FTPS（FTP+SSL）

admin

FTPS（FTP+SSL）

   ftps是一种多传输协议，相当于加密版的FTP。当你在FTP服务器上收发文件的时候，你面临两个风险。第一个风险是在上载文件的时候为文件加密。第二个风险是，这些文件在你等待接收方下载的时候将停留在FTP服务器上，这时你如何保证这些文件的安全。你的第二个选择(创建一个支持SSL的FTP服务器)能够让你的主机使用一个FTPS连接上载这些文件。这包括使用一个在FTP协议下面的SSL层加密控制和数据通道。一种替代FTPS的协议是安全文件传输协议(SFTP)。这个协议使用SSH文件传输协议加密从客户机到服务器的FTP连接。


% b3 F, I, s& S, U  V1 `: h# hFTPS是在安全套接层使用标准的FTP协议和指令的一种增强型TFP协议，为FTP协议和数据通道增加了SSL安全功能。FTPS也称作“FTP-SSL”和“FTP-over-SSL”。SSL是一个在客户机和具有SSL功能的服务器之间的安全连接中对数据进行加密和解密的协议。
) B- G: H  d; e$ `) W
# Y% X, Z& H, g: h# i: ^
. Y4 p+ M* m& \# S和sftp连接方法类似，在windows中可以使用FileZilla等传输软件来连接FTPS进行上传，下载文件，建立，删除目录等操作,在FileZilla连接时，有显式和隐式TLS/SSL连接之分，连接时也有指纹提示。
( o3 ?2 M3 o; \
0 e/ H! f  J4 `  z7 q

0 J, E2 }% H* ~1 ?安全：ftps ftp+ssl

准备工作：

准备一:关闭防火墙；
4 P% S: w4 h) J: k# O5 O; }4 u, [
7 W0 J# e5 ^, [0 l准备二：挂载光盘；
/ @4 k+ h' v6 T
准备三：构建本地yum服务器。
' p' s- K6 m" |9 S( A# S& Q7 [
" c: K" l6 \# Y6 kFTP+SSL配置详细过程:
+ C; N/ Q2 g! X' e% V3 T! \
- ]4 v9 }& t9 x* U+ ^' S* w①.安装配置FTP服务器和抓包工具：（ftp：192.168.101.210）

[root@ftp ~]# yum list all |grep vsftpd
+ a, u; W4 `+ \7 @/ o) W[root@ftp ~]# yum install -y vsftpd

[root@ftp ~]# yum list all |grep wireshark
: w6 M# s, L' q# _
[root@ftp ~]# yum install -y wireshark

[root@ftp ~]# useradd user1
5 S' f' z( Q' o9 @: v% h2 P[root@ftp ~]# echo "123" |passwd --stdin user1
; N4 Z1 V5 j) {
[root@ftp ~]# service vsftpd start

- }- X; \7 `; f: N, IStarting vsftpd for vsftpd:                                [ OK ]
5 X8 B1 A- V! n  ?0 \
& S. S  Q; ~# V. i4 S
[root@ftp ~]# tshark -ni eth0 -R "tcp.dstport eq 21"
# y+ S9 l% k! V9 a) C


②.配置本地CA证书服务器：

[root@ftp ~]# cd /etc/pki/
[root@ftp pki]# ll
  I$ }! V1 W! Z; A9 s! Z[root@ftp pki]# vim tls/openssl.cnf
45 dir             = /etc/pki/CA
& v2 ?" J  z7 W88 countryName             = optional

; D) Q) t1 z7 ]: L$ s' i+ T  `89 stateOrProvinceName     = optional
4 w: }3 F- D* ^$ N2 G8 N
90 organizationName        = optional

[root@ftp pki]# cd CA/
[root@ftp CA]# mkdir certs newcerts crl
[root@ftp CA]# touch index.txt serial
* u+ p; U9 g+ L; x+ ^; F[root@ftp CA]# echo "01" >serial
( h0 n3 m" a$ v+ G
  m- Q& m) l2 Q0 f[root@ftp CA]# ll
[root@ftp CA]# openssl genrsa 1024 > private/cakey.pem
" D# T( N" {3 j) R2 Q. G) P7 D
, ^8 t' S( J8 o! q7 p2 hGenerating RSA private key, 1024 bit long modulus

