块已经完成了安装，接下来我们需要配置vsftpd，让其认证基于MysqL来认证
3）配置vsftpd，让其认证是基于MysqL来做认证
创建vsftpd调用pam_MysqL的配置文件
[root@test-centos7-node3 ~]# cat /etc/pam.d/vsftpd.MysqLauth required pam_MysqL.so user=vsftpd passwd=admin123.com host=192.168.0.10 db=vsftpd table=users usercolumn=name passwdcolumn=password crypt=2account required pam_MysqL.so user=vsftpd passwd=admin123.com host=192.168.0.10 db=vsftpd table=users usercolumn=name passwdcolumn=password crypt=2[root@test-centos7-node3 ~]#
提示：有关pam_MysqL的用法我们可以在源码包里看README文件
修改vsftpd配置文件，指定pam的配置文件为vsftpd.MysqL
[root@test-centos7-node3 ~]# grep pam /etc/vsftpd/vsftpd.confpam_service_name=vsftpd.MysqL[root@test-centos7-node3 ~]#
在linux系统创建一个用于登录FTP系统映射的一个系统账号，比如vuser
[root@test-centos7-node3 ~]# getent passwd vuser[root@test-centos7-node3 ~]# useradd -s /sbin/nologin -d /var/ftproot/ vuser[root@test-centos7-node3 ~]# chmod 555 /var/ftproot/[root@test-centos7-node3 ~]# ll -d /var/ftproot/dr-xr-xr-x 2 vuser vuser 62 Feb 16 04:40 /var/ftproot/[root@test-centos7-node3 ~]# mkdir /var/ftproot/{upload,pub}[root@test-centos7-node3 ~]# setfacl -m u:vuser:rwx /var/ftproot/upload [root@test-centos7-node3 ~]# getfacl /var/ftproot/uploadgetfacl: Removing leading '/' from absolute path names# file: var/ftproot/upload# owner: root# group: rootuser::rwxuser:vuser:rwxgroup::r-xmask::rwxother::r-x[root@test-centos7-node3 ~]# 提示：ftp对登录的根目录是登录被映射成的那个用户的家目录，被映射的用户是不能对其有写的权限的，其他目录无所谓，有写权限表示可以上传文件，没有写权限表示不能上传文件
在/etc/vsftpd/vsftpd.conf中指定开启guest用户，并指定其映射成vuser
[root@test-centos7-node3 ~]# grep guest /etc/vsftpd/vsftpd.confguest_enable=YESguest_username=vuser[root@test-centos7-node3 ~]#
提示：到此vsftpd就配置好了，接下来准备数据库和表
[root@test-centos7-node1 ~]# ip a s ens332: ens33: <broADCAST,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000 link/ether 00:0c:29:f2:82:0c brd ff:ff:ff:ff:ff:ff inet 192.168.0.10/24 brd 192.168.0.255 scope global ens33 valID_lft forever preferred_lft forever inet6 fe80::20c:29ff:fef2:820c/64 scope link valID_lft forever preferred_lft forever[root@test-centos7-node1 ~]# MysqLWelcome to the MariaDB monitor. Commands end with ; or \g.Your MariaDB connection ID is 5Server version: 5.5.56-MariaDB MariaDB Servercopyright (c) 2000,2017,Oracle,MariaDB Corporation Ab and others.Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.MariaDB [(none)]> show databases;+--------------------+| Database |+--------------------+| information_schema || Syslog || MysqL || performance_schema || test || wordpress |+--------------------+6 rows in set (0.00 sec)MariaDB [(none)]> create database vsftpd;query OK,1 row affected (0.00 sec)MariaDB [(none)]> use vsftpdDatabase changedMariaDB [vsftpd]> create table users( -> ID int auto_increment not null primary key,-> name char(50) binary not null,-> password char(48) binary not null);query OK,0 rows affected (0.01 sec)MariaDB [vsftpd]> desc users;+----------+----------+------+-----+---------+----------------+| FIEld | Type | Null | Key | Default | Extra |+----------+----------+------+-----+---------+----------------+| ID | int(11) | NO | PRI | NulL | auto_increment || name | char(50) | NO | | NulL | || password | char(48) | NO | | NulL | |+----------+----------+------+-----+---------+----------------+3 rows in set (0.02 sec)MariaDB [vsftpd]>
提示：这个数据库名称和表的名称参照上面的vsftpd.MysqL里面指定的名称来
创建用于vsftpd连接MysqL的账号,这个账号也是参照vsftpd.MysqL的配置文件里指定的来创建
MariaDB [vsftpd]> grant all on vsftpd.* to vsftpd@'192.168.0.%' IDentifIEd by 'admin123.com';query OK,0 rows affected (0.00 sec)MariaDB [vsftpd]>
在数据库服务器上添加虚拟账号
MariaDB [vsftpd]> desc users;+----------+----------+------+-----+---------+----------------+| FIEld | Type | Null | Key | Default | Extra |+----------+----------+------+-----+---------+----------------+| ID | int(11) | NO | PRI | NulL | auto_increment || name | char(50) | NO | | NulL | || password | char(48) | NO | | NulL | |+----------+----------+------+-----+---------+----------------+3 rows in set (0.00 sec)MariaDB [vsftpd]> insert users(name,password) values('tom',password('tompass')),('jerry',password('jerrypass'));query OK,2 rows affected (0.01 sec)Records: 2 Duplicates: 0 Warnings: 0MariaDB [vsftpd]> select * from users;+----+-------+-------------------------------------------+| ID | name | password |+----+-------+-------------------------------------------+| 1 | tom | *25C2DC5924C8A153CFC4075267C2C1438B48A509 || 2 | jerry | *D38B663230A8D7BD6F2B1C5A6E262431CE5D9293 |+----+-------+-------------------------------------------+2 rows in set (0.00 sec)MariaDB [vsftpd]> 提示：到此我们在数据库里把虚拟账号给建立起来了，接下来我们启动vsftpd，然后用建立好的两个虚拟账号登录ftp系统
