FTPS（FTP+SSL）

admin

FTPS（FTP+SSL）
# z$ h8 G0 _) y( ~
! O. P9 o" C, W& t& k/ Y; U1 n   ftps是一种多传输协议，相当于加密版的FTP。当你在FTP服务器上收发文件的时候，你面临两个风险。第一个风险是在上载文件的时候为文件加密。第二个风险是，这些文件在你等待接收方下载的时候将停留在FTP服务器上，这时你如何保证这些文件的安全。你的第二个选择(创建一个支持SSL的FTP服务器)能够让你的主机使用一个FTPS连接上载这些文件。这包括使用一个在FTP协议下面的SSL层加密控制和数据通道。一种替代FTPS的协议是安全文件传输协议(SFTP)。这个协议使用SSH文件传输协议加密从客户机到服务器的FTP连接。
: \% o- H7 z8 O4 g3 A' s, g7 ^6 C
$ }3 E" K' r/ ^8 y" h, _* ?
FTPS是在安全套接层使用标准的FTP协议和指令的一种增强型TFP协议，为FTP协议和数据通道增加了SSL安全功能。FTPS也称作“FTP-SSL”和“FTP-over-SSL”。SSL是一个在客户机和具有SSL功能的服务器之间的安全连接中对数据进行加密和解密的协议。


: n. d  R4 B" u  E/ ?  a和sftp连接方法类似，在windows中可以使用FileZilla等传输软件来连接FTPS进行上传，下载文件，建立，删除目录等操作,在FileZilla连接时，有显式和隐式TLS/SSL连接之分，连接时也有指纹提示。
8 Q  c! w0 r7 j4 g

' V! S1 I' P7 s
安全：ftps ftp+ssl

准备工作：

7 C" m" M6 ]- h: X准备一:关闭防火墙；
  @4 I3 ]+ W, W/ `2 U
准备二：挂载光盘；
& M% f+ C8 Z# j1 [4 [
2 k* o- s. Z# z- Y$ |: l准备三：构建本地yum服务器。

FTP+SSL配置详细过程:
+ D* z9 a) _5 L: C% j" O' |
①.安装配置FTP服务器和抓包工具：（ftp：192.168.101.210）

+ ]6 n8 {+ B& d  X! i5 e  F8 m6 G[root@ftp ~]# yum list all |grep vsftpd
[root@ftp ~]# yum install -y vsftpd
4 A2 @4 n6 h- e3 i- b& g
8 G- N) J4 L- l$ ^6 Z& \2 Z[root@ftp ~]# yum list all |grep wireshark
' M1 y- J  i0 \2 p( U  L7 j& @, ^! s# a
  U# t5 ?, _  i& I& Y2 m+ Z) K5 R  `[root@ftp ~]# yum install -y wireshark

$ t0 L- [/ V; n) V" B2 {7 |- v[root@ftp ~]# useradd user1
[root@ftp ~]# echo "123" |passwd --stdin user1
/ j# L( L1 a; T
2 I5 R# e; v" P1 s' S$ ^[root@ftp ~]# service vsftpd start
, r: ]5 @9 p& a% z$ {/ V
# [1 Y. E$ [! e3 OStarting vsftpd for vsftpd:                                [ OK ]
+ U; p5 T; [& S) W

& ~2 B: j( _" a( J6 _[root@ftp ~]# tshark -ni eth0 -R "tcp.dstport eq 21"
' k1 d2 i7 @: {+ z
- d. S, T; a0 ^* N  @  H, [( [8 S) i* h

% W" H! p5 @! J1 k8 B; n: f$ T②.配置本地CA证书服务器：
: |! q' o4 D0 I4 ?! X
[root@ftp ~]# cd /etc/pki/
5 S1 v- H9 ?$ q% g2 D4 A[root@ftp pki]# ll
7 K( ~! T) r1 K9 o/ Q/ y) ~/ m- L8 I9 V: v[root@ftp pki]# vim tls/openssl.cnf
! A$ I/ P) ^3 D/ U4 u45 dir             = /etc/pki/CA
. S1 V5 R5 C* c7 K# s88 countryName             = optional

