A non-root based vsftpd system and a distributed vsftpd system

Abstract

The application provides a non-root based vsftpd system, comprising an identification module, a request receiving module and an analysis module; the request receiving module receives an access request of a client in the vsftpd system and sends the request of the client to the identification module or the analysis module; the identification module identifies a user in the request of the client and sends user information to the analysis module; the analysis module analyzes an action of the client request and sets a permission for a program performing the action according to the user information. Through the application, the most appropriate permission distribution can be realized for different operations, and whether the access of a process of different operations to a file under different paths exceeds all permissions of a client user is monitored, the operation exceeding all permissions of the user is terminated in time, and the safety of file data operation in the vsftpd system can be effectively ensured.

Description

Technical Field

[0001] This invention belongs to the field of computer cloud storage, specifically relating to a vsftpd system based on a non-root method and a distributed vsftpd system. Background Technology

[0002] FTP (File Transfer Protocol) is one of the protocols in the TCP / IP protocol suite. The FTP protocol consists of two parts: an FTP server and an FTP client. The FTP server stores files, and users can use an FTP client to access resources located on the FTP server via the FTP protocol. Furthermore, due to its very high transfer efficiency, FTP is generally used for transferring large files over a network.

[0003] vsftpd is an abbreviation for ftpd, which is also commonly used when transferring large files over a network. It is the name of a server that runs on a UNIX-like operating system.

[0004] Chroot technology: vsftpd service is a technology that restricts users to access only their own home directory and not directories outside their home directory.

[0005] The common method for starting vsftpd on Unix-like platforms is by running it as the root user. As is well known, the root user has the highest privileges in Unix-like operating systems, allowing access to and modification of any operating system configuration and services. In distributed systems, this can lead to numerous security issues. vsftpd itself can be configured to start as the ftp user by setting `run_as_launching_user` to `yes` in its configuration file. However, enabling this configuration restricts ftpd user access, allowing only anonymous access, disabling chroot technology, making data transfer ports unavailable, and restricting access to single-process mode. This significantly limits ftpd functionality.

[0006] Therefore, there is an urgent need for a solution that can both ensure the normal operation of FTP services and provide security for non-root users. Summary of the Invention

[0007] To address the above problems, this invention proposes a vsftpd system based on a non-root method, comprising:

[0008] Recognition module;

[0009] Request receiving module; and

[0010] Analysis module;

[0011] The request receiving module is configured to receive access requests from clients in the vsftpd system and send the client's request to the identification module or the analysis module.

[0012] The identification module is configured to identify the user in the client's request and send the user's information to the analysis module;

[0013] The analysis module is configured to analyze the client's request actions and set permissions for the program that performs the actions based on the user's information.

[0014] In some embodiments of the present invention, the user information includes the username and the user's permission category.

[0015] In some embodiments of the present invention, the request module is further configured to:

[0016] The client's request is sent to the analysis module according to the type of data processing the client performs.

[0017] In some embodiments of the present invention, the analysis module is further configured to:

[0018] In response to a client's request for read data, a process for reading files in the system is run with read-only permissions.

[0019] In some embodiments of the present invention, the analysis module is further configured to: in response to a client's request for data processing type of write data, run a process in the system that writes to a file with write-only permissions.

[0020] In some embodiments of the present invention, the analysis module is further configured to:

[0021] Grant the highest privileges to the process writing the file, and simultaneously monitor the file access path of the process writing the file.

[0022] In some embodiments of the present invention, the analysis module is further configured to:

[0023] In response to the process of writing to the file accessing an abnormal path, the process of writing to the file is terminated.

[0024] In some embodiments of the present invention, the analysis module is further configured to:

[0025] In response to a client's request for data of the specified type, a process for modifying files in the system is run with the highest privileges.

[0026] In response to a process running with the highest privileges to modify a file in the system, the process of modifying the file is monitored;

[0027] In response to the process modifying the file accessing an abnormal path or modifying a file in an illegal path, the process modifying the file is terminated.

