FC12, vsftp и виртуальные пользователи

mysql-embedded-5.1.44-1.fc12.x86_64
mysql-5.1.44-1.fc12.x86_64
pam_mysql-0.7-0.9.rc1.fc12.2.i686
mysql-libs-5.1.44-1.fc12.i686
qt-mysql-4.6.2-8.fc12.x86_64
php-mysql-5.3.1-1.fc12.x86_64
mysql-server-5.1.44-1.fc12.x86_64
pam_mysql-0.7-0.9.rc1.fc12.2.x86_64
mysql-libs-5.1.44-1.fc12.x86_64

CREATE DATABASE vsftpd;
GRANT SELECT, INSERT, UPDATE, DELETE, CREATE, DROP ON vsftpd.* TO 'vsftpd'@'localhost' IDENTIFIED BY 'ftpdpass';
GRANT SELECT, INSERT, UPDATE, DELETE, CREATE, DROP ON vsftpd.* TO 'vsftpd'@'localhost.localdomain' IDENTIFIED BY 'ftpdpass';
FLUSH PRIVILEGES;

USE vsftpd;
CREATE TABLE `accounts` (
`id` INT NOT NULL AUTO_INCREMENT PRIMARY KEY ,
`username` VARCHAR( 30 ) NOT NULL ,
`pass` VARCHAR( 50 ) NOT NULL ,
UNIQUE (
`username`
)
) ENGINE = MYISAM ;
quit;

listen=YES
background=YES
dirmessage_enable=YES
syslog_enable=YES
anon_mkdir_write_enable=YES
idle_session_timeout=900
log_ftp_protocol=YES
max_clients=500
max_per_ip=80
pasv_enable=YES
local_umask=022
anonymous_enable=YES
local_enable=YES
write_enable=YES
anon_upload_enable=yes
pasv_min_port=49152
pasv_max_port=65534
xferlog_enable=YES
nopriv_user=vsftpd
chroot_local_user=YES
#ftpd_banner=
secure_chroot_dir=/var/run/vsftpd
pam_service_name=vsftpd
rsa_cert_file=/etc/ssl/certs/vsftpd.pem
guest_enable=YES
guest_username=vsftpd
local_root=/home/vsftpd/$USER
user_sub_token=$USER
virtual_use_local_privs=YES
user_config_dir=/etc/vsftpd_user_conf
setproctitle_enable=YES
session_support=YES

auth required pam_mysql.so user=vsftpd passwd=ftpdpass host=localhost db=vsftpd table=accounts usercolumn=username passwdcolumn=pass use_323_passwd=1 crypt=2
account required pam_mysql.so user=vsftpd passwd=ftpdpass host=localhost db=vsftpd table=accounts usercolumn=username passwdcolumn=pass use_323_passwd=1  crypt=2

USE vsftpd;
INSERT INTO accounts (username, pass) VALUES('testuser', PASSWORD('secret')); quit;

lftp ftp://myhost.dyndns.ws
lftp myhost.dyndns.ws:~> ls                            
drwxrws-wt    2 500      100          4096 Mar 25 17:16 incoming
drwxrwsr-x    2 0        100          4096 Jan 14 14:08 pub

lftp ftp://testuser@myhost.dyndns.ws
Password: 
lftp testuser@myhost.dyndns.ws:~> ls                   
ls: Login failed: 530 Login incorrect.

........
type=USER_AUTH msg=audit(1269594331.801:35948): user pid=1 uid=0 
 auid=4294967295 ses=4294967295 msg='op=PAM:authentication 
 acct="testuser" exe="/usr/sbin/vsftpd" hostname=localhost 
 addr=::1 terminal=ftp res=failed'

логи по совсем иным вещам..
sd 6:0:0:0: [sdd] Attached SCSI disk
EXT4-fs (sda1): mounted filesystem with ordered data mode
EXT4-fs (dm-5): mounted filesystem with ordered data mode
EXT4-fs (sda5): mounted filesystem with ordered data mode
EXT4-fs (dm-4): mounted filesystem with ordered data mode
EXT4-fs (sda2): mounted filesystem with ordered data mode
EXT4-fs (dm-2): mounted filesystem with ordered data mode
EXT4-fs (dm-1): mounted filesystem with ordered data mode

100326  2:43:36  InnoDB: Shutdown completed; log sequence number 0 44233
100326  2:43:36 [Note] /usr/libexec/mysqld: Shutdown complete
100326 02:43:36 mysqld_safe mysqld from pid file /var/run/mysqld/mysqld.pid ended
100326 02:45:09 mysqld_safe Starting mysqld daemon with databases from /var/lib/mysql
100326  2:45:10 [Note] Plugin 'ndbcluster' is disabled.
100326  2:45:10  InnoDB: Started; log sequence number 0 44233
100326  2:45:10 [Note] Event Scheduler: Loaded 0 events
100326  2:45:10 [Note] /usr/libexec/mysqld: ready for connections.
Version: '5.1.44'  socket: '/var/lib/mysql/mysql.sock'  port: 3306  Source distribution

tail /var/log/vsftpd.log 
Fri Mar 26 00:05:28 2010 [pid 2] CONNECT: Client "192.168.1.1"
Fri Mar 26 00:05:32 2010 [pid 1] [testuser] FAIL LOGIN: Client "192.168.1.1"
из существенного - это все.

