FTPS（FTP+SSL）

admin

FTPS（FTP+SSL）
9 n$ r4 f$ L4 J- J% n. _
   ftps是一种多传输协议，相当于加密版的FTP。当你在FTP服务器上收发文件的时候，你面临两个风险。第一个风险是在上载文件的时候为文件加密。第二个风险是，这些文件在你等待接收方下载的时候将停留在FTP服务器上，这时你如何保证这些文件的安全。你的第二个选择(创建一个支持SSL的FTP服务器)能够让你的主机使用一个FTPS连接上载这些文件。这包括使用一个在FTP协议下面的SSL层加密控制和数据通道。一种替代FTPS的协议是安全文件传输协议(SFTP)。这个协议使用SSH文件传输协议加密从客户机到服务器的FTP连接。
2 j8 t6 K- o3 e  e2 J: h2 c

FTPS是在安全套接层使用标准的FTP协议和指令的一种增强型TFP协议，为FTP协议和数据通道增加了SSL安全功能。FTPS也称作“FTP-SSL”和“FTP-over-SSL”。SSL是一个在客户机和具有SSL功能的服务器之间的安全连接中对数据进行加密和解密的协议。

( E3 J3 `: O; b3 M
和sftp连接方法类似，在windows中可以使用FileZilla等传输软件来连接FTPS进行上传，下载文件，建立，删除目录等操作,在FileZilla连接时，有显式和隐式TLS/SSL连接之分，连接时也有指纹提示。


2 [7 ~; ]6 L* r8 |6 Y5 f
8 `' f" Y$ a, |2 z" z/ V: Q安全：ftps ftp+ssl
( i9 R3 P) r; C% L
准备工作：

准备一:关闭防火墙；

准备二：挂载光盘；
: U+ ?9 p& G/ L$ z9 M8 @2 \
6 K+ R9 _8 c% }! V* d5 w准备三：构建本地yum服务器。
% L! ?2 w( b- Z# l9 m4 V* P9 C
& i: d% ^4 u* v4 d/ SFTP+SSL配置详细过程:

①.安装配置FTP服务器和抓包工具：（ftp：192.168.101.210）
" V, G  p: a2 o4 o! l( \" |2 d
[root@ftp ~]# yum list all |grep vsftpd
. Z' E' f& ]1 H3 X, n  i# E6 Z[root@ftp ~]# yum install -y vsftpd
# h' [: X1 e( g& m
7 ^9 j  I4 w! ~3 s$ o[root@ftp ~]# yum list all |grep wireshark
$ c& p- J, @) A
[root@ftp ~]# yum install -y wireshark

; [, w: U" N9 H. Y6 x[root@ftp ~]# useradd user1
[root@ftp ~]# echo "123" |passwd --stdin user1
5 s. R. |9 T: ^! C! o; F- o6 l* j3 ~
[root@ftp ~]# service vsftpd start
4 S) K0 D( I2 |- ]1 Y
$ ]) I1 F! l# T0 S# z* b$ g4 T; NStarting vsftpd for vsftpd:                                [ OK ]
6 h4 |, @9 m8 r' _2 M9 r; g
+ U4 f  M- t3 e6 `
6 l9 l1 @0 h0 [# b; b. `$ ~$ T[root@ftp ~]# tshark -ni eth0 -R "tcp.dstport eq 21"


) J% S& Y0 p+ {. g* \
②.配置本地CA证书服务器：
# ~, X& \* P( _& d4 Y, i- B9 J
[root@ftp ~]# cd /etc/pki/
  y8 }+ W3 a* z4 ?% R2 r$ N) w[root@ftp pki]# ll
[root@ftp pki]# vim tls/openssl.cnf
45 dir             = /etc/pki/CA
88 countryName             = optional
! L: w# }0 h5 W! S# D. R  z8 M6 ~  [2 q# w
89 stateOrProvinceName     = optional

% l  |0 r( o6 T( @" X4 ~90 organizationName        = optional

[root@ftp pki]# cd CA/
[root@ftp CA]# mkdir certs newcerts crl
[root@ftp CA]# touch index.txt serial
[root@ftp CA]# echo "01" >serial