[root@test-centos7-node3 ~]# ftp 192.168.0.30Connected to 192.168.0.30 (192.168.0.30).220 (vsFTPd 3.0.2)name (192.168.0.30:root): tom331 Please specify the password.Password:230 Login successful.Remote system type is UNIX.Using binary mode to transfer files.ftp> ls227 Entering Passive Mode (192,168,30,53,71).150 Here comes the directory Listing.drwxr-xr-x 2 0 0 6 Feb 16 09:41 pubdrwxrwxr-x 2 0 0 6 Feb 16 09:41 upload226 Directory send OK.ftp> pwd257 "/"ftp> bye221 Goodbye.[root@test-centos7-node3 ~]# ftp 192.168.0.30Connected to 192.168.0.30 (192.168.0.30).220 (vsFTPd 3.0.2)name (192.168.0.30:root): jerry331 Please specify the password.Password:230 Login successful.Remote system type is UNIX.Using binary mode to transfer files.ftp> ls227 Entering Passive Mode (192,94,10).150 Here comes the directory Listing.drwxr-xr-x 2 0 0 6 Feb 16 09:41 pubdrwxrwxr-x 2 0 0 6 Feb 16 09:41 upload226 Directory send OK.ftp> bye221 Goodbye.[root@test-centos7-node3 ~]#
提示：可看到我们在数据库里添加的用户是可以登录到ftp系统的
以上两个用户都是拥有一样的权限，不能下载（默认是可以下载所有权限位有r的文件），不能上传文件，我们给tom添加上传权限，对jerry不做权限修改。
在/etc/vsftpd/vsftpd.conf文件中user_config_dir=/etc/vsftpd/vuser_conf/,然后创建对应的目录，在其目录里面新建一个和用户名一模一样的文件，然后在新建的文件里面写对应的权限
[root@test-centos7-node3 ~]# grep user_config_dir /etc/vsftpd/vsftpd.confuser_config_dir=/etc/vsftpd/vuser_config/[root@test-centos7-node3 ~]# mkdir /etc/vsftpd/vuser_config[root@test-centos7-node3 ~]# cd /etc/vsftpd/vuser_config[root@test-centos7-node3 vuser_config]# touch tom[root@test-centos7-node3 vuser_config]# cat > tomanon_upload_enable=YES anon_mkdir_write_enable=YESanon_world_readable_only=NO ^C[root@test-centos7-node3 vuser_config]# cat tom anon_upload_enable=YESanon_mkdir_write_enable=YESanon_world_readable_only=NO[root@test-centos7-node3 vuser_config]#
提示：以上表示给tom用户授权可以上传下载文件，新建目录等，这个前提是对应的映射到用户要对其文件系统有写权限
重启vsftpd，然后验证tom和jerry的权限
[root@test-centos7-node3 ~]# ftp 192.168.0.30Connected to 192.168.0.30 (192.168.0.30).220 (vsFTPd 3.0.2)name (192.168.0.30:root): tom331 Please specify the password.Password:230 Login successful.Remote system type is UNIX.Using binary mode to transfer files.ftp> ls227 Entering Passive Mode (192,49,80).150 Here comes the directory Listing.drwxr-xr-x 2 0 0 6 Feb 16 09:41 pubdrwxrwxr-x 2 0 0 6 Feb 16 10:02 upload226 Directory send OK.ftp> cd upload250 Directory successfully changed.ftp> ls227 Entering Passive Mode (192,240,251).150 Here comes the directory Listing.226 Directory send OK.ftp> mkdir aa257 "/upload/aa" createdftp> ls227 Entering Passive Mode (192,91,141).150 Here comes the directory Listing.drwx------ 2 1000 1000 6 Feb 16 10:03 aa226 Directory send OK.ftp> put pam_MysqL-0.7pre3.tar.gz local: pam_MysqL-0.7pre3.tar.gz remote: pam_MysqL-0.7pre3.tar.gz227 Entering Passive Mode (192,185,200).150 Ok to send data.226 Transfer complete.333992 bytes sent in 0.000498 secs (670666.62 Kbytes/sec)ftp> ls227 Entering Passive Mode (192,142,95).150 Here comes the directory Listing.drwx------ 2 1000 1000 6 Feb 16 10:03 aa-rw------- 1 1000 1000 333992 Feb 16 10:04 pam_MysqL-0.7pre3.tar.gz226 Directory send OK.ftp> bye221 Goodbye.[root@test-centos7-node3 ~]# ftp 192.168.0.30[root@test-centos7-node3 ~]# ftp 192.168.0.30Connected to 192.168.0.30 (192.168.0.30).220 (vsFTPd 3.0.2)name (192.168.0.30:root): jerry331 Please specify the password.Password:230 Login successful.Remote system type is UNIX.Using binary mode to transfer files.ftp> ls227 Entering Passive Mode (192,110).150 Here comes the directory Listing.drwxr-xr-x 2 0 0 6 Feb 16 09:41 pubdrwxrwxr-x 3 0 0 48 Feb 16 10:04 upload226 Directory send OK.ftp> cd upload250 Directory successfully changed.ftp> ls227 Entering Passive Mode (192,160,189).150 Here comes the directory Listing.drwx------ 2 1000 1000 6 Feb 16 10:03 aa-rw------- 1 1000 1000 333992 Feb 16 10:04 pam_MysqL-0.7pre3.tar.gz226 Directory send OK.ftp> mkdir bb550 Permission denIEd.ftp> put pam_MysqL-0.7pre3.tar.gz local: pam_MysqL-0.7pre3.tar.gz remote: pam_MysqL-0.7pre3.tar.gz227 Entering Passive Mode (192,177,120).550 Permission denIEd.ftp> bye221 Goodbye.[root@test-centos7-node3 ~]#
提示：以上测试说明，我们可以对不同的用户单独授权。有关ftp的其他配置请参考本人博客https://www.cnblogs.com/qiuhom-1874/p/12106900.html
2、通过NFS实现服务器/www共享访问。
实验环境，NFS服务器192.168.0.30，客户机192.168.0.10
在192.168.0.30安装nfs-utils