auth required pam_mysql.so user=vsftpd host=localhost passwd=vsftpdpass db=vsftpd table=ftp_accounts usercolumn=username passwdcolumn=password crypt=2
account required pam_mysql.so user=vsftpd host=localhost passwd=vsftpdpass db=vsftpd table=ftp_accounts usercolumn=username passwdcolumn=password crypt=2

auth required pam_mysql.so user=vsftpd passwd=vsftpdpass host=localhost db=vsftpd table=ftp_accounts usercolumn=username passwdcolumn=pass crypt=2 sqllog=1 logtable=logs logmsgcolumn=msg logusercolumn=user logpidcolumn=pid loghostcolumn=host logrhostcolumn=rhost logtimecolumn=logtime 
account required pam_mysql.so user=vsftpd passwd=vsftpdpass host=localhost db=vsftpd table=ftp_accounts usercolumn=username passwdcolumn=pass crypt=2 sqllog=1 logtable=logs logmsgcolumn=msg logusercolumn=user logpidcolumn=pid loghostcolumn=host logrhostcolumn=rhost logtimecolumn=logtime

[iron@estaf ~]$ lftp ftp://ftpuser@estaf.trc.local
Пароль: 
lftp ftpuser@estaf.trc.local:~> ls                        
ls: Ошибка регистрации: 530 Login incorrect.                                          
lftp ftpuser@estaf.trc.local:~> exit

#tail /var/log/mysql-query.log 
100704 22:49:56      137 Connect    vsftpd@localhost on vsftpd
          137 Init DB    vsftpd
          137 Query    SELECT pass FROM ftp_accounts WHERE username = 'ftpuser'
          137 Query    INSERT INTO logs (msg, user, host, rhost, pid, logtime) VALUES ('AUTHENTICATION FALURE (FIRST_PASS)', 'ftpuser', '127.0.0.1', 'estaf.trc.local', '20676', NOW())
          137 Quit

mysql -u vsftpd -p 
Enter password:  
Welcome to the MySQL monitor.  Commands end with ; or \g. 
Your MySQL connection id is 64 
Server version: 5.1.47-log Source distribution 
........... 
mysql> USE vsftpd; 
    ->Reading table information for completion of table and column names 
You can turn off this feature to get a quicker startup with -A 
 
Database changed 
mysql> Query SELECT password FROM ftp_accounts WHERE username = 'ftpuser'; 
+----+----------+-------------------------------------------+ 
| id | username | password                                  | 
+----+----------+-------------------------------------------+ 
|  2 | ftpuser  | *832EB84CB764129D05D498ED9CA7E5CE9B8F83EB | 
+----+----------+-------------------------------------------+ 
1 row in set (0.00 sec)

tail /var/log/vsftpd.log]br] Sat Jul 3 19:33:27 2010 [pid 26725] CONNECT: Client "127.0.0.1" Sat Jul 3 19:33:30 2010 [pid 26724] [ftpuser] FAIL LOGIN: Client "127.0.0.1"
tail /var/log/audit/audit.log
type=CRED_DISP msg=audit(1278171210.664:36961): user pid=26724 uid=0 auid=500 ses=1 subj=unconfined_u:system_r:ftpd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="ftpuser" exe="/usr/sbin/vsftpd" hostname=estaf.trc.local addr=127.0.0.1 terminal=ftp res=success'

cat /etc/vsftpd/vsftpd.conf 
listen=YES 
background=YES 
dirmessage_enable=YES 
anon_mkdir_write_enable=YES 
idle_session_timeout=900 
max_clients=500 
max_per_ip=80 
local_umask=022 
anonymous_enable=YES 
local_enable=YES 
write_enable=YES 
anon_upload_enable=yes 
anon_root=/var/ftp 
pasv_min_port=49152 
pasv_max_port=65534 
nopriv_user=vsftpd 
chroot_local_user=YES 
#ftpd_banner= 
secure_chroot_dir=/var/run/vsftpd 
pam_service_name=vsftpd 
guest_enable=YES 
guest_username=vsftpd 
local_root=/home/vsftpd/$USER 
user_sub_token=$USER 
virtual_use_local_privs=YES 
user_config_dir=/etc/vsftpd_user_conf 
setproctitle_enable=YES 
session_support=YES 
dual_log_enable=YES 
syslog_enable=YES 

ls -l /home/ 
....... 
drwx------. 51 iron   iron    4096 Июл  3 20:04 iron 
........... 
drwxrwsr-x.  6 vsftpd nobody  4096 Июн 30 12:30 vsftpd 
 
ls -l /home/vsftpd/ 
итого 4 
drwxr-xr-t. 6 iron iron 4096 Июн 29 03:11 ftpuser

setsebool -P allow_ftpd_full_access 1

setsebool -P ftpd_connect_db 1