[root@ftp CA]# ll
[root@ftp CA]# openssl genrsa 1024 > private/cakey.pem

# g$ s* ?+ X, Q+ U9 UGenerating RSA private key, 1024 bit long modulus
0 S- ^! s$ h: e7 f' O; b, Z
$ E! N" p/ ]' w3 g6 U...........++++++
....++++++
1 F! Y, Q! Z' G0 o) Te is 65537 (0x10001)
6 ]1 f/ F4 b: E, i% E
[root@ftp CA]# chmod 600 private/cakey.pem
[root@ftp CA]# ll private/cakey.pem
-rw------- 1 root root 887 Feb 10 23:22 private/cakey.pem
[root@ftp CA]# openssl req -new -x509 -key private/cakey.pem -out cacert.pem -days 3650

3 L, g5 z: _/ U  ^You are about to be asked to enter information that will be incorporated
* S+ h. `% H( F# t! Q& B& L
into your certificate request.

( t( V% L+ y( ^3 ^" pWhat you are about to enter is what is called a Distinguished Name or a DN.

There are quite a few fields but you can leave some blank
) \1 J$ q8 e: d' f; E. }+ E( e3 ?
For some fields there will be a default value,
2 q8 L3 {* D; ~3 i6 b; w# p
" m) }8 D5 T6 B- g& Z# ZIf you enter '.', the field will be left blank.
1 ]+ M, P6 Q# q' m
-----
% K2 V! m  \- U5 _; I/ fCountry Name (2 letter code) [GB]:cn
7 A" A+ n" J: |$ [2 ~! Q& A
State or Province Name (full name) [Berkshire]:henan

& O0 @$ d# ]* lLocality Name (eg, city) [Newbury]:zhengzhou

0 g" X! S$ ]+ uOrganization Name (eg, company) [My Company Ltd]:junjie

( B' k8 J' S3 m2 @' s6 p7 G( k$ HOrganizational Unit Name (eg, section) []:soft
8 E0 U. A* G" K4 L
Common Name (eg, your name or your server's hostname) []:ca.junjie.com
- b# a' Y' `9 p7 ?  M
9 L+ c9 x" o/ |4 h' \& z* c0 FEmail Address []:junjie@junjie.com
4 }: c" W& g3 L[root@ftp CA]#ll
3 b  @' T$ r& k  L  Z& }③.为ftp服务器创建证书：

/ h* d3 r& A, g[root@ftp CA]# mkdir /etc/vsftpd/certs
# C6 @1 m) }9 N. c[root@ftp CA]# cd /etc/vsftpd/certs
/ F3 B9 R6 ^  j6 N) F[root@ftp certs]# openssl genrsa 1024 >vsftpd.key
3 D1 D& u4 \' l8 OGenerating RSA private key, 1024 bit long modulus
' M" t! ~( i# z- @2 c
....++++++
! W$ e' R9 w3 B) M/ }* r$ ^$ N9 k...++++++
( z3 \, _" n$ l! o( V) Ye is 65537 (0x10001)

[root@ftp certs]# openssl req -new -key vsftpd.key -out vsftpd.csr
9 w5 N  O9 W3 i( {' V2 F+ z
* O; B+ r9 O8 G8 P& h5 WYou are about to be asked to enter information that will be incorporated

0 m/ K0 L8 }7 F$ t0 m+ Ainto your certificate request.

What you are about to enter is what is called a Distinguished Name or a DN.

There are quite a few fields but you can leave some blank

/ j; {) s% O6 T, M5 OFor some fields there will be a default value,

If you enter '.', the field will be left blank.
& ~  d1 [) x7 Y; Y" B$ K6 d5 N
-----
5 H, `( `* @7 i( l# [0 R1 JCountry Name (2 letter code) [GB]:cn
& ]6 |5 \0 |* M9 m4 L  ]6 N
$ H1 Y  b, U$ i- K9 rState or Province Name (full name) [Berkshire]:henan

Locality Name (eg, city) [Newbury]:zhengzhou
! S) s, u: B8 O; `2 Y/ F+ I
+ v/ s5 v# d# v' [  \' z8 IOrganization Name (eg, company) [My Company Ltd]:junjie

Organizational Unit Name (eg, section) []:ftp

Common Name (eg, your name or your server's hostname) []:ftp.junjie.com

Email Address []:ftp@junjie.com
* I) e* F2 @! |3 x6 A. d3 i4 n
5 o3 L0 Q% E8 ~3 p) w& @1 E; [Please enter the following 'extra' attributes
- {2 i- ^9 q2 y4 c3 O/ d
to be sent with your certificate request

A challenge password []:

