[openwrt][telnet][ftp] 关闭telnet和ftp，ssh

矫情吗；* 2022-05-19 08:39 1104阅读 0赞

## \*\*Telnet \*\* ##

默认端口号是 23

获取telnet的进程号

ps | grep "telnetd" | grep "login.sh" |  awk '{print $1}'

kill 进程号

root@OpenWrt:~# ps | grep "telnetd" 
    10372 root      1776 S    /usr/sbin/telnetd -l /bin/login.sh
    10827 root      1772 S    grep telnetd
    root@OpenWrt:~# ps | grep "telnetd" | grep "login.sh"
    10372 root      1776 S    /usr/sbin/telnetd -l /bin/login.sh
    root@OpenWrt:~# ps | grep "telnetd" | grep "login.sh" |  awk '{print $1}'
    10372
    root@OpenWrt:~#

ssh里面打开telnet

root@OpenWrt:/# /usr/sbin/telnetd -l /bin/login.sh
    root@OpenWrt:/# ps | grep "telnetd" | grep "login.sh" |  awk '{print $1}' 
    12430

--------------------

代码里面关掉telnet  
\\openwrt7621\\trunk\\base\\package\\utils\\busybox\\files\\telnet

![路径地址][70]

start_service() {
    		service_start /usr/sbin/telnetd -l /bin/login.sh
    }

改为：

start_service() {
                  exit
    }

--------------------

关闭ssh和Telnet，并且连同scp一起关闭，是在编译源码中关闭，非路由器里面。  
ssh关闭，不编译dropbear就行了，没了ssh服务，scp也就没有了。  
[来源][Link 1]

--------------------

开机默认关闭：/trunk/base/package/utils/busybox/files/telnet

![这里写图片描述][70 1]

--------------------

## **FTP（vsftpd）** ##

端口21

root@OpenWrt:~# /etc/init.d/vsftpd stop
    root@OpenWrt:~# 
    root@OpenWrt:~# /etc/init.d/vsftpd start

--------------------

VSFTP是一个基于GPL发布的类Unix系统上使用的FTP服务器软件，它的全称是Very Secure FTP 从此名称可以看出来，编制者的初衷是代码的安全。在使用Vsftp服务是经常需要启动、停止、重启vsftp服务，下面是这几个操作使用的指令：

1、启动Vsftpd服务其命令为： `service vsftpd start 或 /etc/init.d/vsftpd start`

2、停止Vsftpd服务的命令为：`service vsftpd stop 或 /etc/init.d/vsftpd stop`

3、重新启动Vsftpd服务的命令为：`service vsftpd restart 或 /etc/init.d/vsftpd restart`

4、检查Vsftpd服务的运行状态：`service vsftpd status`

--------------------

FTP server vsftpd  
来自 Double\_win：[http://www.cnblogs.com/double-win/p/3848797.html][http_www.cnblogs.com_double-win_p_3848797.html]  
(1)安装vsFTP，使用如下命令：

opkg update
    opkg install vsftpd

(2)配置/etc/vsftpd.conf  
根据是否允许anonymous登录，选择不同的配置文件：  
允许anonymous：

background=YES
    listen=YES
    chown_uploads=YES
    chown_username=root
    ftp_username=nobody
    #enable anonymous user
    anonymous_enable=YES
    anon_upload_enable=YES
    anon_root=/mnt/anonymous
    anon_mkdir_write_enable=YES
    anon_max_rate=512000
    local_enable=YES
    write_enable=YES
    local_umask=022
    check_shell=NO
    local_root=/mnt
    chroot_local_user=yes
    accept_timeout=60
    idle_session_timeout=300
    max_clients=600
    max_per_ip=5
    #dirmessage_enable=YES
    ftpd_banner=Welcome to vsFTP service.
    session_support=NO
    syslog_enable=YES

不允许匿名访问的话：

secure_chroot_dir=/mnt/sda3/ftpdir   #创建对应的文件夹
      ftp_username=root        #允许的用户名root 
      nopriv_user=root    
      background=YES
      listen=YES
      anonymous_enable=NO
      local_enable=YES
      write_enable=YES
      local_umask=022
      check_shell=NO
      dirmessage_enable=YES
      ftpd_banner=Welcome to vsFTP service.
      syslog_enable=YES
      max_clients=600
      max_per_ip=5
      accept_timeout=60    #设置连接超时

(4)启动vsftpd服务

/etc/init.d/vsftpd restart     #重启vsftpd服务
    /etc/init.d/vsftpd enable     #允许开机自启动

--------------------

![这里写图片描述][70 2]