[root@test-centos7-node3 ~]# ip a s ens33 2: ens33: <broADCAST,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000 link/ether 00:0c:29:4a:bd:74 brd ff:ff:ff:ff:ff:ff inet 192.168.0.30/24 brd 192.168.0.255 scope global ens33 valID_lft forever preferred_lft forever inet6 fe80::20c:29ff:fe4a:bd74/64 scope link valID_lft forever preferred_lft forever[root@test-centos7-node3 ~]# yum install nfs-utils -yLoaded plugins: fastestmirrorLoading mirror speeds from cached hostfile * base: mirrors.aliyun.com * extras: mirrors.aliyun.com * updates: mirrors.aliyun.comResolving DependencIEs--> Running transaction check---> Package nfs-utils.x86_64 1:1.3.0-0.65.el7 will be installed--> Processing Dependency: libtirpc >= 0.2.4-0.7 for package: 1:nfs-utils-1.3.0-0.65.el7.x86_64--> Processing Dependency: gssproxy >= 0.7.0-3 for package: 1:nfs-utils-1.3.0-0.65.el7.x86_64--> Processing Dependency: rpcbind for package: 1:nfs-utils-1.3.0-0.65.el7.x86_64……省略部分内容Installed: nfs-utils.x86_64 1:1.3.0-0.65.el7 Dependency Installed: gssproxy.x86_64 0:0.7.0-26.el7 keyutils.x86_64 0:1.5.8-3.el7 libbasicobjects.x86_64 0:0.1.1-32.el7 libcollection.x86_64 0:0.7.0-32.el7 libevent.x86_64 0:2.0.21-4.el7 libini_config.x86_64 0:1.3.1-32.el7 libnfsIDmap.x86_64 0:0.25-19.el7 libpath_utils.x86_64 0:0.2.1-32.el7 libref_array.x86_64 0:0.1.5-32.el7 libtirpc.x86_64 0:0.2.4-0.16.el7 libverto-libevent.x86_64 0:0.2.5-4.el7 quota.x86_64 1:4.01-19.el7 quota-nls.noarch 1:4.01-19.el7 rpcbind.x86_64 0:0.2.0-48.el7 tcp_wrappers.x86_64 0:7.6-77.el7 Updated: selinux-policy.noarch 0:3.13.1-252.el7_7.6 Dependency Updated: libsemanage.x86_64 0:2.5-14.el7 policycoreutils.x86_64 0:2.5-33.el7 selinux-policy-targeted.noarch 0:3.13.1-252.el7_7.6 Complete![root@test-centos7-node3 ~]#
提示：安装nfs-utils 它会把其依赖包rpcbind给一起安装上
新建共享目录/www
[root@test-centos7-node3 ~]# ls /bin boot data dev etc home lib lib64 media mnt opt proc root run sbin srv sys tmp tools usr var[root@test-centos7-node3 ~]# mkdir /www[root@test-centos7-node3 ~]# ls /bin boot data dev etc home lib lib64 media mnt opt proc root run sbin srv sys tmp tools usr var www[root@test-centos7-node3 ~]#
配置nfs共享/www目录
[root@test-centos7-node3 ~]# cat /etc/exports/www 192.168.0.10(rw,root_squash,all_squash)[root@test-centos7-node3 ~]#
提示：以上配置表示把/www目录只共享给192.168.0.10这台主机，并且以只读、压榨所有用户权限方式共享
启动nfs-server
[root@test-centos7-node3 ~]# systemctl status rpcbind nfs-server● rpcbind.service - RPC bind service Loaded: loaded (/usr/lib/systemd/system/rpcbind.service; enabled; vendor preset: enabled) Active: inactive (dead)● nfs-server.service - NFS server and services Loaded: loaded (/usr/lib/systemd/system/nfs-server.service; Disabled; vendor preset: Disabled) Active: inactive (dead)[root@test-centos7-node3 ~]# systemctl start nfs-server[root@test-centos7-node3 ~]# systemctl status rpcbind nfs-server● rpcbind.service - RPC bind service Loaded: loaded (/usr/lib/systemd/system/rpcbind.service; enabled; vendor preset: enabled) Active: active (running) since Sun 2020-02-16 05:33:51 EST; 2s ago Process: 16255 ExecStart=/sbin/rpcbind -w $RPCBIND_ARGS (code=exited,status=0/SUCCESS) Main PID: 16256 (rpcbind) CGroup: /system.slice/rpcbind.service └─16256 /sbin/rpcbind -wFeb 16 05:33:51 test-centos7-node3 systemd[1]: Starting RPC bind service...Feb 16 05:33:51 test-centos7-node3 systemd[1]: Started RPC bind service.● nfs-server.service - NFS server and services Loaded: loaded (/usr/lib/systemd/system/nfs-server.service; Disabled; vendor preset: Disabled) Active: active (exited) since Sun 2020-02-16 05:33:51 EST; 2s ago Process: 16290 ExecStartPost=/bin/sh -c if systemctl -q is-active gssproxy; then systemctl reload gssproxy ; fi (code=exited,status=0/SUCCESS) Process: 16273 ExecStart=/usr/sbin/rpc.nfsd $RPCNFSDARGS (code=exited,status=0/SUCCESS) Process: 16270 ExecStartPre=/usr/sbin/exportfs -r (code=exited,status=0/SUCCESS) Main PID: 16273 (code=exited,status=0/SUCCESS) CGroup: /system.slice/nfs-server.serviceFeb 16 05:33:51 test-centos7-node3 systemd[1]: Starting NFS server and services...Feb 16 05:33:51 test-centos7-node3 systemd[1]: Started NFS server and services.[root@test-centos7-node3 ~]# ss -ntlState Recv-Q Send-Q Local Address:Port Peer Address:Port ListEN 0 128 *:111 *:* ListEN 0 128 *:20048 *:* ListEN 0 128 *:53457 *:* ListEN 0 128 *:22 *:* ListEN 0 100 127.0.0.1:25 *:* ListEN 0 64 *:35199 *:* ListEN 0 64 *:2049 *:* ListEN 0 128 192.168.0.30:9000 *:* ListEN 0 128 :::111 :::* ListEN 0 128 :::20048 :::* ListEN 0 32 :::21 :::* ListEN 0 128 :::22 :::* ListEN 0 100 ::1:25 :::* ListEN 0 64 :::32961 :::* ListEN 0 64 :::2049 :::* ListEN 0 128 :::60355 :::* [root@test-centos7-node3 ~]#
提示：在centos7上启动nfs-server它会把rpcbind服务一起启动起来，在centos6上需要手动启动rpcbind
在客户端挂载共享目录/www
