FTPS（FTP+SSL）

admin

FTPS（FTP+SSL）
0 O1 U2 b; n' y3 W4 `
7 F  J6 T, g  N! k8 Q0 T; a   ftps是一种多传输协议，相当于加密版的FTP。当你在FTP服务器上收发文件的时候，你面临两个风险。第一个风险是在上载文件的时候为文件加密。第二个风险是，这些文件在你等待接收方下载的时候将停留在FTP服务器上，这时你如何保证这些文件的安全。你的第二个选择(创建一个支持SSL的FTP服务器)能够让你的主机使用一个FTPS连接上载这些文件。这包括使用一个在FTP协议下面的SSL层加密控制和数据通道。一种替代FTPS的协议是安全文件传输协议(SFTP)。这个协议使用SSH文件传输协议加密从客户机到服务器的FTP连接。

: z1 D: c0 y8 U9 b' T2 E
FTPS是在安全套接层使用标准的FTP协议和指令的一种增强型TFP协议，为FTP协议和数据通道增加了SSL安全功能。FTPS也称作“FTP-SSL”和“FTP-over-SSL”。SSL是一个在客户机和具有SSL功能的服务器之间的安全连接中对数据进行加密和解密的协议。


+ o! Z3 I- R4 u# f和sftp连接方法类似，在windows中可以使用FileZilla等传输软件来连接FTPS进行上传，下载文件，建立，删除目录等操作,在FileZilla连接时，有显式和隐式TLS/SSL连接之分，连接时也有指纹提示。

% Q  d7 T0 W) r

0 S  v- E+ p2 i5 Y6 X安全：ftps ftp+ssl
, c$ P  |5 L; v( a8 _5 z* W; h
, z$ s/ R# c+ ?9 B7 E# v) M0 L准备工作：
( f1 e6 w: f6 I* x/ `3 K* O( y
准备一:关闭防火墙；
0 Q, J' L6 ?" ^/ S$ j9 n: I
, g( O1 D! e4 W' N. b2 D, m: t) A准备二：挂载光盘；

; j# t* p" w, _准备三：构建本地yum服务器。

FTP+SSL配置详细过程:
6 U$ R" A) L1 q6 ~! `; l
①.安装配置FTP服务器和抓包工具：（ftp：192.168.101.210）

[root@ftp ~]# yum list all |grep vsftpd
' W; r2 t( N& A) F[root@ftp ~]# yum install -y vsftpd
0 ?& F% a& ^5 p/ M
; ?# H! m; i# y. N" ?[root@ftp ~]# yum list all |grep wireshark
5 o' X, M3 \/ O- g9 V- S: V
% J) I3 k. Y0 O( `3 u1 i[root@ftp ~]# yum install -y wireshark

$ `8 u5 O% Q7 ]# E( Y[root@ftp ~]# useradd user1
[root@ftp ~]# echo "123" |passwd --stdin user1
0 Q6 C, s+ Y2 o
[root@ftp ~]# service vsftpd start

Starting vsftpd for vsftpd:                                [ OK ]
* ~5 w# E& V* ?: h( z  W7 K; B

% N2 V3 M) o( X& v+ |3 [1 i[root@ftp ~]# tshark -ni eth0 -R "tcp.dstport eq 21"
3 S1 o  n5 ~  d4 d! B7 w2 @


②.配置本地CA证书服务器：

[root@ftp ~]# cd /etc/pki/
[root@ftp pki]# ll
[root@ftp pki]# vim tls/openssl.cnf
  Q) U! b' M4 k; u" c5 i# i45 dir             = /etc/pki/CA
88 countryName             = optional
+ J. s+ O% J6 N* ]& J. E
89 stateOrProvinceName     = optional
; d+ o; @& C5 D2 ?; r6 `, l
90 organizationName        = optional
( q7 W6 x+ ?. W" K0 j* M* ]- j
[root@ftp pki]# cd CA/
$ X: ~3 u6 B) y8 r0 R; q[root@ftp CA]# mkdir certs newcerts crl
[root@ftp CA]# touch index.txt serial
, ]2 Q: l  d7 `4 L. G[root@ftp CA]# echo "01" >serial

[root@ftp CA]# ll
7 M# p% k  y/ B, k6 y* L[root@ftp CA]# openssl genrsa 1024 > private/cakey.pem
2 F: F) x! V( {" d
Generating RSA private key, 1024 bit long modulus