+ C- m1 {( f( x& f" p8 @4 GAn optional company name []:
8 L" F9 Y8 \" E- p0 ?1 X( D
& Z/ `2 Y/ L( C) o& S3 ?9 U[root@ftp certs]# openssl ca -in vsftpd.csr -out vsftpd.crt
Using configuration from /etc/pki/tls/openssl.cnf
- W; b9 Q1 w- d: G, d* J
. [( C+ h; W1 R; x0 y; sCheck that the request matches the signature
- o2 B1 I' d4 w7 b: M
7 w2 U. B7 o5 k" O& `+ z) ISignature ok
. X4 j5 `' m" Y- lCertificate Details:
7 K  ?7 M& Z( |
        Serial Number: 1 (0x1)
0 |1 j7 X& c, Y1 ^+ M- T        Validity
            Not Before: Feb 10 15:48:55 2012 GMT
& D0 I1 P$ g6 u0 X1 Z+ R' w
5 B, M7 w+ k5 B$ M/ o! V7 ^            Not After : Feb 9 15:48:55 2013 GMT
+ b1 u* z# a: Y; B        Subject:
8 L0 n% }9 j/ d$ t, Y2 g* E            countryName               = cn
            stateOrProvinceName       = henan
            organizationName          = junjie
! ]- G3 X# C- I1 X" f. D/ X            organizationalUnitName    = ftp
            commonName                = ftp.junjie.com
& I4 G) @& v/ Y  h/ m            emailAddress              = junjie@junjie.com
        X509v3 extensions:
! R1 x3 e" W* I            X509v3 Basic Constraints:
7 y2 P# T2 }  x" u) N+ _8 p/ U/ R) t                CA:FALSE
            Netscape Comment:
                OpenSSL Generated Certificate
8 A3 I, J. i* c" Y: W* {; C' ]% t1 t            X509v3 Subject Key Identifier:
                33:C5:01:33:A5:CF:42:9F:24:A9:0D:E9:41:8E:26:C3:1B:7B:18:11

4 C) ^' `: `; w            X509v3 Authority Key Identifier:
                keyid:501:A8:0A:1F:B7:CD:49:94:69:E3:70:E9:AE:93:73:2C:94:66:AC

, D& i# X2 ^# x0 B* M( k  Z, l2 ^! I
$ X, m/ i) M- s: z: _5 v% p6 aCertificate is to be certified until Feb 9 15:48:55 2013 GMT (365 days)
8 `5 v5 l* M6 P. r) j4 X) c
, L( c2 F; Z3 m/ V% U  }. s* PSign the certificate? [y/n]:y



9 @' l! r- b% x) w# i1 out of 1 certificate requests certified, commit? [y/n]y
. s' O5 l8 s( z7 p, I6 f4 c: \- z( s
6 V% o' g+ f/ @9 r9 I0 Z9 [Write out database with 1 new entries
' G3 K% W: Q+ \
) X8 e" E; p. s! P6 I7 J; ?Data Base Updated
  ]  s, A3 L. r+ }6 y7 M[root@ftp certs]# ll
[root@ftp certs]# chmod 600 *
[root@ftp certs]# ll
④.使ftp服务应用证书：

[root@ftp certs]# cd /etc/vsftpd/            
( K) o9 P( t4 f$ Q[root@ftp vsftpd]# vim vsftpd.conf         #增加以下内容
118 rsa_cert_file=/etc/vsftpd/certs/vsftpd.crt

% A5 Q/ X5 D0 N# v, }& X0 H" w: C119 rsa_private_key_file=/etc/vsftpd/certs/vsftpd.key
; J( s# g- @# a
" Z4 N3 ]$ y+ q5 Z7 |120 force_local_data_ssl=YES
$ x; j! f7 [3 u4 A5 g9 x121 force_local_logins_ssl=YES
+ P) t: P8 f* c% e* r4 ^8 X/ r122 ssl_enable=YES
123 ssl_sslv2=YES
124 ssl_sslv3=YES
125 ssl_tlsv1=YES
6 ^/ O9 y" V1 G' @" A) N2 i[root@ftp vsftpd]# service vsftpd restart
+ \/ `* L$ A. P* h% m
) i4 \7 {! S! _& @" E, e4 ?Shutting down vsftpd:                                      [ OK ]
Starting vsftpd for vsftpd:                                [ OK ]
⑤客户端测试（已加密传输）：
0 F/ R) o7 x% G$ f, C  h0 }
8 `6 @* K( o' `: ]( z