[root@test-centos7-node1 ~]# ip a s ens33 2: ens33: <broADCAST,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000 link/ether 00:0c:29:f2:82:0c brd ff:ff:ff:ff:ff:ff inet 192.168.0.10/24 brd 192.168.0.255 scope global ens33 valID_lft forever preferred_lft forever inet6 fe80::20c:29ff:fef2:820c/64 scope link valID_lft forever preferred_lft forever[root@test-centos7-node1 ~]# showmount -e 192.168.0.30Export List for 192.168.0.30:/www 192.168.0.10[root@test-centos7-node1 ~]# mount 192.168.0.30:/www /mnt[root@test-centos7-node1 ~]# dffilesystem 1K-blocks Used Available Use% Mounted on/dev/sda3 48209924 1664784 46545140 4% /devtmpfs 1922828 0 1922828 0% /devtmpfs 1932652 0 1932652 0% /dev/shmtmpfs 1932652 8744 1923908 1% /runtmpfs 1932652 0 1932652 0% /sys/fs/cgroup/dev/sda1 2086912 137672 1949240 7% /boottmpfs 386532 0 386532 0% /run/user/0192.168.0.30:/www 48210432 1717760 46492672 4% /mnt[root@test-centos7-node1 ~]#
提示：在客户端如果没有showmount命令，需要安装nfs-utils即可
测试，客户端挂载好共享目录，客户端在其共享目录里新建文件，看看服务端是否能够正常访问？
[root@test-centos7-node1 ~]# cd /mnt[root@test-centos7-node1 mnt]# ls[root@test-centos7-node1 mnt]# cp /etc/fstab .cp: cannot create regular file ‘./fstab’: Permission denIEd[root@test-centos7-node1 mnt]# touch aatouch: cannot touch ‘aa’: Permission denIEd[root@test-centos7-node1 mnt]#
提示：它告诉我们所@R_301_6240@，这是因为我们当前用户是root,访问nfs共享目录时把其权限压榨成nfsnobody用户的权限，因为在nfs服务端共享的目录是root属主，root组，其他用户对其目录没有写权限，所以我们不能在里面创建文件等有写的 *** 作。
在nfs服务端授权nfsnobody用户对/www目录有读写执行权限
[root@test-centos7-node3 ~]# setfacl -m u:nfsnobody:rwx /www[root@test-centos7-node3 ~]# getfacl /wwwgetfacl: Removing leading '/' from absolute path names# file: www# owner: root# group: rootuser::rwxuser:nfsnobody:rwxgroup::r-xmask::rwxother::r-x[root@test-centos7-node3 ~]#
在客户机上在对其挂载的共享目录创建文件或目录，在服务器端看看能否看到和使用呢?
[root@test-centos7-node1 ~]# dffilesystem 1K-blocks Used Available Use% Mounted on/dev/sda3 48209924 1664764 46545160 4% /devtmpfs 1922828 0 1922828 0% /devtmpfs 1932652 0 1932652 0% /dev/shmtmpfs 1932652 8744 1923908 1% /runtmpfs 1932652 0 1932652 0% /sys/fs/cgroup/dev/sda1 2086912 137672 1949240 7% /boottmpfs 386532 0 386532 0% /run/user/0192.168.0.30:/www 48210432 1717760 46492672 4% /mnt[root@test-centos7-node1 ~]# cd /mnt[root@test-centos7-node1 mnt]# ls[root@test-centos7-node1 mnt]# cp /etc/fstab .[root@test-centos7-node1 mnt]# lsfstab[root@test-centos7-node1 mnt]# touch aa[root@test-centos7-node1 mnt]# mkdir test[root@test-centos7-node1 mnt]#
[root@test-centos7-node3 ~]# ll /www/total 4-rw-r--r-- 1 nfsnobody nfsnobody 0 Feb 16 05:45 aa-rw-r--r-- 1 nfsnobody nfsnobody 501 Feb 16 05:45 fstabdrwxr-xr-x 2 nfsnobody nfsnobody 6 Feb 16 05:45 test[root@test-centos7-node3 ~]#
提示：在服务端可以看到客户端新建的文件和目录。这里需要注意一点的是，服务端往共享目录里放文件，需要注意权限，如果是root属主root属组,客户端那边可以能没有办法对文件进行修改 *** 作。到此nfs共享/www目录就完成了，更多nfs的使用和说明请参考本人博客https://www.cnblogs.com/qiuhom-1874/p/12237964.html
3、配置samba共享，实现/www目录共享
环境说明：smb服务器上192.168.0.30，客户机上192.168.0.10
1）安装samba
[root@test-centos7-node3 ~]# ip a s ens332: ens33: <broADCAST,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000 link/ether 00:0c:29:4a:bd:74 brd ff:ff:ff:ff:ff:ff inet 192.168.0.30/24 brd 192.168.0.255 scope global ens33 valID_lft forever preferred_lft forever inet6 fe80::20c:29ff:fe4a:bd74/64 scope link valID_lft forever preferred_lft forever[root@test-centos7-node3 ~]# yum install -y sambaLoaded plugins: fastestmirrorLoading mirror speeds from cached hostfile * base: mirrors.aliyun.com * extras: mirrors.aliyun.com * updates: mirrors.aliyun.comResolving DependencIEs--> Running transaction check---> Package samba.x86_64 0:4.9.1-10.el7_7 will be installed--> Processing Dependency: samba-libs = 4.9.1-10.el7_7 for package: samba-4.9.1-10.el7_7.x86_64……省略部分内容Installed: samba.x86_64 0:4.9.1-10.el7_7 Dependency Installed: cups-libs.x86_64 1:1.6.3-40.el7 libldb.x86_64 0:1.4.2-1.el7 libtalloc.x86_64 0:2.1.14-1.el7 libtdb.x86_64 0:1.3.16-1.el7 libtevent.x86_64 0:0.9.37-1.el7 libwbclIEnt.x86_64 0:4.9.1-10.el7_7 pytalloc.x86_64 0:2.1.14-1.el7 samba-clIEnt-libs.x86_64 0:4.9.1-10.el7_7 samba-common.noarch 0:4.9.1-10.el7_7 samba-common-libs.x86_64 0:4.9.1-10.el7_7 samba-common-tools.x86_64 0:4.9.1-10.el7_7 samba-libs.x86_64 0:4.9.1-10.el7_7 Dependency Updated: dbus.x86_64 1:1.10.24-13.el7_6 dbus-libs.x86_64 1:1.10.24-13.el7_6 Complete![root@test-centos7-node3 ~]#
2）配置samba共享/www目录
[root@test-centos7-node3 ~]# tail -6 /etc/samba/smb.conf[share_www] comment = share /www path = /www read only =no create mask = 0664 directory mask = 0775[root@test-centos7-node3 ~]#
3）检查samba配置文件