[https://wiki.openwrt.org/doc/howto/ftp.overview][https_wiki.openwrt.org_doc_howto_ftp.overview]  
[http://www.cnblogs.com/double-win/p/3848797.html][http_www.cnblogs.com_double-win_p_3848797.html]  
[https://blog.csdn.net/kingwan560/article/details/52209705][https_blog.csdn.net_kingwan560_article_details_52209705]

--------------------

## 开机默认关闭：/trunk/base/feeds/packages/net/vsftpd/files/vsftpd.conf   ![这里写图片描述][70 3] ##

--------------------

## SSH ##

端口22

/etc/init.d/dropbear stop   //停止
    
    /etc/init.d/dropbear start  //开启
    
    netstat -ant |grep :22 //查看端口信息

如何默认关闭  
修改配置文件

root@OpenWrt:~# cat /etc/config/dropbear 
    config dropbear
            option PasswordAuth 'on'
            option RootPasswordAuth 'on'
            option Port         '22'
    #       option BannerFile   '/etc/banner'
    root@OpenWrt:~# 
    
    ------------------------------------------------------------
    option BannerFile   '/etc/banner' //是ssh连接成功的显示的那个图案
      _______                     ________        __
     |       |.-----.-----.-----.|  |  |  |.----.|  |_
     |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
     |_______||   __|_____|__|__||________||__|  |____|
              |__| W I R E L E S S   F R E E D O M
     -----------------------------------------------------

[https://wiki.openwrt.org/doc/uci/dropbear][https_wiki.openwrt.org_doc_uci_dropbear]

![这里写图片描述][70 4]  
![这里写图片描述][70 5]

添加一个 option enable ‘0’，重启/etc/init.d/dropbear restart。  
然后可以看到ssh的22端口已经关闭

root@OpenWrt:~# cat /etc/config/dropbear 
    config dropbear
            option PasswordAuth 'on'
            option RootPasswordAuth 'on'
            option enable '0'
            option Port         '22'
    #       option BannerFile   '/etc/banner'
    root@OpenWrt:~# 
    root@OpenWrt:~# netstat -ant |grep :22
    tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      
    tcp        0      0 :::22                   :::*                    LISTEN      
    root@OpenWrt:~# 
    root@OpenWrt:~# /etc/init.d/dropbear restart
    root@OpenWrt:~# 
    root@OpenWrt:~# netstat -ant |grep :22
    root@OpenWrt:~#

system("uci set /etc/config/dropbear.@dropbear[0].enable=1"); // 1 is open,defalut is 1
    system("uci commit /etc/config/dropbear");
    system("/etc/init.d/dropbear restart");

新建连接的ssh已无法建立  
![这里写图片描述][70 6]

--------------------

开机默认关闭：  
/trunk/base/package/ramips/ui/luci-mtk/src/contrib/uci/hostfiles/etc/config/dropbear

![这里写图片描述][70 7]

--------------------

unsigned char *ManagementSetting(int *pResult, json_object *pJsonReq, unsigned char* pOutBuf, int* pOutLen)
    {
    	json_object *rsp_json = NULL;	
    	json_object *pApconf = NULL;	
    	int nCheckTypRet = FALSE, nExeRet = TRUE;
    	char szCmd[256] = {0};
    	char ret_ssh[BUF_SIZE_64] = {0};
    	char ret_telnet[BUF_SIZE_64] = {0};
    	char ret_ftp[BUF_SIZE_64] = {0};
    	char *json_val = NULL;
    	char out_buf[128] = {0};
    	int  telnet_pid = -999;
    
    	*pResult = FALSE;
    	
    	rsp_json = json_object_new_object();
    	CHECK_NEW_JSON(rsp_json);
    	
    	json_object_object_foreach(pJsonReq, key, val)
    	{
    		json_val = json_object_get_string(val);
    
    	
    		my_printf(LOG_MODE_LEVEL_3, "%s(%d) ,key:%s val:%s\n",__FUNCTION__,__LINE__,key,json_object_get_string(val));	
    
    		if (strcmp(key, "SSH") == 0) //22
    		{
    			GetNVRamData("/etc/config/CusCMCfg.globalValue.SSH",ret_ssh,BUF_SIZE_64); 
    			my_printf(LOG_MODE_LEVEL_3, "%s(%d) SSH %s   ret_ssh:%s\n",__FUNCTION__,__LINE__,json_val,ret_ssh);
    			if(openUtil_strcmp(json_val,"On") == 0)
    			{
    				if(openUtil_strcmp(ret_ssh,"Off") == 0)//current status is off,so switch to on
    				{
    					my_printf(LOG_MODE_LEVEL_3, "%s(%d) SSH %s\n",__FUNCTION__,__LINE__,json_val);
    					system("uci set /etc/config/dropbear.@dropbear[0].enable=1"); // 1 is open,defalut is 1
    					system("uci commit /etc/config/dropbear");
    					sleep(1);
    					system("/etc/init.d/dropbear restart");
    					//my_printf(LOG_MODE_LEVEL_3, "%s(%d) SSH /etc/init.d/dropbear restart 1\n",__FUNCTION__,__LINE__);
    					sleep(1);
    