...........++++++
....++++++
e is 65537 (0x10001)

2 f7 x+ m! i" ~/ a% Z: E. N3 {[root@ftp CA]# chmod 600 private/cakey.pem
" g7 ?- z, T, O9 \; v[root@ftp CA]# ll private/cakey.pem
-rw------- 1 root root 887 Feb 10 23:22 private/cakey.pem
( w$ U; J( `7 m0 b+ Y! F[root@ftp CA]# openssl req -new -x509 -key private/cakey.pem -out cacert.pem -days 3650
$ r* p- z6 ?+ G
- w: c5 m8 K9 g- j% D/ gYou are about to be asked to enter information that will be incorporated
; L( _# l6 T5 @" ~' k
% n- r7 t" V! W8 {into your certificate request.
0 ~: l( l* G" _) Y9 {
What you are about to enter is what is called a Distinguished Name or a DN.

6 i' z4 F9 y9 N* l7 G. r  qThere are quite a few fields but you can leave some blank
& a( m6 B( W% Q6 t+ ~/ S& t
For some fields there will be a default value,
, A3 Y+ J& p2 j4 ?+ ]/ p  ~
4 k! K( C& _1 n3 I* a1 Q/ i" ZIf you enter '.', the field will be left blank.

# Y  S4 E" ^& {/ v" C- L-----
: J1 {$ v8 C4 Y) [6 B  m. H* Z$ @Country Name (2 letter code) [GB]:cn
3 U2 a2 {9 s- b" X, P
/ z$ u2 L4 j) D2 i' {3 I9 A. Z8 qState or Province Name (full name) [Berkshire]:henan
" ~9 ?2 z: J$ f$ c  l7 \; k
Locality Name (eg, city) [Newbury]:zhengzhou

Organization Name (eg, company) [My Company Ltd]:junjie
0 v# j9 ~2 Q$ H% b: l$ J
2 c4 _/ _( J; t7 ], h& oOrganizational Unit Name (eg, section) []:soft

Common Name (eg, your name or your server's hostname) []:ca.junjie.com
2 y  f3 G* g' A
Email Address []:junjie@junjie.com
[root@ftp CA]#ll
. v2 _2 i- s# h4 v7 |+ q  \' Z1 c③.为ftp服务器创建证书：
7 [* f6 D" P4 l% x1 B) O/ N* z
2 r* |; @. s, i% t$ e* N$ _, J, s[root@ftp CA]# mkdir /etc/vsftpd/certs
[root@ftp CA]# cd /etc/vsftpd/certs
[root@ftp certs]# openssl genrsa 1024 >vsftpd.key
Generating RSA private key, 1024 bit long modulus
: W7 M- h! I5 B) D
....++++++
& E% w! F8 z& ?5 U$ H...++++++
2 I  |! s. Q7 `' B7 O  xe is 65537 (0x10001)
' G3 _; L+ }, \  T$ C
; o3 _/ V) i0 |7 A# [* U[root@ftp certs]# openssl req -new -key vsftpd.key -out vsftpd.csr

% a5 S' N9 o/ d( HYou are about to be asked to enter information that will be incorporated

' L7 z9 `6 k9 Q9 `. a2 |into your certificate request.
& R1 f- F8 Z3 j4 P& W
What you are about to enter is what is called a Distinguished Name or a DN.

& f2 F2 N* Z* y1 s9 xThere are quite a few fields but you can leave some blank
7 R) A& [4 \0 S
( a4 }; f* }' n8 [; VFor some fields there will be a default value,

If you enter '.', the field will be left blank.
0 T; W/ U$ x8 `4 [
* Z8 q( I/ F) ^. F" R-----
Country Name (2 letter code) [GB]:cn

State or Province Name (full name) [Berkshire]:henan
3 P; X% Z. ?* p  a# J
  ?  a! ~5 X7 A$ |! vLocality Name (eg, city) [Newbury]:zhengzhou