[0028] In some embodiments of the present invention, the analysis module is further configured to:

[0029] In response to a client's request to delete data, the system runs a file deletion process with the highest privileges.

[0030] In response to the process running the deleted file in the system with the highest privileges, the process of deleting the file is monitored;

[0031] In response to the process of deleting the file accessing an abnormal path or modifying a file in an illegal path, the process of deleting the file is terminated.

[0032] Another aspect of the present invention proposes a distributed vsftpd system, which includes multiple vsftpd nodes; any one of the vsftpd nodes runs the vsftpd system implemented in the above embodiments.

[0033] The present invention proposes a vsftpd system based on non-root access and a distributed vsftpd system. An analysis module analyzes the types of requests made by clients accessing the vsftpd system and executes processes with different permissions. Specifically, it assigns different permissions to client operations such as accessing, modifying, and deleting data in the vsftpd system, ensuring the most appropriate permission allocation for different operations. Simultaneously, it monitors whether the processes of different operations accessing files in different paths exceed the client user's full permissions, promptly terminating operations that exceed the user's permissions. This effectively guarantees the security of file data operations within the vsftpd system. Attached Figure Description

[0034] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0035] Figure 1 A structural diagram of a vsftpd system based on a non-root method is provided in an embodiment of the present invention;

[0036] Figure 2 This is a structural topology diagram of a distributed vsftpd system provided in an embodiment of the present invention. Detailed Implementation

[0037] To make the objectives, technical solutions, and advantages of the present invention clearer, the embodiments of the present invention will be further described in detail below with reference to specific examples and the accompanying drawings.

[0038] like Figure 1 As shown, the first aspect of the present invention proposes a vsftpd system based on a non-root method, comprising:

[0039] Identification module 1;

[0040] Request receiving module 2; and

[0041] Analysis Module 3;

[0042] The request receiving module is configured to receive access requests from clients in the vsftpd system and send the client's request to the identification module or the analysis module.

[0043] The identification module is configured to identify the user in the client's request and send the user's information to the analysis module;

[0044] The analysis module is configured to analyze the client's request actions and set permissions for the program that performs the actions based on the user's information.

[0045] like Figure 1 As shown in the embodiments of the present invention, different functions in the vsftpd system are separated, and an identification module 1, a request receiving module 2, and an analysis module 3 are added. The identification module 1 is used to identify the user's identity. Due to permission restrictions on the password file in the vsftpd system, programs executed by ordinary users cannot open it. Therefore, the identification module 1 needs authorization from the analysis module 3 before execution. The identification module 1 can then access the password verification file and send the user's identity and permission information from the client to the analysis module 3. The request receiving module 2 is responsible for receiving all access requests from the client. Access requests include login verification requests and requests for file operations, i.e., operations on files under a certain path. The request receiving module 2 sends the user's login verification request to the identification module 1, which verifies the client's identity. The file operations in the access request are sent to the analysis module 3. The analysis module 3 analyzes the operations in the access request and executes the corresponding program for the requested operation based on the analysis results, i.e., starting the corresponding process.

[0046] In some embodiments of the present invention, the user information includes the username and the user's permission category.

[0047] In some embodiments of the present invention, the request receiving module is further configured to:

[0048] The client's request is sent to the analysis module according to the type of data processing the client performs.

[0049] In this implementation, the user's information mainly consists of the username and password, which are verified by the identification module 1. The user's permissions are verified by the identification module 1 and then sent to the analysis module 3.

[0050] In some embodiments of the present invention, the analysis module is further configured to:

[0051] In response to a client's request for read data, a process for reading files in the system is run with read-only permissions.

[0052] In this embodiment, when the request file operation type sent by the request receiving module 2 to the analysis module 3 is to read files under the corresponding path, the analysis module 3 sets the permissions of the executable file of the program that reads the file to be able to read files on the disk, and then executes the executable file of the program that reads the file.