; H2 e( s6 n% y( d89 stateOrProvinceName     = optional

. ~& E+ m4 \8 e/ m! C90 organizationName        = optional
! e1 _; q# v( W( L' `
[root@ftp pki]# cd CA/
4 ~' n! D; y2 m[root@ftp CA]# mkdir certs newcerts crl
[root@ftp CA]# touch index.txt serial
[root@ftp CA]# echo "01" >serial

' R- ]( j) L" M+ }1 _/ j[root@ftp CA]# ll
[root@ftp CA]# openssl genrsa 1024 > private/cakey.pem

2 m, z% n; h1 F& UGenerating RSA private key, 1024 bit long modulus
4 o0 p3 \' X7 k7 {
7 {6 C6 L" u0 C; r* s5 [...........++++++
....++++++
e is 65537 (0x10001)
# t* E. s- H6 b8 u" \- ?
[root@ftp CA]# chmod 600 private/cakey.pem
[root@ftp CA]# ll private/cakey.pem
' ~: U; H$ a- a0 G4 p, s. ?$ h1 n-rw------- 1 root root 887 Feb 10 23:22 private/cakey.pem
[root@ftp CA]# openssl req -new -x509 -key private/cakey.pem -out cacert.pem -days 3650
2 L. l, }8 U! @/ F2 K$ `
You are about to be asked to enter information that will be incorporated

into your certificate request.

8 B9 z9 D8 ^1 T9 rWhat you are about to enter is what is called a Distinguished Name or a DN.

There are quite a few fields but you can leave some blank
2 J9 i' Y2 p. J/ l% R4 E
For some fields there will be a default value,
0 X0 H" r) f/ a3 `: ~+ b
% \* ~1 _6 h+ d; m1 K, s+ |8 }! lIf you enter '.', the field will be left blank.
, {8 U7 J9 p3 `' q* @0 F: l
-----
: b+ k0 e! l% W5 S# I- L) HCountry Name (2 letter code) [GB]:cn

  J/ h8 f3 I8 Z5 H  V1 J" ]' K& t$ RState or Province Name (full name) [Berkshire]:henan

Locality Name (eg, city) [Newbury]:zhengzhou
* y& I) n) q6 k
* L2 e* @- e  `Organization Name (eg, company) [My Company Ltd]:junjie

. `2 f+ j$ f; ~1 [0 N) e0 k" c) s7 |% [Organizational Unit Name (eg, section) []:soft
- [' T# R+ q6 h2 v0 n4 r
Common Name (eg, your name or your server's hostname) []:ca.junjie.com

- o0 D6 H8 u' _, y2 L- v! z  V+ JEmail Address []:junjie@junjie.com
[root@ftp CA]#ll
4 z9 `3 |  C! p8 i! K2 P+ b- `( d③.为ftp服务器创建证书：
( q0 e& \3 C; j
8 G# v* v8 O* `[root@ftp CA]# mkdir /etc/vsftpd/certs
  Z. X, m* \8 j. v) Q7 [[root@ftp CA]# cd /etc/vsftpd/certs
. z' X; S; {+ \- x[root@ftp certs]# openssl genrsa 1024 >vsftpd.key
Generating RSA private key, 1024 bit long modulus
2 b( v% g! s4 w; g
3 W8 }* m! J& e% Z' A" q, K0 @....++++++
- ^# ~* F) n2 \...++++++
e is 65537 (0x10001)

  s9 Y: @0 y! ?* _[root@ftp certs]# openssl req -new -key vsftpd.key -out vsftpd.csr
$ w  c% y5 D) }% _$ G
* D$ Q  U' e/ F; i2 j7 Z' J3 HYou are about to be asked to enter information that will be incorporated

  v1 A' g( c* u, J. k8 i+ R) w# dinto your certificate request.
  i1 v+ ]( {2 ~' d5 H$ }8 v
What you are about to enter is what is called a Distinguished Name or a DN.