    					memset(out_buf, 0x0, sizeof(out_buf));
    					get_system_output("netstat -nap | grep \":22\"",out_buf,sizeof(out_buf));
    					my_printf(LOG_MODE_LEVEL_3, "%s(%d) out_buf=%s\n",__FUNCTION__,__LINE__, out_buf);	
    
    					if( openUtil_strlen(out_buf) != 0 )
    					{
    						system("uci set /etc/config/CusCMCfg.globalValue.SSH='On'");
    						system("uci commit /etc/config/CusCMCfg");
    					}
    
    				}
    
    			}
    			else //Off
    			{
    				if(openUtil_strcmp(ret_ssh,"On") == 0)//current status is on,so switch to off
    				{
    					my_printf(LOG_MODE_LEVEL_3, "%s(%d) SSH %s\n",__FUNCTION__,__LINE__,json_val);
    					system("uci set /etc/config/dropbear.@dropbear[0].enable=0");
    					system("uci commit /etc/config/dropbear");
    					sleep(1);
    					system("/etc/init.d/dropbear stop");
    					//cprintf("%s(%d) SSH /etc/init.d/dropbear stop 0\n",__FUNCTION__,__LINE__);
    					
    					system("uci set /etc/config/CusCMCfg.globalValue.SSH='Off'");
    					system("uci commit /etc/config/CusCMCfg");	
    				}
    			}
    		}
    		else if (strcmp(key, "Telnet") == 0) //23
    		{
    			GetNVRamData("/etc/config/CusCMCfg.globalValue.Telnet",ret_telnet,BUF_SIZE_64); 
    			my_printf(LOG_MODE_LEVEL_3, "%s(%d) Telnet %s   ret_telnet:%s\n",__FUNCTION__,__LINE__,json_val,ret_telnet);
    			if(openUtil_strcmp(json_val,"On") == 0)
    			{
    				if(openUtil_strcmp(ret_telnet,"Off") == 0)//current status is off,so switch to on
    				{
    					my_printf(LOG_MODE_LEVEL_3, "%s(%d) Telnet %s\n",__FUNCTION__,__LINE__,json_val);
    					system("/usr/sbin/telnetd -l /bin/login.sh");
    					//cprintf("%s(%d) Telnet /usr/sbin/telnetd -l /bin/login.sh\n",__FUNCTION__,__LINE__);
    					//system("uci set /etc/config/CusCMCfg.globalValue.Telnet='On'");
    					//system("uci commit /etc/config/CusCMCfg");
    					sleep(1);
    
    					memset(out_buf, 0x0, sizeof(out_buf));
    					get_system_output("netstat -nap | grep \":23\"",out_buf,sizeof(out_buf));
    					my_printf(LOG_MODE_LEVEL_3, "%s(%d) out_buf=%s\n",__FUNCTION__,__LINE__, out_buf); 
    					
    					if( openUtil_strlen(out_buf) != 0 )
    					{
    						system("uci set /etc/config/CusCMCfg.globalValue.Telnet='On'");
    						system("uci commit /etc/config/CusCMCfg");
    					}
    				}
    			}
    			else //Off
    			{
    				if(openUtil_strcmp(ret_telnet,"On") == 0)//current status is On,so switch to Off					{
    				{
    					get_system_output("ps | grep \"telnetd\" | grep \"login.sh\" |  awk '{print $1}'",out_buf,sizeof(out_buf));
    					telnet_pid = atoi(out_buf);
    					my_printf(LOG_MODE_LEVEL_3, "%s(%d) out_buf:%s  telnet_pid:%d\n",__FUNCTION__,__LINE__,out_buf,telnet_pid);
    					sprintf(szCmd, "kill %d", telnet_pid);
    					my_printf(LOG_MODE_LEVEL_3, "%s(%d) szCmd:%s \n",__FUNCTION__,__LINE__,szCmd);
    					system(szCmd);	
    					//my_printf(LOG_MODE_LEVEL_3, "%s(%d) Telnet %s\n",__FUNCTION__,__LINE__,json_val);
    					system("uci set /etc/config/CusCMCfg.globalValue.Telnet='Off'");
    					system("uci commit /etc/config/CusCMCfg");				
    				}
    			}
    		}
    		else if (strcmp(key, "FTP") == 0) //21
    		{
    			GetNVRamData("/etc/config/CusCMCfg.globalValue.FTP",ret_ftp,BUF_SIZE_64); 
    			my_printf(LOG_MODE_LEVEL_3, "%s(%d) FTP %s   ret_ftp:%s\n",__FUNCTION__,__LINE__,json_val,ret_ftp);
    			if(openUtil_strcmp(json_val,"On") == 0)
    			{
    				if(openUtil_strcmp(ret_ftp,"Off") == 0)//current status is off,so switch to on
    				{
    					my_printf(LOG_MODE_LEVEL_3, "%s(%d) FTP %s\n",__FUNCTION__,__LINE__,json_val);
    					system("sed -i 's/listen=NO/listen=YES/g' /etc/vsftpd.conf");
    					sleep(1);
    					system("/etc/init.d/vsftpd restart");
    					//my_printf(LOG_MODE_LEVEL_3, "%s(%d) FTP /etc/init.d/vsftpd restart YES\n",__FUNCTION__,__LINE__);		
    					//system("uci set /etc/config/CusCMCfg.globalValue.FTP='On'");
    					//system("uci commit /etc/config/CusCMCfg");
    					sleep(1);
    