Organization Name (eg, company) [My Company Ltd]:junjie

. m" G7 S3 T8 t2 b# |Organizational Unit Name (eg, section) []:ftp
; \8 @6 h. z$ }" @
Common Name (eg, your name or your server's hostname) []:ftp.junjie.com
5 G, X" W4 ^1 ^1 B7 v1 ~. |! ~
Email Address []:ftp@junjie.com
# V6 Q! ^# ^: s0 y9 e; \  j) r
) {6 j) c" c* B- P5 `) n8 ePlease enter the following 'extra' attributes
( r2 s6 A& K! Z" n1 }1 X
" A6 h5 f2 w/ b  z3 b- Uto be sent with your certificate request
. N6 [7 ~- i6 D, n1 \2 [
7 y  m  S  m; U( j& v; GA challenge password []:
* j# r* x; e, p" h: S' m7 E' h
2 Q+ d+ }+ {8 E  K! f7 TAn optional company name []:
  G4 K/ N% B. n, ^6 p3 g
) b% [" o: Q3 b  _: {[root@ftp certs]# openssl ca -in vsftpd.csr -out vsftpd.crt
Using configuration from /etc/pki/tls/openssl.cnf
/ X( _+ i' L) _" P9 x" Y( \0 g2 O
. Y" W& {1 ~1 l" L: u  U- _2 a* ?Check that the request matches the signature
2 q5 ?9 C: h: a  Z# Q+ Y
Signature ok
Certificate Details:
- @1 d. a; X8 _) j* s
$ T0 X+ p* a+ h7 ^% y6 G        Serial Number: 1 (0x1)
        Validity
$ ]/ U. H5 }- }            Not Before: Feb 10 15:48:55 2012 GMT

            Not After : Feb 9 15:48:55 2013 GMT
        Subject:
' u$ p4 I$ c' ]6 p7 Z2 G            countryName               = cn
            stateOrProvinceName       = henan
            organizationName          = junjie
            organizationalUnitName    = ftp
/ X: L( Y$ V4 n# O( O/ |2 S0 _. f            commonName                = ftp.junjie.com
            emailAddress              = junjie@junjie.com
        X509v3 extensions:
            X509v3 Basic Constraints:
$ }: \) u4 r- a- I                CA:FALSE
            Netscape Comment:
                OpenSSL Generated Certificate
! B. y& A# ~1 a0 `( C& c            X509v3 Subject Key Identifier:
: W7 s. S% r2 e' P% R  v; k8 u" t                33:C5:01:33:A5:CF:42:9F:24:A9:0D:E9:41:8E:26:C3:1B:7B:18:11
5 C* j9 k# r$ W; U
            X509v3 Authority Key Identifier:
& }9 ^* y4 k7 O3 I3 v! |. {                keyid:501:A8:0A:1F:B7:CD:49:94:69:E3:70:E9:AE:93:73:2C:94:66:AC
1 v7 i' o  X% n( A

3 T7 d" l; X) \Certificate is to be certified until Feb 9 15:48:55 2013 GMT (365 days)

Sign the certificate? [y/n]:y



6 V, ^, h$ u  x" Y. P$ x1 out of 1 certificate requests certified, commit? [y/n]y

Write out database with 1 new entries

Data Base Updated
[root@ftp certs]# ll
# c6 p8 s& c' f* c[root@ftp certs]# chmod 600 *
" u; v$ h0 ?' o6 Y9 A+ g[root@ftp certs]# ll
④.使ftp服务应用证书：

[root@ftp certs]# cd /etc/vsftpd/            
0 {9 w+ F+ P3 B" _0 z  ?) J0 g0 D[root@ftp vsftpd]# vim vsftpd.conf         #增加以下内容
118 rsa_cert_file=/etc/vsftpd/certs/vsftpd.crt

119 rsa_private_key_file=/etc/vsftpd/certs/vsftpd.key
6 ]* ~" W5 T2 A$ g* B- b
2 j1 b. |( `+ }  E  W7 H120 force_local_data_ssl=YES
121 force_local_logins_ssl=YES
122 ssl_enable=YES
7 e% g4 i& B+ p9 ]123 ssl_sslv2=YES
1 ~% B, ~' w& g1 |124 ssl_sslv3=YES
4 }4 P* d; [* ~/ Y6 \2 O125 ssl_tlsv1=YES
[root@ftp vsftpd]# service vsftpd restart

' o' `! i" F$ B8 c: `6 c4 wShutting down vsftpd:                                      [ OK ]
Starting vsftpd for vsftpd:                                [ OK ]
⑤客户端测试（已加密传输）：