...........++++++
" [: a* T: l; d+ a; _....++++++
. p! `& R. e: H+ Ee is 65537 (0x10001)

[root@ftp CA]# chmod 600 private/cakey.pem
- I2 d: H& [* ][root@ftp CA]# ll private/cakey.pem
-rw------- 1 root root 887 Feb 10 23:22 private/cakey.pem
) R. S$ x0 H0 X& i5 Z[root@ftp CA]# openssl req -new -x509 -key private/cakey.pem -out cacert.pem -days 3650
* |, I* q7 Y- ]+ f: m% b8 ^+ ]
- k* ]& t$ D6 a* u% xYou are about to be asked to enter information that will be incorporated
/ R' q. }* g1 V8 n7 p2 Z- D) j
( C7 M4 o$ O3 i, Q& uinto your certificate request.
, i4 ^/ F8 [1 y# X& M
! Y  z! J- u4 W7 IWhat you are about to enter is what is called a Distinguished Name or a DN.

) y; x" M5 z$ A; `There are quite a few fields but you can leave some blank

# X0 G" U( d5 [/ ?For some fields there will be a default value,
, s( b) t* ^0 C! M
If you enter '.', the field will be left blank.
) F. s; F5 ]; ]) w% u$ T& o
9 n8 g8 ]0 q5 W-----
8 D* o6 S% P7 S) L- ^7 hCountry Name (2 letter code) [GB]:cn
5 R+ h, y! \+ n9 ?7 C: s
, r3 m& T0 G6 U0 zState or Province Name (full name) [Berkshire]:henan

Locality Name (eg, city) [Newbury]:zhengzhou
$ }% I( k8 |5 e8 _
- g3 d4 p* ]; N" XOrganization Name (eg, company) [My Company Ltd]:junjie
! A1 H2 S6 x6 X; H) O. \
; ?( l# }. l7 z' E' r, x& iOrganizational Unit Name (eg, section) []:soft
3 ]  |7 o" q' _- S0 ]  Z: ~
Common Name (eg, your name or your server's hostname) []:ca.junjie.com

Email Address []:junjie@junjie.com
6 q9 D: ^! l1 Y[root@ftp CA]#ll
③.为ftp服务器创建证书：

8 d7 S/ X& {, E! K# _) I: ~[root@ftp CA]# mkdir /etc/vsftpd/certs
[root@ftp CA]# cd /etc/vsftpd/certs
[root@ftp certs]# openssl genrsa 1024 >vsftpd.key
Generating RSA private key, 1024 bit long modulus
9 P; p& p, J; ]
....++++++
...++++++
e is 65537 (0x10001)
$ A! @1 Y5 ?$ d; i% @* C  n! u
[root@ftp certs]# openssl req -new -key vsftpd.key -out vsftpd.csr

You are about to be asked to enter information that will be incorporated
5 e: ^# |" z. H- I% D/ j
" M) P7 |( g7 d) {  H* _% |into your certificate request.
: A9 J2 W" W0 s2 P) J
9 E) @& C" C/ ]3 p* F1 N3 s, M/ vWhat you are about to enter is what is called a Distinguished Name or a DN.

There are quite a few fields but you can leave some blank

For some fields there will be a default value,

  [4 i0 P- ?( i. h0 o9 e7 kIf you enter '.', the field will be left blank.

; D8 B3 ~5 t; _; ^6 f& p- \6 d-----
Country Name (2 letter code) [GB]:cn

3 T( ~' |) e# p/ b% ]( l- }9 Y( eState or Province Name (full name) [Berkshire]:henan

- ^  ~. L: ?# c3 z; E' J) RLocality Name (eg, city) [Newbury]:zhengzhou
- j9 M5 J9 _2 g. t# o; q% K4 E  L# ~
5 ?7 `" d' M% y) ]4 SOrganization Name (eg, company) [My Company Ltd]:junjie
) |% _/ r! b$ e' @% D" S
Organizational Unit Name (eg, section) []:ftp
' V! ]/ z' Z$ _) y; R) p; j
Common Name (eg, your name or your server's hostname) []:ftp.junjie.com
1 c- ]% e8 ]8 P5 j7 @3 w; h
. L3 m* U; z# e5 M( c$ OEmail Address []:ftp@junjie.com
/ W% \, f# L+ o' m
6 W* K" _) i0 [; u* pPlease enter the following 'extra' attributes

to be sent with your certificate request
' b+ E, J! P7 }2 W- q5 w
- V( G5 _! c+ a, M! KA challenge password []:

, d6 [  K5 N8 C4 g2 {An optional company name []:
' O5 c. Q* s8 P+ w7 B! B
: h4 {2 E' t. H2 Q  q[root@ftp certs]# openssl ca -in vsftpd.csr -out vsftpd.crt
Using configuration from /etc/pki/tls/openssl.cnf
0 \. b* {; u. d9 L2 H2 y
& L0 C* ~% ]+ S# a6 k. eCheck that the request matches the signature
& h' Z2 f  _* d. R
$ V9 b/ o# H! |/ k* l; v" g( r9 QSignature ok
Certificate Details:
( @& z9 K$ R, W. Q! ?
        Serial Number: 1 (0x1)
        Validity
9 }$ y6 f& @: L; b            Not Before: Feb 10 15:48:55 2012 GMT

2 O/ U5 }5 T$ u+ |9 K2 o            Not After : Feb 9 15:48:55 2013 GMT
  Q( }$ E( y  w1 d. ~: D% y        Subject:
4 t: S2 f% n$ ?* }! G% q8 R            countryName               = cn
3 P, I6 K+ U# ]0 W/ f            stateOrProvinceName       = henan
( N! \0 L6 U4 Q, [) p# ]! J            organizationName          = junjie
) F5 r9 M1 y8 V+ H* [            organizationalUnitName    = ftp
' @1 L$ Z) |, C/ ^  H            commonName                = ftp.junjie.com
            emailAddress              = junjie@junjie.com
        X509v3 extensions:
1 X& U% k8 x7 x            X509v3 Basic Constraints:
                CA:FALSE
3 Y& B* D# _+ `+ M! S* \, M            Netscape Comment:
1 v5 E! w4 ^! |! [$ u2 }% C& Z                OpenSSL Generated Certificate
# C0 S& _! d3 U  Y5 y            X509v3 Subject Key Identifier:
                33:C5:01:33:A5:CF:42:9F:24:A9:0D:E9:41:8E:26:C3:1B:7B:18:11
5 b5 I- S9 E7 n/ N. M4 \5 \4 W% F3 t
( l" I4 T5 L( e' f# b' L+ h            X509v3 Authority Key Identifier:
                keyid:501:A8:0A:1F:B7:CD:49:94:69:E3:70:E9:AE:93:73:2C:94:66:AC


Certificate is to be certified until Feb 9 15:48:55 2013 GMT (365 days)

) V4 \2 |0 C5 d3 aSign the certificate? [y/n]:y
& ]! S* e' ^5 G


! L( I% G* t/ W- o3 k( ]1 F1 out of 1 certificate requests certified, commit? [y/n]y
0 x1 M# X/ o1 E3 m" Q& {
" V- t4 X3 N; r* kWrite out database with 1 new entries

Data Base Updated
. Y& h% c4 V* A; M6 o& }2 d9 D[root@ftp certs]# ll
[root@ftp certs]# chmod 600 *
4 s8 P( ~# ]% f$ ]) Q$ W- F3 S[root@ftp certs]# ll
④.使ftp服务应用证书：
( J$ k$ I7 @$ r5 h. i3 V
[root@ftp certs]# cd /etc/vsftpd/            
[root@ftp vsftpd]# vim vsftpd.conf         #增加以下内容
7 z( H9 Z! P1 T) T( Y3 B118 rsa_cert_file=/etc/vsftpd/certs/vsftpd.crt
2 |8 p* C% w4 [; g& o4 }# u( ?9 b
119 rsa_private_key_file=/etc/vsftpd/certs/vsftpd.key

120 force_local_data_ssl=YES
121 force_local_logins_ssl=YES
2 c2 x1 F- t% }$ H4 R1 g122 ssl_enable=YES
123 ssl_sslv2=YES
124 ssl_sslv3=YES
3 X; o- |( v; }! _$ |! y0 D: X' s4 L125 ssl_tlsv1=YES
5 B8 v# t4 L* ^& Z$ c  q[root@ftp vsftpd]# service vsftpd restart

Shutting down vsftpd:                                      [ OK ]
" i* Z  Y, K3 U0 I* jStarting vsftpd for vsftpd:                                [ OK ]
⑤客户端测试（已加密传输）：