[root@test-centos7-node3 ~]# testparm rlimit_max: increasing rlimit_max (1024) to minimum windows limit (16384)Registered MSG_REQ_POol_USAGERegistered MSG_REQ_DMALLOC_MARK and LOG_CHANGEDLoad smb config files from /etc/samba/smb.confrlimit_max: increasing rlimit_max (1024) to minimum windows limit (16384)Processing section "[homes]"Processing section "[printers]"Processing section "[print$]"Processing section "[share_www]"Loaded services file OK.WARNING: The 'netbios name' is too long (max. 15 chars).Server role: RolE_STANDALONEPress enter to see a dump of your service deFinitions# Global parameters[global] printcap name = cups security = USER workgroup = SAMBA IDmap config * : backend = tdb cups options = raw[homes] browseable = No comment = Home DirectorIEs inherit acls = Yes read only = No valID users = %s %D%w%s[printers] browseable = No comment = All Printers create mask = 0600 path = /var/tmp printable = Yes[print$] comment = Printer Drivers create mask = 0664 directory mask = 0775 force group = @printadmin path = /var/lib/samba/drivers write List = @printadmin root[share_www] comment = share /www create mask = 0664 directory mask = 0775 path = /www read only = No[root@test-centos7-node3 ~]#
4）启动samba服务
[root@test-centos7-node3 ~]# systemctl start smb[root@test-centos7-node3 ~]# ss -ntlState Recv-Q Send-Q Local Address:Port Peer Address:Port ListEN 0 50 *:139 *:* ListEN 0 128 *:111 *:* ListEN 0 128 *:20048 *:* ListEN 0 128 *:53457 *:* ListEN 0 128 *:22 *:* ListEN 0 100 127.0.0.1:25 *:* ListEN 0 50 *:445 *:* ListEN 0 64 *:35199 *:* ListEN 0 64 *:2049 *:* ListEN 0 128 192.168.0.30:9000 *:* ListEN 0 50 :::139 :::* ListEN 0 128 :::111 :::* ListEN 0 128 :::20048 :::* ListEN 0 32 :::21 :::* ListEN 0 128 :::22 :::* ListEN 0 100 ::1:25 :::* ListEN 0 50 :::445 :::* ListEN 0 64 :::32961 :::* ListEN 0 64 :::2049 :::* ListEN 0 128 :::60355 :::* [root@test-centos7-node3 ~]#
提示：smb默认工作在tcp的445端口
5）在客户端使用smbclIEnt查看是否能够看到smb服务端共享的目录
[root@test-centos7-node1 ~]# smbclIEnt -L \192.168.0.30Enter SAMBA\root's password: Anonymous login successfulDomain=[TEST-CENTOS7-NODE3] OS=[windows 6.1] Server=[Samba 4.9.1] Sharename Type Comment --------- ---- ------- print$ disk Printer Drivers share_www disk share /www IPC$ IPC IPC Service (Samba 4.9.1)Anonymous login successfulDomain=[TEST-CENTOS7-NODE3] OS=[windows 6.1] Server=[Samba 4.9.1] Server Comment --------- ------- Workgroup Master --------- -------[root@test-centos7-node1 ~]#
提示：如果提示smbclIEnt未找到该命令，需要安装samba-clIEnt这个包；从上面的提示看，在客户机上是可以正常的看到samba服务器共享出来的名为share_www目录
6）在samba服务器上添加一个samba账号
[root@test-centos7-node3 ~]# getent passwd tom[root@test-centos7-node3 ~]# useradd -s /sbin/nologin tom[root@test-centos7-node3 ~]# getent passwd tom tom:x:1001:1001::/home/tom:/sbin/nologin[root@test-centos7-node3 ~]# smbpasswd -a tomNew SMB password:Retype new SMB password:Added user tom.[root@test-centos7-node3 ~]# pdbedit -Ltom:1001:[root@test-centos7-node3 ~]#
提示：samba服务的用户必须是linux主机上存在的用户，为了安全我们创建用户时需要指定其shell类型为/sbin/nologin
在客户机上用新建的用户去连接samba服务
[root@test-centos7-node1 ~]# smbclIEnt //192.168.0.30/share_www -U tom%adminDomain=[TEST-CENTOS7-NODE3] OS=[windows 6.1] Server=[Samba 4.9.1]smb: \> ls . D 0 Sun Feb 16 05:45:53 2020 .. D 0 Sun Feb 16 05:23:56 2020 fstab N 501 Sun Feb 16 05:45:45 2020 aa N 0 Sun Feb 16 05:45:49 2020 test D 0 Sun Feb 16 05:45:53 2020 48209924 blocks of size 1024. 46455356 blocks availablesmb: \> q[root@test-centos7-node1 ~]#提示：在客户机上用服务端添加的smb账号是可以看到samba共享出来的目录，以及目录里的文件
[root@test-centos7-node1 ~]# smbclIEnt //192.168.0.30/share_www -U tom%adminDomain=[TEST-CENTOS7-NODE3] OS=[windows 6.1] Server=[Samba 4.9.1]smb: \> ls . D 0 Sun Feb 16 05:45:53 2020 .. D 0 Sun Feb 16 05:23:56 2020 fstab N 501 Sun Feb 16 05:45:45 2020 aa N 0 Sun Feb 16 05:45:49 2020 test D 0 Sun Feb 16 05:45:53 2020 48209924 blocks of size 1024. 46455336 blocks availablesmb: \> !lstest.PHPsmb: \> put test.PHP NT_STATUS_ACCESS_DENIED opening remote file \test.PHPsmb: \> get fstab getting file \fstab of size 501 as fstab (69.9 KiloBytes/sec) (average 69.9 KiloBytes/sec)smb: \> !lsfstab test.PHPsmb: \> q[root@test-centos7-node1 ~]#提示：我们新建的tom用户在客户端 *** 作没有上传权限，只有下载权限。这是因为samba虽然指定了共享目录可写，但是对于tom用户在服务端上的文件系统没有授权为可写，所以tom用户暂时没法上传，需要上传文件我们就必须要对其文件系统赋予tom用户有写的权限才行 在服务端授权tom用户可以对共享目录有读写执行权限
[root@test-centos7-node3 ~]# setfacl -m u:tom:rwx /www[root@test-centos7-node3 ~]# getfacl /wwwgetfacl: Removing leading '/' from absolute path names# file: www# owner: root# group: rootuser::rwxuser:tom:rwxuser:nfsnobody:rwxgroup::r-xmask::rwxother::r-x[root@test-centos7-node3 ~]#测试，在客户端用tom用户访问共享目录，然后上传文件，看是否能够正常上传文件?