There are quite a few fields but you can leave some blank

For some fields there will be a default value,
6 P6 _- Z( Z* M1 }  @- N" F
If you enter '.', the field will be left blank.
4 a. w4 y6 V; H
-----
7 K7 o& k' _' Y! @Country Name (2 letter code) [GB]:cn
1 N8 L8 l4 l% B3 e6 j8 z
0 }" ?4 \6 M# g, I  tState or Province Name (full name) [Berkshire]:henan
  g+ A9 l# {6 p' h! _. H- {
Locality Name (eg, city) [Newbury]:zhengzhou
" [: @$ y/ a; q9 A5 u
Organization Name (eg, company) [My Company Ltd]:junjie
5 f# f$ ]: p( Z9 d* R+ ~+ p
- Z& d8 [; W% r4 J0 S3 a* VOrganizational Unit Name (eg, section) []:ftp

Common Name (eg, your name or your server's hostname) []:ftp.junjie.com

Email Address []:ftp@junjie.com

Please enter the following 'extra' attributes

to be sent with your certificate request
2 [4 A4 d+ j) f
8 c; l, d# f5 u( @; s/ qA challenge password []:

An optional company name []:
2 z# K- ]1 @8 w' _0 T
& i/ d9 P! n3 Y* ]; d[root@ftp certs]# openssl ca -in vsftpd.csr -out vsftpd.crt
Using configuration from /etc/pki/tls/openssl.cnf

6 u$ L3 I2 z- ?% w1 z0 w2 LCheck that the request matches the signature

Signature ok
Certificate Details:
  N# J5 t0 E9 k/ C* Z6 a" s6 l( H2 ^
        Serial Number: 1 (0x1)
! p$ o  q$ ~& v* Z2 h$ S        Validity
* i% i7 t- k7 w            Not Before: Feb 10 15:48:55 2012 GMT
* C2 K1 ]7 ]+ }+ b% a
            Not After : Feb 9 15:48:55 2013 GMT
$ a/ T4 ~! N* J5 D. R        Subject:
/ n8 p+ E2 A1 z  G9 G. @$ O            countryName               = cn
            stateOrProvinceName       = henan
            organizationName          = junjie
            organizationalUnitName    = ftp
6 M. W3 W2 `) ]+ X) G7 i: ?            commonName                = ftp.junjie.com
0 E! D& S$ V+ D& W3 I" Q+ |            emailAddress              = junjie@junjie.com
! M: }$ D% N+ `. ]! J- `# F        X509v3 extensions:
7 O+ y" N& U2 L- K            X509v3 Basic Constraints:
& T, n& o  N/ T                CA:FALSE
8 y" R9 @8 @( n& W9 d% A            Netscape Comment:
0 k7 Z& e) T/ U5 `                OpenSSL Generated Certificate
' X% X- P8 J% d7 q! Q            X509v3 Subject Key Identifier:
                33:C5:01:33:A5:CF:42:9F:24:A9:0D:E9:41:8E:26:C3:1B:7B:18:11
1 Z& d) I7 N: B/ B
            X509v3 Authority Key Identifier:
  K. B- D% E# e                keyid:501:A8:0A:1F:B7:CD:49:94:69:E3:70:E9:AE:93:73:2C:94:66:AC
  E- I+ x+ c, o# ?  W" R# z  i4 p
3 k6 U$ g0 g& r6 {$ L0 @
Certificate is to be certified until Feb 9 15:48:55 2013 GMT (365 days)
4 M/ ?% n, s1 M# p. C, W
Sign the certificate? [y/n]:y
: C2 H2 V& j% O* o; ]


6 c; B7 B4 c' t+ E8 Y- T% |1 out of 1 certificate requests certified, commit? [y/n]y
# B) o: S' ]& u( ]- v% O
Write out database with 1 new entries
" W' B4 w4 F# ^* a  u: k, h  W8 `
Data Base Updated
( ?; E! x0 M; V2 N) M[root@ftp certs]# ll
, x2 d* C! L! |) F4 q  |9 N[root@ftp certs]# chmod 600 *
[root@ftp certs]# ll
, c0 ]6 a1 {6 g6 C. G& \6 j6 i④.使ftp服务应用证书：

[root@ftp certs]# cd /etc/vsftpd/            
) X7 _* i' n) k  l6 r2 B[root@ftp vsftpd]# vim vsftpd.conf         #增加以下内容
118 rsa_cert_file=/etc/vsftpd/certs/vsftpd.crt
9 \/ E1 S4 \+ d" K9 _7 T( E
& D) V, D# y5 y$ t. |7 S119 rsa_private_key_file=/etc/vsftpd/certs/vsftpd.key

120 force_local_data_ssl=YES
121 force_local_logins_ssl=YES
122 ssl_enable=YES
% V. [# r8 `  r* M123 ssl_sslv2=YES
124 ssl_sslv3=YES
125 ssl_tlsv1=YES
# g) L4 ]* g6 E[root@ftp vsftpd]# service vsftpd restart