从上面看出证书名称出现问题，但可是可以使用！选择接收一次！

" g1 ?( w  _0 L' |
: v+ a: _- }: [; b, n
该次登录抓包内容如下所示：传输已经经过加密！
% }/ |3 R5 S$ X8 `6 t[root@ftp ~]# tshark -ni eth0 -R "tcp.dstport eq 21"
* W) K$ B/ V8 p# P. E


5 Q  w$ {* R0 D* W( m; q1 R[root@ftp ~]# tshark -ni eth0 -R "tcp.dstport eq 21"

+ d: x0 _1 L9 B$ U1 e, R6 Q/ XRunning as user "root" and group "root". This could be dangerous.
) q$ F' y1 W5 x1 z
2 r0 v% `; z& r8 s2 `4 KCapturing on eth0

5 e5 I  i1 Q. A4 c) L 9.742109 192.168.101.113 -> 192.168.101.210 TCP 52572 > 21 [SYN] Seq=0 Win=8192 Len=0 MSS=1460 WS=2

3 Q1 [2 |4 r% s! W* N7 y, E) O' C; z 9.742144 192.168.101.113 -> 192.168.101.210 TCP 52572 > 21 [ACK] Seq=1 Ack=1 Win=65700 Len=0

9 G5 w, a, R& J8 P 9.747458 192.168.101.113 -> 192.168.101.210 FTP Request: AUTH SSL
; x& a; s) Q2 {
- N# I# F% _: i6 W 9.755605 192.168.101.113 -> 192.168.101.210 FTP Request: \200\310\001\003\001\000\237\000\000\000 \000\300\024\000\300

1 Y/ q3 b/ [& k' F9 x4 f 9.758795 192.168.101.113 -> 192.168.101.210 FTP Request: \026\003\001\000\206\020\000\000\202\000\200n\257\315\204\324o

9.778662 192.168.101.113 -> 192.168.101.210 FTP Request: \027\003\001\000\030\215\325t\357\277\001\376FZ\243D\373\003\367\231\207Q\324\003Q}/\335\025\027\003\001\000 \f\355b\270\355\325\020[\372\302s{^\375\307\364C\307\243\251v9\370\364\260\277\253\317\321gB]
0 b: k* _5 q6 D# r
3 Y5 ^* Q0 s8 t) H' g# N 9.779885 192.168.101.113 -> 192.168.101.210 FTP Request: \027\003\001\000\030\324\000\267\312\0320\213\266y\311\025[\371\275?\254Y\257\024[\245vjM\027\003\001\000(\236\321\221Z\321Z(\316'\343.\235?\321=8\264b\270(j\336\231\210\265\207K\223A\037"\277\251\252t\252a`\374
5 B# r8 d! N7 I/ a" g9 c
! `4 @2 }. }) T- Z+ T 9.782153 192.168.101.113 -> 192.168.101.210 FTP Request: \027\003\001\000\030\257d\313mXZT\356\2366\334q\223\017gt\371\232\207\226\325

% s" L( N, F; N$ r6 l: X* Z/ T 9.793165 192.168.101.113 -> 192.168.101.210 FTP Request: \027\003\001\000\0301\020S\237\372\210\004N4\370\366\377\2213m\356\233w:\275)>@%\027\003\001\000 Y\032\275BM=3J\313\240\241\372Z\371@\335\262\252\240\235\021\345\271\305\223\211\020\340\332\323Q\251
, E5 F2 c. d* w+ ^5 y1 v  N
# s( U* P8 \' ?8 z 9.795630 192.168.101.113 -> 192.168.101.210 FTP Request: \027\003\001\000\030\302\016=LR\272\030{\034\277V\256]\230\247\363\355M\241\327U\207k\032\027\003\001\000 OYi\216=S\322\212)\271V\016\2519w\332f\213\222S\244\275M\316\025N\302:k\312b\331

. ]0 C% @9 l. H1 X8 O6 C$ j 9.796727 192.168.101.113 -> 192.168.101.210 TCP 52572 > 21 [ACK] Seq=741 Ack=1260 Win=64440 Len=0