[root@test-centos7-node1 ~]# smbclIEnt //192.168.0.30/share_www -U tom%adminDomain=[TEST-CENTOS7-NODE3] OS=[windows 6.1] Server=[Samba 4.9.1]smb: \> ls . D 0 Sun Feb 16 05:45:53 2020 .. D 0 Sun Feb 16 05:23:56 2020 fstab N 501 Sun Feb 16 05:45:45 2020 aa N 0 Sun Feb 16 05:45:49 2020 test D 0 Sun Feb 16 05:45:53 2020 48209924 blocks of size 1024. 46455776 blocks availablesmb: \> !lsfstab test.PHPsmb: \> put test.PHP putting file test.PHP as \test.PHP (1.1 kb/s) (average 1.1 kb/s)smb: \> ls . D 0 Sun Feb 16 06:30:30 2020 .. D 0 Sun Feb 16 05:23:56 2020 fstab N 501 Sun Feb 16 05:45:45 2020 aa N 0 Sun Feb 16 05:45:49 2020 test D 0 Sun Feb 16 05:45:53 2020 test.PHP A 20 Sun Feb 16 06:30:30 2020 48209924 blocks of size 1024. 46455752 blocks availablesmb: \> q[root@test-centos7-node1 ~]#提示：修改了文件系统权限后，tom用户就可以往共享目录里上传文件了，更多samba服务端配置和说明请参考本人博客https://www.cnblogs.com/qiuhom-1874/p/12237973.html4、使用rsync+inotify实现/www目录实时同步 实验环境说明：rsync服务器是192.168.0.30，客户机上192.168.0.10 1）安装inotify-tools
[root@test-centos7-node3 ~]# ip a s ens332: ens33: <broADCAST,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000 link/ether 00:0c:29:4a:bd:74 brd ff:ff:ff:ff:ff:ff inet 192.168.0.30/24 brd 192.168.0.255 scope global ens33 valID_lft forever preferred_lft forever inet6 fe80::20c:29ff:fe4a:bd74/64 scope link valID_lft forever preferred_lft forever[root@test-centos7-node3 ~]# yum install inotify-tools -yLoaded plugins: fastestmirrorLoading mirror speeds from cached hostfile * base: mirrors.aliyun.com * extras: mirrors.aliyun.com * updates: mirrors.aliyun.comResolving DependencIEs--> Running transaction check---> Package inotify-tools.x86_64 0:3.14-9.el7 will be installed--> Finished Dependency ResolutionDependencIEs Resolved=========================================================================================================================================================================== Package Arch Version Repository Size===========================================================================================================================================================================Installing: inotify-tools x86_64 3.14-9.el7 epel 51 kTransaction Summary===========================================================================================================================================================================Install 1 PackageTotal download size: 51 kInstalled size: 111 kDownloading packages:inotify-tools-3.14-9.el7.x86_64.rpm | 51 kB 00:00:00 Running transaction checkRunning transaction testTransaction test succeededRunning transaction Installing : inotify-tools-3.14-9.el7.x86_64 1/1 Verifying : inotify-tools-3.14-9.el7.x86_64 1/1 Installed: inotify-tools.x86_64 0:3.14-9.el7 Complete![root@test-centos7-node3 ~]# rpm -ql inotify-tools/usr/bin/inotifywait/usr/bin/inotifywatch/usr/lib64/libinotifytools.so.0/usr/lib64/libinotifytools.so.0.4.1/usr/share/doc/inotify-tools-3.14/usr/share/doc/inotify-tools-3.14/AUTHORS/usr/share/doc/inotify-tools-3.14/copYING/usr/share/doc/inotify-tools-3.14/ChangeLog/usr/share/doc/inotify-tools-3.14/NEWS/usr/share/doc/inotify-tools-3.14/README/usr/share/man/man1/inotifywait.1.gz/usr/share/man/man1/inotifywatch.1.gz[root@test-centos7-node3 ~]#提示：inotify是内核的一个功能，我们要使用内核的功能，必须要在用户空间安装对应的工具才可以对内核功能发起调用 *** 作 2）安装rsync
[root@test-centos7-node3 ~]# yum install -y rsyncLoaded plugins: fastestmirrorLoading mirror speeds from cached hostfile * base: mirrors.aliyun.com * extras: mirrors.aliyun.com * updates: mirrors.aliyun.comPackage rsync-3.1.2-6.el7_6.1.x86_64 already installed and latest versionnothing to do[root@test-centos7-node3 ~]#提示：系统告诉我们rsync这个包已经安装好了 3）配置rsync服务，让其工作为守护进程模式
[root@test-centos7-node3 ~]# cat /etc/rsyncd.conf# /etc/rsyncd: configuration file for rsync daemon mode# See rsyncd.conf man page for more options.# configuration example:# uID = nobody# gID = nobody# use chroot = yes# max connections = 4# pID file = /var/run/rsyncd.pID# exclude = lost+found/# transfer logging = yes# timeout = 900# ignore nonreadable = yes# dont compress = *.gz *.tgz *.zip *.z *.Z *.rpm *.deb *.bz2# [ftp]# path = /home/ftp# comment = ftp export areauID = rootgID = rootuse chroot = nomax connections = 0ignore errorsexclude = lost+found/log file = /var/log/rsyncd.logpID file = /var/run/rsyncd.pIDlock file = /var/run/rsyncd.lockreverse lookup = nohosts allow = 192.168.0.0/24[backup]path = /backup/comment = share backupread only = noauth users = jerrysecrets file = /etc/rsync.pass[root@test-centos7-node3 ~]#4）新建/backup目录和/etc/rsync.pass文件，并且配置一个用户和密码用于rsync同步
