Pure-FTPd 整合 MySQL 實現虛擬用戶認證與權限精細化控制

Pure-FTPd 支援 MySQL 後端認證，實現 FTP 用戶集中管理、配額限制、帶寬控制、目錄隔離。本文涵蓋源碼編譯安裝、MySQL 認證表設計、系統用戶映射、ACL 精細權限、啟動腳本與防火牆配置的完整落地流程。

編譯安裝關鍵參數

./configure --prefix=/usr/local/pureftpd \
  --with-mysql=/usr/local/mysql \
  --with-language=simplified-chinese \
  --with-virtualchroot --with-virtualhosts \
  --with-quotas --with-ratios --with-throttling \
  --with-uploadscript --with-diraliases --with-peruserlimits \
  --with-cookie --with-paranoidmsg --with-altlog
make && make install

系統服務註冊

cp contrib/redhat.init /etc/init.d/pureftpd
# 修改路徑：fullpath=/usr/local/pureftpd/sbin/$prog
# 修改配置文件路徑：$fullpath /usr/local/pureftpd/etc/pure-ftpd.conf --daemonize
chmod 755 /etc/init.d/pureftpd
chkconfig --add pureftpd && chkconfig pureftpd on

核心配置 /usr/local/pureftpd/etc/pure-ftpd.conf

ChrootEveryone yes           # 限制在家目錄
NoAnonymous yes              # 禁用匿名
CreateHomeDir yes            # 自動創建家目錄
MaxClientsNumber 50
MaxClientsPerIP 8
PassivePortRange 30000 50000 # 被動模式端口段
AntiWarez yes
CustomerProof yes
PIDFile /var/run/pure-ftpd.pid

MySQL 認證配置 /usr/local/pureftpd/etc/pureftpd-mysql.conf

MYSQLServer 127.0.0.1
MYSQLPort 3306
MYSQLUser pureftpd
MYSQLPassword pureftpd
MYSQLDatabase pureftpd
MYSQLCrypt cleartext          # 明文存儲；生產建議 crypt/md5
MYSQLGetPW SELECT Password FROM users WHERE User='\L'
MYSQLGetUID SELECT Uid FROM users WHERE User='\L'
MYSQLGetGID SELECT Gid FROM users WHERE User='\L'
MYSQLGetDir SELECT Dir FROM users WHERE User='\L'
MySQLGetBandwidthUL SELECT ULBandwidth FROM users WHERE User='\L'
MySQLGetBandwidthDL SELECT DLBandwidth FROM users WHERE User='\L'

認證表結構

CREATE DATABASE pureftpd;
GRANT ALL ON pureftpd.* TO 'pureftpd'@'localhost' IDENTIFIED BY 'pureftpd';

CREATE TABLE `users` (
  `id` INT UNSIGNED NOT NULL AUTO_INCREMENT,
  `User` VARCHAR(16) NOT NULL DEFAULT '',
  `Password` VARCHAR(64) NOT NULL DEFAULT '',
  `Uid` VARCHAR(11) NOT NULL DEFAULT '-1',
  `Gid` VARCHAR(11) NOT NULL DEFAULT '-1',
  `Dir` VARCHAR(128) NOT NULL DEFAULT '',
  `QuotaSize` SMALLINT(5) NOT NULL DEFAULT '0',   -- MB
  `QuotaFiles` INT(11) NOT NULL DEFAULT '0',
  `ULBandwidth` SMALLINT(5) NOT NULL DEFAULT '0', -- KB/s
  `DLBandwidth` SMALLINT(5) NOT NULL DEFAULT '0',
  `ULRatio` SMALLINT(6) NOT NULL DEFAULT '0',
  `DLRatio` SMALLINT(6) NOT NULL DEFAULT '0',
  `comment` TINYTEXT NOT NULL,
  `ipaccess` VARCHAR(15) NOT NULL DEFAULT '*',
  `status` ENUM('0','1') NOT NULL DEFAULT '0',
  `create_date` DATETIME NOT NULL DEFAULT '0000-00-00 00:00:00',
  `modify_date` DATETIME NOT NULL DEFAULT '0000-00-00 00:00:00',
  PRIMARY KEY (`id`,`User`), UNIQUE KEY `User` (`User`)
) ENGINE=MyISAM DEFAULT CHARSET=utf8;

系統用戶與目錄權限映射

# 上傳用戶（寫權限）
groupadd upload -g 2001
useradd upload -u 2001 -g upload -s /sbin/nologin

# 下載用戶（讀權限）
groupadd download -g 2000
useradd download -u 2000 -g download -s /sbin/nologin

# FTP 根目錄
mkdir /ftproot
chown -R upload:download /ftproot
chmod 750 /ftproot

# ACL 精細控制：download 讀取權限繼承
setfacl -R -m u:download:rx /ftproot
setfacl -R -d -m u:download:rx /ftproot

插入測試用戶

INSERT INTO users (User,Password,Uid,Gid,Dir,status) VALUES
('upload','upload','2001','2001','/ftproot','1'),
('download','download','2000','2000','/ftproot','1');

啟動與驗證

/usr/local/pureftpd/bin/pure-config.pl /usr/local/pureftpd/etc/pure-ftpd.conf
# 瀏覽器訪問 ftp://server:21 測試 upload/download 登錄

防火牆放行

iptables -I INPUT -p tcp --dport 21 -j ACCEPT
iptables -I INPUT -p tcp --dport 30000:50000 -j ACCEPT
service iptables save

總結

Pure-FTPd + MySQL 實現「數據庫即配置中心」：新增用戶 = INSERT 一行，修改配額 = UPDATE 一行，無需重啟服務。結合系統 UID/GID + ACL，實現同一目錄下「上傳組寫、下載組讀」的精細權限模型，極大降低運維複雜度。