Shutting down vsftpd:                                      [ OK ]
# O% h" [7 |% T' J; RStarting vsftpd for vsftpd:                                [ OK ]
⑤客户端测试（已加密传输）：
2 i+ n* i) r" O; S4 }7 R) Y

5 ~4 E1 H) N- k( s& |


3 f& H4 \  ^8 t( W: j7 i, n从上面看出证书名称出现问题，但可是可以使用！选择接收一次！


1 E% n4 @7 j7 @; r$ U) W4 B4 f7 ]
该次登录抓包内容如下所示：传输已经经过加密！
[root@ftp ~]# tshark -ni eth0 -R "tcp.dstport eq 21"

3 Y, a9 l7 }/ I, O+ P% }

6 q, R; s  Y! D" g& h[root@ftp ~]# tshark -ni eth0 -R "tcp.dstport eq 21"
' L+ X4 [# T, y2 |1 G
Running as user "root" and group "root". This could be dangerous.

Capturing on eth0
" x  g) T# y2 ?* l9 \3 M) n
9.742109 192.168.101.113 -> 192.168.101.210 TCP 52572 > 21 [SYN] Seq=0 Win=8192 Len=0 MSS=1460 WS=2
. T' L3 w* I/ A/ w8 q2 p: k# B
9.742144 192.168.101.113 -> 192.168.101.210 TCP 52572 > 21 [ACK] Seq=1 Ack=1 Win=65700 Len=0

0 K! Z5 ^: ^: [ 9.747458 192.168.101.113 -> 192.168.101.210 FTP Request: AUTH SSL
( B4 {5 r  J$ K4 d3 N7 f/ m
. }$ H: N% o7 `% m 9.755605 192.168.101.113 -> 192.168.101.210 FTP Request: \200\310\001\003\001\000\237\000\000\000 \000\300\024\000\300
+ K/ k( B+ |* s4 Y+ _
- f: O8 `" f- ~/ g( q) n 9.758795 192.168.101.113 -> 192.168.101.210 FTP Request: \026\003\001\000\206\020\000\000\202\000\200n\257\315\204\324o
( o! A7 }# V/ y" }
' N! G$ g0 J( _; c 9.778662 192.168.101.113 -> 192.168.101.210 FTP Request: \027\003\001\000\030\215\325t\357\277\001\376FZ\243D\373\003\367\231\207Q\324\003Q}/\335\025\027\003\001\000 \f\355b\270\355\325\020[\372\302s{^\375\307\364C\307\243\251v9\370\364\260\277\253\317\321gB]

9.779885 192.168.101.113 -> 192.168.101.210 FTP Request: \027\003\001\000\030\324\000\267\312\0320\213\266y\311\025[\371\275?\254Y\257\024[\245vjM\027\003\001\000(\236\321\221Z\321Z(\316'\343.\235?\321=8\264b\270(j\336\231\210\265\207K\223A\037"\277\251\252t\252a`\374
" V/ l( O6 ^0 @" m% q! {5 p# S
7 W$ d1 m, v4 I* \* t" l+ S1 o/ K. b 9.782153 192.168.101.113 -> 192.168.101.210 FTP Request: \027\003\001\000\030\257d\313mXZT\356\2366\334q\223\017gt\371\232\207\226\325
+ D1 b9 T4 H4 C* \7 }) P( v6 S
9.793165 192.168.101.113 -> 192.168.101.210 FTP Request: \027\003\001\000\0301\020S\237\372\210\004N4\370\366\377\2213m\356\233w:\275)>@%\027\003\001\000 Y\032\275BM=3J\313\240\241\372Z\371@\335\262\252\240\235\021\345\271\305\223\211\020\340\332\323Q\251

9.795630 192.168.101.113 -> 192.168.101.210 FTP Request: \027\003\001\000\030\302\016=LR\272\030{\034\277V\256]\230\247\363\355M\241\327U\207k\032\027\003\001\000 OYi\216=S\322\212)\271V\016\2519w\332f\213\222S\244\275M\316\025N\302:k\312b\331
- [1 k; Q6 r, i4 |/ `
5 [9 N8 @% z" W+ `- q$ ] 9.796727 192.168.101.113 -> 192.168.101.210 TCP 52572 > 21 [ACK] Seq=741 Ack=1260 Win=64440 Len=0
! i! a* t% J( b7 s- a; E
9.797542 192.168.101.113 -> 192.168.101.210 TCP 52572 > 21 [ACK] Seq=741 Ack=1334 Win=64364 Len=0