, z. k8 o9 i3 [; v5 x 9.797542 192.168.101.113 -> 192.168.101.210 TCP 52572 > 21 [ACK] Seq=741 Ack=1334 Win=64364 Len=0
$ g( u% k5 w3 W# D
9.798327 192.168.101.113 -> 192.168.101.210 TCP 52572 > 21 [ACK] Seq=741 Ack=1408 Win=64292 Len=0
( Q* y+ s6 B5 ~7 n7 Z. t# k
# M" r8 \( A$ D! G  U& L 9.798775 192.168.101.113 -> 192.168.101.210 TCP 52572 > 21 [ACK] Seq=741 Ack=1482 Win=65700 Len=0

; k6 W1 O% ?: z; N/ ^, V! F 9.799387 192.168.101.113 -> 192.168.101.210 TCP 52572 > 21 [ACK] Seq=741 Ack=1564 Win=65616 Len=0

9.799910 192.168.101.113 -> 192.168.101.210 TCP 52572 > 21 [ACK] Seq=741 Ack=1638 Win=65544 Len=0

% i( Q8 P$ Y& o( Q5 y7 l. n 9.805078 192.168.101.113 -> 192.168.101.210 FTP Request: \027\003\001\000\030G}\305\210\021s\244q\023k=\345R\232A\366B\360\202\320\361(x\344\027\003\001\000 \351W\350\377\362\2756\334\303\035+1l|{\304\277\224\326n\036d\213\217\b\216\023N\225\003a\274
! \- s% W6 q. e) _8 l& J% u
9.810763 192.168.101.113 -> 192.168.101.210 FTP Request: \027\003\001\000\030\203\354F\302\253\205\212\355\334$\321=\303h\276\302\350\320.\346\223\337BG\027\003\001\000 73\027\372#\232
3 K- m% ?$ p. A  v6 X
1 o$ a* d* ~# J/ M, n/ Q 9.813350 192.168.101.113 -> 192.168.101.210 FTP Request: \027\003\001\000\030\203x`k\337RM\341w\022N\255|f\260U ?\354)A\301^\251\027\003\001\000 \031`\366\364He\030\266z)\373\265\237\261\3430\220\331\340Kv[\033\347\tXj\344\314\236\242

9.814073 192.168.101.113 -> 192.168.101.210 FTP Request: \027\003\001\000\030\307\2126sY\a\237\034\321\277!j\320\213\235\032\277e\345\361E>|)\027\003\001\000 \256\304}:-\365\034\aD~\fk`]\314\b\207\365-\217\305\244

9.838659 192.168.101.113 -> 192.168.101.210 FTP Request: \027\003\001\000\030\300\272t&\t(\262\243\361\210\263\343\326\261\017$\317V\002\354\325\271\250\366\027\003\001\000 \350F\305\360\363\365\033\274W\207M\006\216\255\016\365\205z\033\002\032B\345,\3712\034\377\327[\272P
! y0 h9 y5 m5 A
5 u) l1 W9 n' ?( f% H 9.851675 192.168.101.113 -> 192.168.101.210 TCP 52572 > 21 [ACK] Seq=1071 Ack=2041 Win=65140 Len=0
  Z% Q5 v% p/ }" n
9 b9 I, P, e; c% r 9.856073 192.168.101.113 -> 192.168.101.210 FTP Request: \027\003\001\000\030\f\357\000E/\372\333\247\016\344\315\345\346\271L\327\214CE0*i\316\332\027\003\001\000(8\220\341\316.*\234dM\235

10.061779 192.168.101.113 -> 192.168.101.210 TCP 52572 > 21 [ACK] Seq=1145 Ack=2094 Win=65088 Len=0
  E  d, v- _' M0 [; ~
3 g$ K' E. ^* a% _( a1 Q9 p 39.978110 192.168.101.113 -> 192.168.101.210 FTP Request: \027\003\001\000\030=\032\322\022\216B\025O\016\034

: J' M1 c; o! X 39.980672 192.168.101.113 -> 192.168.101.210 TCP 52572 > 21 [FIN, ACK] Seq=1211 Ack=2139 Win=65040 Len=0

  Y/ C  L+ X" M, s4 o6 m5 @ 39.980725 192.168.101.113 -> 192.168.101.210 TCP 52572 > 21 [RST, ACK] Seq=1212 Ack=2149 Win=0 Len=0
, g) v( M8 p7 [2 t8 h9 e
% h1 h( d" G, z0 M5 D% O" ]27 packets captured
& V0 C& G. J" r3 X  u
; G+ q* T- V8 O5 R0 v[root@ftp ~]#