1 g. A* E4 G& V
  V' p3 [. n# P/ V  Q8 }+ E
从上面看出证书名称出现问题，但可是可以使用！选择接收一次！


  N% h& q6 b9 b' v3 a3 e
该次登录抓包内容如下所示：传输已经经过加密！
4 t. w! f( `7 ?& e  @[root@ftp ~]# tshark -ni eth0 -R "tcp.dstport eq 21"
" V# C$ K" Q8 V* L. z


  H2 N6 O" M, h2 H6 ~0 a[root@ftp ~]# tshark -ni eth0 -R "tcp.dstport eq 21"
8 Z+ G2 B. H  t  _: n  m
1 i/ I2 S5 V, K# B; vRunning as user "root" and group "root". This could be dangerous.
/ r4 ?, V3 D4 H3 L4 s- u
4 D1 w8 P1 z; x; ?3 kCapturing on eth0
! {, \! m- O' y9 O; ?- G
" e1 ^! R- L2 \) [) U5 S 9.742109 192.168.101.113 -> 192.168.101.210 TCP 52572 > 21 [SYN] Seq=0 Win=8192 Len=0 MSS=1460 WS=2

5 n; i( f3 F; L3 m& ?2 _ 9.742144 192.168.101.113 -> 192.168.101.210 TCP 52572 > 21 [ACK] Seq=1 Ack=1 Win=65700 Len=0
, H  w$ I# \4 h  c- N
9.747458 192.168.101.113 -> 192.168.101.210 FTP Request: AUTH SSL
" O% A: |4 t$ f6 e$ c  ?. F3 W1 M
9.755605 192.168.101.113 -> 192.168.101.210 FTP Request: \200\310\001\003\001\000\237\000\000\000 \000\300\024\000\300
1 C0 a. n5 |3 [. }" f" t
9.758795 192.168.101.113 -> 192.168.101.210 FTP Request: \026\003\001\000\206\020\000\000\202\000\200n\257\315\204\324o
, E2 d0 Q% `( d  {7 \, v
9.778662 192.168.101.113 -> 192.168.101.210 FTP Request: \027\003\001\000\030\215\325t\357\277\001\376FZ\243D\373\003\367\231\207Q\324\003Q}/\335\025\027\003\001\000 \f\355b\270\355\325\020[\372\302s{^\375\307\364C\307\243\251v9\370\364\260\277\253\317\321gB]

7 e6 t: G% R: p4 a' l 9.779885 192.168.101.113 -> 192.168.101.210 FTP Request: \027\003\001\000\030\324\000\267\312\0320\213\266y\311\025[\371\275?\254Y\257\024[\245vjM\027\003\001\000(\236\321\221Z\321Z(\316'\343.\235?\321=8\264b\270(j\336\231\210\265\207K\223A\037"\277\251\252t\252a`\374

) W/ E6 N9 ?: {, t3 Z2 j' ? 9.782153 192.168.101.113 -> 192.168.101.210 FTP Request: \027\003\001\000\030\257d\313mXZT\356\2366\334q\223\017gt\371\232\207\226\325

9.793165 192.168.101.113 -> 192.168.101.210 FTP Request: \027\003\001\000\0301\020S\237\372\210\004N4\370\366\377\2213m\356\233w:\275)>@%\027\003\001\000 Y\032\275BM=3J\313\240\241\372Z\371@\335\262\252\240\235\021\345\271\305\223\211\020\340\332\323Q\251
4 I; H( D& X3 @! |
! u- K: P" T! n0 }. n/ |0 n 9.795630 192.168.101.113 -> 192.168.101.210 FTP Request: \027\003\001\000\030\302\016=LR\272\030{\034\277V\256]\230\247\363\355M\241\327U\207k\032\027\003\001\000 OYi\216=S\322\212)\271V\016\2519w\332f\213\222S\244\275M\316\025N\302:k\312b\331
0 t1 T: l8 W# L; |
. b: ^& }: o/ w5 R 9.796727 192.168.101.113 -> 192.168.101.210 TCP 52572 > 21 [ACK] Seq=741 Ack=1260 Win=64440 Len=0
% `5 V$ Z. _/ ]
* f/ v/ `+ o- ?1 \ 9.797542 192.168.101.113 -> 192.168.101.210 TCP 52572 > 21 [ACK] Seq=741 Ack=1334 Win=64364 Len=0
6 {: E4 H# D% J7 ?  H
9.798327 192.168.101.113 -> 192.168.101.210 TCP 52572 > 21 [ACK] Seq=741 Ack=1408 Win=64292 Len=0
. Z1 s3 X. o3 I
+ V/ x- g. d+ o  N3 t# ~* I1 m 9.798775 192.168.101.113 -> 192.168.101.210 TCP 52572 > 21 [ACK] Seq=741 Ack=1482 Win=65700 Len=0
, q. v# Y" G; ]7 {+ G
9.799387 192.168.101.113 -> 192.168.101.210 TCP 52572 > 21 [ACK] Seq=741 Ack=1564 Win=65616 Len=0

