本公司需要讓客戶自行上傳 render 時會使用到的素材，或是下載 render 後的結果，
所以架了一台 FTP server，裡面有上百個帳號。
但最近因為網路問題，常常有國外的客戶抱怨檔案傳輸的速度不夠理想，
處在一個網路被政府高度控管的地方，我們能做的部份是非常有限。
於是想到要在 AWS 各地區上租虛擬主機架設 FTP server，先讓客戶將檔案上傳，
我們再將檔案同步到離我們公司的較近的 AWS 地區的伺服器上，用此來解決網路速度慢的問題。
但接下來面臨到的問題是，上百個帳號怎麼辦，
總不可能每架一台 FTP server，就一個一個建帳號吧。
還好有找到一個方法，就是 Proftp + MySQL。
設定的方法如下
1. 安裝所需要的套件
yum -y install mysql mysql-server proftpd proftpd-mysql
2.建立 DB
/usr/bin/mysqladmin -u root -p create proftpdb
3. 建立帳號和權限
/usr/bin/mysql -u root -p -e "GRANT ALL PRIVILEGES ON proftpdb.* TO 'proftpd'@'localhost' IDENTIFIED BY '123456';"
4. 建立虛擬帳號使用的系統帳號和群組
groupadd -g 1000 virtualgrp
useradd -g 1000 -u 1000 virtualuser
5. proftpd 資料庫的 ftpuser 資料表
CREATE TABLE IF NOT EXISTS `ftpuser` (
`id` int(10) unsigned NOT NULL AUTO_INCREMENT,
`userid` varchar(32) COLLATE utf8_general_ci NOT NULL DEFAULT '',
`passwd` varchar(32) COLLATE utf8_general_ci NOT NULL DEFAULT '',
`uid` smallint(6) NOT NULL DEFAULT '501',
`gid` smallint(6) NOT NULL DEFAULT '501',
`homedir` varchar(255) COLLATE utf8_general_ci NOT NULL DEFAULT '',
`shell` varchar(16) COLLATE utf8_general_ci NOT NULL DEFAULT '/sbin/nologin',
PRIMARY KEY (`id`),
UNIQUE KEY `userid` (`userid`)
) ENGINE=MyISAM DEFAULT CHARSET=utf8 COLLATE=utf8_general_ci COMMENT='ProFTP user table';
insert into ftpuser values ('1','john',encrypt('123456'),'1000','1000','/home/virtualuser/john','/sbin/nologin');
insert into ftpuser values ('2','chen',encrypt('123456'),'1000','1000','/home/virtualuser/chen','/sbin/nologin');
6. proftpd 資料庫的 ftpgroup 資料表
CREATE TABLE IF NOT EXISTS `ftpgroup` (
`groupname` varchar(16) COLLATE utf8_general_ci NOT NULL,
`gid` smallint(6) NOT NULL DEFAULT '5500',
`members` varchar(16) COLLATE utf8_general_ci NOT NULL,
KEY `groupname` (`groupname`)
) ENGINE=MyISAM DEFAULT CHARSET=utf8 COLLATE=utf8_general_ci COMMENT='ProFTP group table';
insert into ftpgroup values ('virtualgrp','1000','john');
insert into ftpgroup values ('virtualgrp','1000','chen');
7. 設定 /etc/proftpd.conf
# This is the ProFTPD configuration file
# $Id: proftpd.conf,v 1.1 2004/02/26 17:54:30 thias Exp $
ServerName "ProFTPD server"
ServerIdent on "FTP Server ready."
ServerAdmin root@localhost
ServerType standalone
#ServerType inetd
DefaultServer on
AccessGrantMsg "User %u logged in."