9.798327 192.168.101.113 -> 192.168.101.210 TCP 52572 > 21 [ACK] Seq=741 Ack=1408 Win=64292 Len=0

2 ]" t4 e% x' p: Y2 o# b0 D 9.798775 192.168.101.113 -> 192.168.101.210 TCP 52572 > 21 [ACK] Seq=741 Ack=1482 Win=65700 Len=0

% i( s& }5 x; w& D% u/ I 9.799387 192.168.101.113 -> 192.168.101.210 TCP 52572 > 21 [ACK] Seq=741 Ack=1564 Win=65616 Len=0
  C& l* G; U6 ]
9.799910 192.168.101.113 -> 192.168.101.210 TCP 52572 > 21 [ACK] Seq=741 Ack=1638 Win=65544 Len=0
/ S. F: j. l5 f1 X. ]) R; n
9.805078 192.168.101.113 -> 192.168.101.210 FTP Request: \027\003\001\000\030G}\305\210\021s\244q\023k=\345R\232A\366B\360\202\320\361(x\344\027\003\001\000 \351W\350\377\362\2756\334\303\035+1l|{\304\277\224\326n\036d\213\217\b\216\023N\225\003a\274
# c6 y, y; A. M6 }, U; f) e% }/ U
# w; k' r6 i+ h, f2 V$ h. c 9.810763 192.168.101.113 -> 192.168.101.210 FTP Request: \027\003\001\000\030\203\354F\302\253\205\212\355\334$\321=\303h\276\302\350\320.\346\223\337BG\027\003\001\000 73\027\372#\232

9.813350 192.168.101.113 -> 192.168.101.210 FTP Request: \027\003\001\000\030\203x`k\337RM\341w\022N\255|f\260U ?\354)A\301^\251\027\003\001\000 \031`\366\364He\030\266z)\373\265\237\261\3430\220\331\340Kv[\033\347\tXj\344\314\236\242

7 j* _: F  Q7 @ 9.814073 192.168.101.113 -> 192.168.101.210 FTP Request: \027\003\001\000\030\307\2126sY\a\237\034\321\277!j\320\213\235\032\277e\345\361E>|)\027\003\001\000 \256\304}:-\365\034\aD~\fk`]\314\b\207\365-\217\305\244

9.838659 192.168.101.113 -> 192.168.101.210 FTP Request: \027\003\001\000\030\300\272t&\t(\262\243\361\210\263\343\326\261\017$\317V\002\354\325\271\250\366\027\003\001\000 \350F\305\360\363\365\033\274W\207M\006\216\255\016\365\205z\033\002\032B\345,\3712\034\377\327[\272P

9.851675 192.168.101.113 -> 192.168.101.210 TCP 52572 > 21 [ACK] Seq=1071 Ack=2041 Win=65140 Len=0
. B8 z5 o5 m9 O
9.856073 192.168.101.113 -> 192.168.101.210 FTP Request: \027\003\001\000\030\f\357\000E/\372\333\247\016\344\315\345\346\271L\327\214CE0*i\316\332\027\003\001\000(8\220\341\316.*\234dM\235
2 J8 e0 Y3 F* o; S( D
10.061779 192.168.101.113 -> 192.168.101.210 TCP 52572 > 21 [ACK] Seq=1145 Ack=2094 Win=65088 Len=0

39.978110 192.168.101.113 -> 192.168.101.210 FTP Request: \027\003\001\000\030=\032\322\022\216B\025O\016\034
+ b# f7 @" G8 A/ S7 ]
39.980672 192.168.101.113 -> 192.168.101.210 TCP 52572 > 21 [FIN, ACK] Seq=1211 Ack=2139 Win=65040 Len=0
% ^% D  o; C* e
4 M" x" q* ]% D' c" f- B6 E1 A 39.980725 192.168.101.113 -> 192.168.101.210 TCP 52572 > 21 [RST, ACK] Seq=1212 Ack=2149 Win=0 Len=0
: }7 Q4 x& Q7 o  a' u: e8 ~
27 packets captured

[root@ftp ~]#