[root@test-centos7-node3 ~]# mkdir /backup[root@test-centos7-node3 ~]# ll /backuptotal 0[root@test-centos7-node3 ~]# echo "jerry:admin" > /etc/rsync.pass[root@test-centos7-node3 ~]# cat /etc/rsync.passjerry:admin[root@test-centos7-node3 ~]# chmod 600 /etc/rsync.pass[root@test-centos7-node3 ~]#提示：rsync.pass文件用于存放rsync同步数据时用到的用户和密码，这个文件的格式是用户名：密码，这些都是明文的，为了其内容的安全，通常我们把其权限设置为非root用户不可读写的权限 5）启动rsysnc服务
[root@test-centos7-node3 ~]# rsync --daemon[root@test-centos7-node3 ~]# ss -ntlState Recv-Q Send-Q Local Address:Port Peer Address:Port ListEN 0 128 *:22 *:* ListEN 0 100 127.0.0.1:25 *:* ListEN 0 128 192.168.0.30:9000 *:* ListEN 0 5 *:873 *:* ListEN 0 128 :::22 :::* ListEN 0 100 ::1:25 :::* ListEN 0 5 :::873 :::* [root@test-centos7-node3 ~]#提示：rsync默认工作在tcp的873端口 6）在客户机上安装inotify-tools，并创建用于连接rsync服务器上的用户对应的密码文件和创建/www目录
[root@test-centos7-node1 ~]# ip a s ens332: ens33: <broADCAST,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000 link/ether 00:0c:29:f2:82:0c brd ff:ff:ff:ff:ff:ff inet 192.168.0.10/24 brd 192.168.0.255 scope global ens33 valID_lft forever preferred_lft forever inet6 fe80::20c:29ff:fef2:820c/64 scope link valID_lft forever preferred_lft forever[root@test-centos7-node1 ~]# yum install -y inotify-toolsLoaded plugins: fastestmirrorLoading mirror speeds from cached hostfileResolving DependencIEs--> Running transaction check---> Package inotify-tools.x86_64 0:3.14-9.el7 will be installed--> Finished Dependency ResolutionDependencIEs Resolved=========================================================================================================================================================================== Package Arch Version Repository Size===========================================================================================================================================================================Installing: inotify-tools x86_64 3.14-9.el7 epel 51 kTransaction Summary===========================================================================================================================================================================Install 1 PackageTotal download size: 51 kInstalled size: 111 kDownloading packages:inotify-tools-3.14-9.el7.x86_64.rpm | 51 kB 00:00:00 Running transaction checkRunning transaction testTransaction test succeededRunning transaction Installing : inotify-tools-3.14-9.el7.x86_64 1/1 Verifying : inotify-tools-3.14-9.el7.x86_64 1/1 Installed: inotify-tools.x86_64 0:3.14-9.el7 Complete![root@test-centos7-node1 ~]# echo "admin" > /etc/rsync.pass[root@test-centos7-node1 ~]# chmod 600 /etc/rsync.pass[root@test-centos7-node1 ~]# cat /etc/rsync.passadmin[root@test-centos7-node1 ~]# ll /etc/rsync.pass-rw------- 1 root root 6 Feb 16 07:15 /etc/rsync.pass[root@test-centos7-node1 ~]# [root@test-centos7-node1 ~]# mkdir /www[root@test-centos7-node1 ~]# ll /wwwtotal 0[root@test-centos7-node1 ~]#7）在客户端上编写脚本，实现实时监控/www目录下的资源，如有变动，立刻同步至rsync服务器对应的目录下
[root@test-centos7-node1 ~]# cat inotify_rsync.sh #!/bin/bashSRC='/www/'DEST='jerry@192.168.0.30::backup'inotifywait -mrq --timefmt '%Y-%m-%d %H:%M' --format '%T %w %f' -e create,delete,moved_to,close_write ${SRC} |while read DATE TIME DIR file;do filePATH=${DIR}${file} rsync -az --delete --password-file=/etc/rsync.pass $SRC $DEST && echo "At ${TIME} on ${DATE},file $filePATH was backuped up via rsync" >> /var/log/changelist.logdone[root@test-centos7-node1 ~]# 8）运行脚本，然后在/www目录下新建文件，看看能不能及时同步到rsync服务器上去 提示：没有在/www目录里创建文件时，rsync服务器上对应的目录是没有任何文件的，是一个空目录 提示：可以看到我们在客户端的/www目录下新建文件和目录能够及时的同步到rsync对应的/backup目录下；更多关于inotify和rsync的说明请参考https://www.cnblogs.com/qiuhom-1874/p/12246660.html5、使用iptable实现: 放行telnet, ftp, web服务,放行samba服务,其他端口服务全部拒绝 1）加载nf_conntrack_ftp模块[root@test-centos7-node3 ~]# lsmod |grep ftp[root@test-centos7-node3 ~]# modprobe nf_conntrack_ftp[root@test-centos7-node3 ~]# lsmod |grep ftp nf_conntrack_ftp 18638 0 nf_conntrack 133387 3 xt_conntrack,nf_conntrack_ftp,nf_conntrack_ipv4[root@test-centos7-node3 ~]#2）编写规则
[root@test-centos7-node3 ~]# ip a s ens332: ens33: <broADCAST,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000 link/ether 00:0c:29:4a:bd:74 brd ff:ff:ff:ff:ff:ff inet 192.168.0.30/24 brd 192.168.0.255 scope global ens33 valID_lft forever preferred_lft forever inet6 fe80::20c:29ff:fe4a:bd74/64 scope link valID_lft forever preferred_lft forever[root@test-centos7-node3 ~]# iptables -nvLChain input (policy ACCEPT 52 packets,3952 bytes) pkts bytes target prot opt in out source destination Chain FORWARD (policy ACCEPT 0 packets,0 bytes) pkts bytes target prot opt in out source destination Chain OUTPUT (policy ACCEPT 38 packets,4088 bytes) pkts bytes target prot opt in out source destination [root@test-centos7-node3 ~]# iptables -A input -p tcp -m