#DisplayConnect /etc/ftpissue
#DisplayLogin /etc/ftpmotd
#DisplayGoAway /etc/ftpgoaway
DeferWelcome off
# Use this to excude users from the chroot
DefaultRoot ~ !adm
# Use pam to authenticate (default) and be authoritative
AuthPAMConfig proftpd
AuthOrder mod_sql.c
#####AuthOrder mod_auth_pam.c* mod_auth_unix.c
# Do not perform ident nor DNS lookups (hangs when the port is filtered)
IdentLookups off
UseReverseDNS off
# Port 21 is the standard FTP port.
Port 21
PassivePorts 50000 50030
# Umask 022 is a good standard umask to prevent new dirs and files
# from being group and world writable.
Umask 022
# Default to show dot files in directory listings
ListOptions "-a"
# See Configuration.html for these (here are the default values)
#MultilineRFC2228 off
#RootLogin off
#LoginPasswordPrompt on
#MaxLoginAttempts 3
#MaxClientsPerHost none
#AllowForeignAddress off # For FXP
# Allow to resume not only the downloads but the uploads too
AllowRetrieveRestart on
AllowStoreRestart on
# To prevent DoS attacks, set the maximum number of child processes
# to 30. If you need to allow more than 30 concurrent connections
# at once, simply increase this value. Note that this ONLY works
# in standalone mode, in inetd mode you should use an inetd server
# that allows you to limit maximum number of processes per service
# (such as xinetd)
MaxInstances 20
# Set the user and group that the server normally runs at.
User nobody
Group nobody
# Disable sendfile by default since it breaks displaying the download speeds in
# ftptop and ftpwho
UseSendfile no
# This is where we want to put the pid file
ScoreboardFile /var/run/proftpd.score
# Normally, we want users to do a few things.
<Global>
AllowOverwrite yes
<Limit ALL SITE_CHMOD>
AllowAll
</Limit>
</Global>
# Define the log formats
LogFormat default "%h %l %u %t \"%r\" %s %b"
LogFormat auth "%v [%P] %h %t \"%r\" %s"
# TLS
# Explained at http://www.castaglia.org/proftpd/modules/mod_tls.html
#TLSEngine on
#TLSRequired on
#TLSRSACertificateFile /etc/pki/tls/certs/proftpd.pem
#TLSRSACertificateKeyFile /etc/pki/tls/certs/proftpd.pem
#TLSCipherSuite ALL:!ADH:!DES
#TLSOptions NoCertRequest
#TLSVerifyClient off
##TLSRenegotiate ctrl 3600 data 512000 required off timeout 300
#TLSLog /var/log/proftpd/tls.log
# SQL authentication Dynamic Shared Object (DSO) loading
# See README.DSO and howto/DSO.html for more details.
<IfModule mod_dso.c>
LoadModule mod_sql.c
LoadModule mod_sql_mysql.c
# LoadModule mod_sql_postgres.c
</IfModule>
<IfModule mod_sql.c>
# We need our "default" connection to the userdb database
SQLConnectInfo proftpdb@localhost proftpd-sg 6p9i2t7t
SQLBackend mysql
SQLAuthTypes Backend Plaintext Crypt
SQLAuthenticate on
SQLMinUserUID 1000
SQLMinUserGID 1000
RequireValidShell off
CreateHome on
# Point mod_sql at our users/groups tables
SQLUserInfo ftpuser userid passwd uid gid homedir shell
SQLGroupInfo ftpgroup groupname gid members
</IfModule>
# A basic anonymous configuration, with an upload directory.
#<Anonymous ~ftp>
# User ftp
# Group ftp
# AccessGrantMsg "Anonymous login ok, restrictions apply."
#
# # We want clients to be able to login with "anonymous" as well as "ftp"
# UserAlias anonymous ftp
#
# # Limit the maximum number of anonymous logins
# MaxClients 10 "Sorry, max %m users -- try again later"
#
# # Put the user into /pub right after login
# #DefaultChdir /pub
#
# # We want 'welcome.msg' displayed at login, '.message' displayed in
# # each newly chdired directory and tell users to read README* files.
# DisplayLogin /welcome.msg
# DisplayFirstChdir .message
# DisplayReadme README*
#
# # Some more cosmetic and not vital stuff
# DirFakeUser on ftp
# DirFakeGroup on ftp
#
# # Limit WRITE everywhere in the anonymous chroot
# <Limit WRITE SITE_CHMOD>
# DenyAll
# </Limit>
#
# # An upload directory that allows storing files but not retrieving
# # or creating directories.
# <Directory uploads/*>
# AllowOverwrite no
# <Limit READ>
# DenyAll
# </Limit>
#
# <Limit STOR>
# AllowAll
# </Limit>
# </Directory>
#
# # Don't write anonymous accesses to the system wtmp file (good idea!)
# WtmpLog off
#
# # Logging for the anonymous transfers
# ExtendedLog /var/log/proftpd/access.log WRITE,READ default
# ExtendedLog /var/log/proftpd/auth.log AUTH auth
#
#</Anonymous>
8. 設定 iptables
-A INPUT -m state --state NEW -m tcp -p tcp --dport 21 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 50000:50030 -j ACCEPT
完成以上設定後，就可以使用虛擬帳號登入 proftp 來傳輸檔案了。
留言列表