# s- U/ I2 r2 [& P2 t, E5 \
$ k9 x4 D. I* B

$ x7 H# i$ ]2 t$ i6 {
0 x$ p# J1 Z0 |* |9 k' i从上面看出证书名称出现问题，但可是可以使用！选择接收一次！

  D5 U7 Z3 d& h$ ^; S: u5 M! @- y
1 r0 i4 g! F6 U. _7 P
1 x& n% n9 U& g3 `' w: `0 w/ f0 s该次登录抓包内容如下所示：传输已经经过加密！
# z( R3 f: A. V) D[root@ftp ~]# tshark -ni eth0 -R "tcp.dstport eq 21"

9 z) F. W& Z5 b" b6 q. X4 s* v
. ^! C! g3 Y: L& n
[root@ftp ~]# tshark -ni eth0 -R "tcp.dstport eq 21"

' P: N$ w0 l+ h  z- c8 SRunning as user "root" and group "root". This could be dangerous.

: d  N* Q) t9 t# RCapturing on eth0

$ g, P% |; T+ g+ {9 d" b' @" B 9.742109 192.168.101.113 -> 192.168.101.210 TCP 52572 > 21 [SYN] Seq=0 Win=8192 Len=0 MSS=1460 WS=2

; y# Z; s8 C1 l) R4 l 9.742144 192.168.101.113 -> 192.168.101.210 TCP 52572 > 21 [ACK] Seq=1 Ack=1 Win=65700 Len=0

9.747458 192.168.101.113 -> 192.168.101.210 FTP Request: AUTH SSL

9.755605 192.168.101.113 -> 192.168.101.210 FTP Request: \200\310\001\003\001\000\237\000\000\000 \000\300\024\000\300

, Z" v# C& h$ @, R  _; h 9.758795 192.168.101.113 -> 192.168.101.210 FTP Request: \026\003\001\000\206\020\000\000\202\000\200n\257\315\204\324o
# q( y. T# a% K0 I
0 ~# Y/ m' l' ^. B0 l  G' I3 y+ [ 9.778662 192.168.101.113 -> 192.168.101.210 FTP Request: \027\003\001\000\030\215\325t\357\277\001\376FZ\243D\373\003\367\231\207Q\324\003Q}/\335\025\027\003\001\000 \f\355b\270\355\325\020[\372\302s{^\375\307\364C\307\243\251v9\370\364\260\277\253\317\321gB]

6 O1 F2 z4 l( P1 e$ Z0 \1 c 9.779885 192.168.101.113 -> 192.168.101.210 FTP Request: \027\003\001\000\030\324\000\267\312\0320\213\266y\311\025[\371\275?\254Y\257\024[\245vjM\027\003\001\000(\236\321\221Z\321Z(\316'\343.\235?\321=8\264b\270(j\336\231\210\265\207K\223A\037"\277\251\252t\252a`\374
; Y: F5 \3 K' T
9.782153 192.168.101.113 -> 192.168.101.210 FTP Request: \027\003\001\000\030\257d\313mXZT\356\2366\334q\223\017gt\371\232\207\226\325
  [: H2 I7 t: V6 o
9.793165 192.168.101.113 -> 192.168.101.210 FTP Request: \027\003\001\000\0301\020S\237\372\210\004N4\370\366\377\2213m\356\233w:\275)>@%\027\003\001\000 Y\032\275BM=3J\313\240\241\372Z\371@\335\262\252\240\235\021\345\271\305\223\211\020\340\332\323Q\251
+ V) h0 u" [, ?, f0 B3 w! b1 C
9.795630 192.168.101.113 -> 192.168.101.210 FTP Request: \027\003\001\000\030\302\016=LR\272\030{\034\277V\256]\230\247\363\355M\241\327U\207k\032\027\003\001\000 OYi\216=S\322\212)\271V\016\2519w\332f\213\222S\244\275M\316\025N\302:k\312b\331
: |8 V9 v+ Q( P0 T+ M, x
9.796727 192.168.101.113 -> 192.168.101.210 TCP 52572 > 21 [ACK] Seq=741 Ack=1260 Win=64440 Len=0