9.799910 192.168.101.113 -> 192.168.101.210 TCP 52572 > 21 [ACK] Seq=741 Ack=1638 Win=65544 Len=0
7 s8 k$ R6 a9 X. ]* K4 X8 `, j  q
9.805078 192.168.101.113 -> 192.168.101.210 FTP Request: \027\003\001\000\030G}\305\210\021s\244q\023k=\345R\232A\366B\360\202\320\361(x\344\027\003\001\000 \351W\350\377\362\2756\334\303\035+1l|{\304\277\224\326n\036d\213\217\b\216\023N\225\003a\274
! r; m% V* n0 ]! ~% b- o; K
9 h6 \  t0 P7 }# R! Z% _ 9.810763 192.168.101.113 -> 192.168.101.210 FTP Request: \027\003\001\000\030\203\354F\302\253\205\212\355\334$\321=\303h\276\302\350\320.\346\223\337BG\027\003\001\000 73\027\372#\232
" `2 g; V" _! E2 H: P7 L0 [" t
' |* c6 L- S( r/ t 9.813350 192.168.101.113 -> 192.168.101.210 FTP Request: \027\003\001\000\030\203x`k\337RM\341w\022N\255|f\260U ?\354)A\301^\251\027\003\001\000 \031`\366\364He\030\266z)\373\265\237\261\3430\220\331\340Kv[\033\347\tXj\344\314\236\242

9.814073 192.168.101.113 -> 192.168.101.210 FTP Request: \027\003\001\000\030\307\2126sY\a\237\034\321\277!j\320\213\235\032\277e\345\361E>|)\027\003\001\000 \256\304}:-\365\034\aD~\fk`]\314\b\207\365-\217\305\244

9.838659 192.168.101.113 -> 192.168.101.210 FTP Request: \027\003\001\000\030\300\272t&\t(\262\243\361\210\263\343\326\261\017$\317V\002\354\325\271\250\366\027\003\001\000 \350F\305\360\363\365\033\274W\207M\006\216\255\016\365\205z\033\002\032B\345,\3712\034\377\327[\272P

- U/ X5 ?0 A* R" y' C, ~8 z# ]6 K 9.851675 192.168.101.113 -> 192.168.101.210 TCP 52572 > 21 [ACK] Seq=1071 Ack=2041 Win=65140 Len=0
; q* E4 i/ g6 Y" L# Z" S0 N9 b& k
9.856073 192.168.101.113 -> 192.168.101.210 FTP Request: \027\003\001\000\030\f\357\000E/\372\333\247\016\344\315\345\346\271L\327\214CE0*i\316\332\027\003\001\000(8\220\341\316.*\234dM\235
9 f. ^6 P& M$ v9 |8 k. J
10.061779 192.168.101.113 -> 192.168.101.210 TCP 52572 > 21 [ACK] Seq=1145 Ack=2094 Win=65088 Len=0
* N9 m1 x6 N9 C) G
39.978110 192.168.101.113 -> 192.168.101.210 FTP Request: \027\003\001\000\030=\032\322\022\216B\025O\016\034

8 Z: k2 J0 h" U/ R/ f9 W  `6 m 39.980672 192.168.101.113 -> 192.168.101.210 TCP 52572 > 21 [FIN, ACK] Seq=1211 Ack=2139 Win=65040 Len=0

39.980725 192.168.101.113 -> 192.168.101.210 TCP 52572 > 21 [RST, ACK] Seq=1212 Ack=2149 Win=0 Len=0

27 packets captured

5 @9 A* k8 ^; Y9 c0 Z' r) }[root@ftp ~]#