state --state RELATED,ESTABliSHED -j ACCEPT [root@test-centos7-node3 ~]# iptables -A OUTPUT -p tcp -m state --state NEW,ESTABliSHED -j ACCEPT [root@test-centos7-node3 ~]# iptables -A input -p tcp -m multiport --dports 21:23,80,139,445 -m state --state NEW -j ACCEPT[root@test-centos7-node3 ~]# iptables -A input -j DROP[root@test-centos7-node3 ~]# iptables -A OUTPUT -j DROP [root@test-centos7-node3 ~]# iptables -nvLChain input (policy ACCEPT 0 packets,0 bytes) pkts bytes target prot opt in out source destination 181 12960 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABliSHED 0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 multiport dports 21:23,445 state NEW 0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 Chain FORWARD (policy ACCEPT 0 packets,0 bytes) pkts bytes target prot opt in out source destination Chain OUTPUT (policy ACCEPT 0 packets,0 bytes) pkts bytes target prot opt in out source destination 81 8524 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW,ESTABliSHED 0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 [root@test-centos7-node3 ~]#测试：在客户机上访问192.168.0.30上的telent 、ftp、 web、samba服务,看看客户端访问这些服务是不是正常放行的
[root@test-centos7-node1 ~]# ip a s ens33 2: ens33: <broADCAST,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000 link/ether 00:0c:29:f2:82:0c brd ff:ff:ff:ff:ff:ff inet 192.168.0.10/24 brd 192.168.0.255 scope global ens33 valID_lft forever preferred_lft forever inet6 fe80::20c:29ff:fef2:820c/64 scope link valID_lft forever preferred_lft forever[root@test-centos7-node1 ~]# telnet 192.168.0.30 Trying 192.168.0.30...Connected to 192.168.0.30.Escape character is '^]'.test-centos7-node3 login: qiuhomPassword: Last login: Sun Feb 16 09:44:25 from ::ffff:192.168.0.10[qiuhom@test-centos7-node3 ~]$ ip a s ens332: ens33: <broADCAST,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000 link/ether 00:0c:29:4a:bd:74 brd ff:ff:ff:ff:ff:ff inet 192.168.0.30/24 brd 192.168.0.255 scope global ens33 valID_lft forever preferred_lft forever inet6 fe80::20c:29ff:fe4a:bd74/64 scope link valID_lft forever preferred_lft forever[qiuhom@test-centos7-node3 ~]$ exit logoutConnection closed by foreign host.[root@test-centos7-node1 ~]# curl -I http://192.168.0.30/index.HTMLhttp/1.1 200 OKDate: Sun,16 Feb 2020 14:46:01 GMTServer: Apache/2.4.6 (CentOS)Last-ModifIEd: Sun,16 Feb 2020 13:16:09 GMTETag: "1f5-59eb13dfb0e13"Accept-Ranges: bytesContent-Length: 501Content-Type: text/HTML; charset=UTF-8[root@test-centos7-node1 ~]# ftp 192.168.0.30Connected to 192.168.0.30 (192.168.0.30).220 (vsFTPd 3.0.2)name (192.168.0.30:root): tom331 Please specify the password.Password:230 Login successful.Remote system type is UNIX.Using binary mode to transfer files.ftp> ls227 Entering Passive Mode (192,56,188).150 Here comes the directory Listing.drwxr-xr-x 2 0 0 6 Feb 16 09:41 pubdrwxrwxr-x 3 0 0 48 Feb 16 10:04 upload226 Directory send OK.ftp> cd upload250 Directory successfully changed.ftp> ls227 Entering Passive Mode (192,55).150 Here comes the directory Listing.drwx------ 2 1000 1000 6 Feb 16 10:03 aa-rw------- 1 1000 1000 333992 Feb 16 10:04 pam_MysqL-0.7pre3.tar.gz226 Directory send OK.ftp> get pam_MysqL-0.7pre3.tar.gzlocal: pam_MysqL-0.7pre3.tar.gz remote: pam_MysqL-0.7pre3.tar.gz227 Entering Passive Mode (192,211,130).150 opening BINARY mode data connection for pam_MysqL-0.7pre3.tar.gz (333992 bytes).226 Transfer complete.333992 bytes received in 0.0109 secs (30532.22 Kbytes/sec)ftp> bye221 Goodbye.[root@test-centos7-node1 ~]# smbclIEnt //192.168.0.30/share_www -U tom%adminDomain=[TEST-CENTOS7-NODE3] OS=[windows 6.1] Server=[Samba 4.9.1]smb: \> ls . D 0 Sun Feb 16 06:30:30 2020 .. D 0 Sun Feb 16 07:24:16 2020 fstab N 501 Sun Feb 16 05:45:45 2020 aa N 0 Sun Feb 16 05:45:49 2020 test D 0 Sun Feb 16 05:45:53 2020 test.PHP A 20 Sun Feb 16 06:30:30 2020 48209924 blocks of size 1024. 46442924 blocks availablesmb: \> get aagetting file \aa of size 0 as aa (0.0 KiloBytes/sec) (average 0.0 KiloBytes/sec)smb: \> ls . D 0 Sun Feb 16 06:30:30 2020 .. D 0 Sun Feb 16 07:24:16 2020 fstab N 501 Sun Feb 16 05:45:45 2020 aa N 0 Sun Feb 16 05:45:49 2020 test D 0 Sun Feb 16 05:45:53 2020 test.PHP A 20 Sun Feb 16 06:30:30 2020 48209924 blocks of size 1024. 46442924 blocks availablesmb: \> !lsaa fstab inotify_rsync.sh pam_MysqL-0.7pre3.tar.gz test.PHPsmb: \> q[root@test-centos7-node1 ~]#提示：可以看到在客户端访问telnet、web、ftp、samba服务都是不受任何影响的；有关iptables的用法和说明可以参考本人系列博文https://www.cnblogs.com/qiuhom-1874/category/1642473.html
总结
以上是内存溢出为你收集整理的Linux系统之网络文件共享与数据实时同步实践全部内容，希望文章能够帮你解决Linux系统之网络文件共享与数据实时同步实践所遇到的程序开发问题。如果觉得内存溢出网站内容还不错，欢迎将内存溢出网站推荐给程序员好友。欢迎分享，转载请注明来源：内存溢出
微信扫一扫
支付宝扫一扫
评论列表（0条）