[0053] In some embodiments of the present invention, the analysis module is further configured to run a process for writing files in the system with write-only permissions in response to a client's request for data processing of type write data.

[0054] In this embodiment, when the request file operation type sent by the request receiving module 2 to the analysis module 3 is to write a file in the corresponding path, the analysis module 3 sets the permissions of the executable file of the program that writes the file to be able to write files to the disk, and then executes the executable file of the program that writes the file.

[0055] In some embodiments of the present invention, the analysis module is further configured to:

[0056] Grant the highest privileges to the process writing the file, and simultaneously monitor the file access path of the process writing the file.

[0057] In some embodiments of the present invention, the analysis module is further configured to:

[0058] In response to the process of writing to the file accessing an abnormal path, the process of writing to the file is terminated.

[0059] In this embodiment, the analysis module 3 also analyzes the access paths of the process after the executable file of the program that writes files is executed in real time. If the process after the executable file of the program that writes files is executed accesses a file path that the user of the client should not access, the process is terminated.

[0060] In some embodiments of the present invention, the analysis module is further configured to:

[0061] In response to a client's request for data of the specified type, a process for modifying files in the system is run with the highest privileges.

[0062] In response to a process running with the highest privileges to modify a file in the system, the process of modifying the file is monitored;

[0063] In response to the process modifying the file accessing an abnormal path or modifying a file in an illegal path, the process modifying the file is terminated.

[0064] In this invention, when the path of the file requested by the client is inconsistent with the path accessed by the process performing the corresponding operation on the file, the file path accessed by the process performing the corresponding operation on the file is considered to be an abnormal path.

[0065] Furthermore, when the path of the file requested by the client is not a file specified in the account provided during the client's user login verification, the file path of the file requested by the client is also considered an abnormal path.

[0066] Therefore, analysis module 3 needs to verify the paths accessed by the processes or threads operating on the corresponding files, determining whether the paths accessed by the processes or threads are the same paths requested by the client. In some cases, it also needs to determine whether the path belongs to the user based on the user information provided by identification module 1. When the aforementioned abnormal paths are found, the corresponding processes should be terminated promptly. This is to prevent malicious users from obtaining data that does not belong to them by sending path requests through the client, even if they know the file directory structure.

[0067] In this embodiment, when the request file operation type sent by the request receiving module 2 to the analysis module 3 is to modify a file in the corresponding path, the analysis module 3 sets the permissions of the executable file of the program that modifies the file to allow modification of files on the disk, and then executes the executable file of the program that modifies the file. The analysis module 3 also analyzes the access paths of the process after the executable file of the program that modifies the file is executed in real time. If the process after the executable file of the program that modifies the file is executed accesses a file path that the user of the client should not access, then the process is terminated.

[0068] In some embodiments of the present invention, the analysis module is configured to:

[0069] In response to a client's request to delete data, the system runs a file deletion process with the highest privileges.

[0070] In response to the process running the deleted file in the system with the highest privileges, the process of deleting the file is monitored;

[0071] In response to the process of deleting the file accessing an abnormal path or modifying a file in an illegal path, the process of deleting the file is terminated.

[0072] In this embodiment, when the request file operation type sent by the request receiving module 2 to the analysis module 3 is to delete a file in the corresponding path, the analysis module 3 sets the permissions of the executable file of the file deletion program to allow file deletion on the disk, and then executes the executable file of the file deletion program. The analysis module 3 also analyzes the access paths of the process after the executable file of the file deletion program is executed in real time. If the process after the executable file of the file deletion program is executed accesses a file path that the client user should not access, the process is terminated.

[0073] like Figure 2 As shown, another aspect of the present invention also proposes a distributed vsftpd system 20, which includes multiple vsftpd nodes 21; any one of the vsftpd nodes runs the vsftpd system implemented as described in the above embodiments.