9 R) T+ h- q. G4 z* w3 E 9.797542 192.168.101.113 -> 192.168.101.210 TCP 52572 > 21 [ACK] Seq=741 Ack=1334 Win=64364 Len=0
$ ^/ s% H! G+ V% ^) J% r$ I
* |( ]6 ~" o- Y 9.798327 192.168.101.113 -> 192.168.101.210 TCP 52572 > 21 [ACK] Seq=741 Ack=1408 Win=64292 Len=0
7 @( s7 V+ p2 R) c& v
& c# Z% S! v0 z& p8 P. s; v4 ` 9.798775 192.168.101.113 -> 192.168.101.210 TCP 52572 > 21 [ACK] Seq=741 Ack=1482 Win=65700 Len=0

9.799387 192.168.101.113 -> 192.168.101.210 TCP 52572 > 21 [ACK] Seq=741 Ack=1564 Win=65616 Len=0
1 v# ^( p( {8 d' K- A4 W' c
9.799910 192.168.101.113 -> 192.168.101.210 TCP 52572 > 21 [ACK] Seq=741 Ack=1638 Win=65544 Len=0

9.805078 192.168.101.113 -> 192.168.101.210 FTP Request: \027\003\001\000\030G}\305\210\021s\244q\023k=\345R\232A\366B\360\202\320\361(x\344\027\003\001\000 \351W\350\377\362\2756\334\303\035+1l|{\304\277\224\326n\036d\213\217\b\216\023N\225\003a\274

3 t7 o, T, I% @* x* p2 @/ F9 d 9.810763 192.168.101.113 -> 192.168.101.210 FTP Request: \027\003\001\000\030\203\354F\302\253\205\212\355\334$\321=\303h\276\302\350\320.\346\223\337BG\027\003\001\000 73\027\372#\232

3 z% A% ~! |; h" {+ E# R3 N% j 9.813350 192.168.101.113 -> 192.168.101.210 FTP Request: \027\003\001\000\030\203x`k\337RM\341w\022N\255|f\260U ?\354)A\301^\251\027\003\001\000 \031`\366\364He\030\266z)\373\265\237\261\3430\220\331\340Kv[\033\347\tXj\344\314\236\242
0 i9 ?1 |. @' O' y2 e; ~8 r$ ^
9.814073 192.168.101.113 -> 192.168.101.210 FTP Request: \027\003\001\000\030\307\2126sY\a\237\034\321\277!j\320\213\235\032\277e\345\361E>|)\027\003\001\000 \256\304}:-\365\034\aD~\fk`]\314\b\207\365-\217\305\244

0 |( C# c# g/ r, o 9.838659 192.168.101.113 -> 192.168.101.210 FTP Request: \027\003\001\000\030\300\272t&\t(\262\243\361\210\263\343\326\261\017$\317V\002\354\325\271\250\366\027\003\001\000 \350F\305\360\363\365\033\274W\207M\006\216\255\016\365\205z\033\002\032B\345,\3712\034\377\327[\272P

2 l3 G. x$ p7 t8 \. f 9.851675 192.168.101.113 -> 192.168.101.210 TCP 52572 > 21 [ACK] Seq=1071 Ack=2041 Win=65140 Len=0
% o7 ?3 ~5 n9 z' I; d0 U9 }
9.856073 192.168.101.113 -> 192.168.101.210 FTP Request: \027\003\001\000\030\f\357\000E/\372\333\247\016\344\315\345\346\271L\327\214CE0*i\316\332\027\003\001\000(8\220\341\316.*\234dM\235
1 ^+ r* {3 J8 H+ m, T
10.061779 192.168.101.113 -> 192.168.101.210 TCP 52572 > 21 [ACK] Seq=1145 Ack=2094 Win=65088 Len=0

  e0 A7 v7 b2 S! z% M- s3 ?  S 39.978110 192.168.101.113 -> 192.168.101.210 FTP Request: \027\003\001\000\030=\032\322\022\216B\025O\016\034
% f6 u" Z& L2 C
39.980672 192.168.101.113 -> 192.168.101.210 TCP 52572 > 21 [FIN, ACK] Seq=1211 Ack=2139 Win=65040 Len=0
8 b: {. |* v0 h! q+ b' ]! _
39.980725 192.168.101.113 -> 192.168.101.210 TCP 52572 > 21 [RST, ACK] Seq=1212 Ack=2149 Win=0 Len=0
- @* F0 `0 @  K2 V" i2 _
27 packets captured

[root@ftp ~]#