[0074] The present invention proposes a vsftpd system based on non-root access and a distributed vsftpd system. An analysis module analyzes the types of requests made by clients accessing the vsftpd system and executes processes with different permissions. Specifically, it assigns different permissions to client operations such as accessing, modifying, and deleting data in the vsftpd system, ensuring the most appropriate permission allocation for different operations. Simultaneously, it monitors whether the processes of different operations accessing files in different paths exceed the client user's full permissions, promptly terminating operations that exceed the user's permissions. This effectively guarantees the security of file data operations within the vsftpd system.

[0075] The above are exemplary embodiments disclosed in this invention. However, it should be noted that various changes and modifications can be made without departing from the scope of the embodiments of this invention as defined by the claims. The functions, steps, and / or actions of the methods according to the disclosed embodiments described herein do not need to be performed in any particular order. Furthermore, although the elements disclosed in the embodiments of this invention may be described or claimed individually, they may be understood as multiple unless explicitly limited to a singular number.

[0076] It should be understood that, as used herein, the singular form “a” is intended to include the plural form as well, unless the context clearly supports an exception. It should also be understood that, as used herein, “and / or” refers to any and all possible combinations of one or more of the associated listed items.

[0077] The embodiment numbers disclosed in the above embodiments of the present invention are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0078] Those skilled in the art will understand that all or part of the steps of the above embodiments can be implemented by hardware or by a program instructing related hardware. The program can be stored in a computer-readable storage medium, such as a read-only memory, a disk, or an optical disk.

[0079] The above-described "preferred" embodiments are possible examples of implementation methods and are presented merely for the purpose of clearly understanding the principles of the present invention. Those skilled in the art should understand that the discussion of any of the above embodiments is merely exemplary and is not intended to imply that the scope of the disclosed embodiments of the present invention (including the claims) is limited to these examples; within the framework of the present invention, technical features of the above embodiments or different embodiments can also be combined, and many other variations of different aspects of the present invention as described above exist, which are not provided in detail for the sake of brevity. Therefore, any omissions, modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A vsftpd system based on non-root mode, characterized in that, include: Recognition module; Request receiving module; and Analysis module; Before the identification module can be executed, the analysis module needs to authorize the identification module so that the identification module can access the password verification file; The request receiving module is configured to receive access requests from clients in the vsftpd system. If the client's request is a login verification request, the request is sent to the identification module. If the client's request is a request for file operation, the request is sent to the analysis module according to the type of data processing the client performs. The identification module is configured to identify the user in the client's request and send the user's information to the analysis module; the analysis module is configured to analyze the action of the client's request and set permissions for the program that performs the action based on the user's information. The analysis module is also configured to grant the highest privileges to the corresponding operation process when the client processes data as write data, modify data, or delete data, and simultaneously monitor the file access path of the operation process; in response to abnormal file access paths of the operation process, terminate the operation process.

2. The system according to claim 1, characterized in that, The user information includes the username and the user's permission category.

3. The system according to claim 1, characterized in that, The analysis module is also configured to: In response to a client's request for read data, a process for reading files in the system is run with read-only permissions.

4. The system according to claim 1, characterized in that, The analysis module is configured to: In response to a client's request to write data, the process writing to the file is granted the highest privileges.

5. The system according to claim 1, characterized in that, The analysis module is configured to: In response to a client's request for data of the specified type, a process for modifying files in the system is run with the highest privileges. In response to the monitoring that the process modifying the file is modifying a file in an illegal path, the process modifying the file is terminated.

6. The system according to claim 1, characterized in that, The analysis module is configured to: In response to a client's request to delete data, the system runs a file deletion process with the highest privileges. In response to the detection that the process deleting the file has modified a file in an illegal path, the process deleting the file is terminated.

7. A distributed vsftpd system, characterized in that, The distributed vsftpd system comprises multiple vsftpd nodes; any one of the vsftpd nodes runs the vsftpd system as described in claims 1-6.

Images