    					memset(out_buf, 0x0, sizeof(out_buf));
    					get_system_output("netstat -nap | grep \":21\"",out_buf,sizeof(out_buf));
    					my_printf(LOG_MODE_LEVEL_3, "%s(%d) out_buf=%s\n",__FUNCTION__,__LINE__, out_buf); 
    					
    					if( openUtil_strlen(out_buf) != 0 )
    					{
    						system("uci set /etc/config/CusCMCfg.globalValue.FTP='On'");
    						system("uci commit /etc/config/CusCMCfg");
    					}
    
    				}
    			}
    			else //Off
    			{	
    				if(openUtil_strcmp(ret_ftp,"On") == 0)//current status is on,so switch to off
    				{
    					my_printf(LOG_MODE_LEVEL_3, "%s(%d) FTP %s\n",__FUNCTION__,__LINE__,json_val);
    					//system("/etc/init.d/vsftpd stop");
    					//cprintf("%s(%d) FTP /etc/init.d/vsftpd stop\n",__FUNCTION__,__LINE__);
    					system("sed -i 's/listen=YES/listen=NO/g' /etc/vsftpd.conf");
    					sleep(1);
    					system("/etc/init.d/vsftpd stop");
    					//my_printf(LOG_MODE_LEVEL_3, "%s(%d) FTP /etc/init.d/vsftpd stop NO\n",__FUNCTION__,__LINE__);
    					system("uci set /etc/config/CusCMCfg.globalValue.FTP='Off'");
    					system("uci commit /etc/config/CusCMCfg");
    				}
    			}
    		}	
    		
    		nCheckTypRet = TRUE;
    	}
    	my_printf(LOG_MODE_LEVEL_3, "%s(%d) ManagementSetting.....set...ok \n",__FUNCTION__,__LINE__);			
    	
    	json_object_object_add(rsp_json, COMM_RSP_STATUS, json_object_new_string(((nCheckTypRet != FALSE) ? COMM_RSP_SUCCESS : COMM_RSP_FAIL)));
    	json_object_object_add(rsp_json, COMM_MSG_CODE, json_object_new_string(((nCheckTypRet != FALSE) ? COMM_MSG_0000 : COMM_MSG_2001)));
    	json_object_object_add(rsp_json, COMM_RESULT, json_object_new_string(((nExeRet != 0) ? COMM_RESULT_OK : COMM_RESULT_ERROR)));
    
    	//rsp_json buffer is released in the next function
    	return ConstructFinalBuffer(pResult, MANAGEMENT_REQ, &rsp_json, pOutBuf, pOutLen);
    }

[70]: /images/20220519/b08311e6f2b34e03955dca50c6f1d3b4.png
[Link 1]: http://www.right.com.cn/forum/thread-190265-1-1.html
[70 1]: /images/20220519/66d3bb6b1a6845a2aeacfd9396e35847.png
[http_www.cnblogs.com_double-win_p_3848797.html]: http://www.cnblogs.com/double-win/p/3848797.html
[70 2]: /images/20220519/b31329f8fe5449b289ffdbba58dabb24.png
[https_wiki.openwrt.org_doc_howto_ftp.overview]: https://wiki.openwrt.org/doc/howto/ftp.overview
[https_blog.csdn.net_kingwan560_article_details_52209705]: https://blog.csdn.net/kingwan560/article/details/52209705
[70 3]: /images/20220519/3f61ba99a79b46ccbb86c471fc4eaf7d.png
[https_wiki.openwrt.org_doc_uci_dropbear]: https://wiki.openwrt.org/doc/uci/dropbear
[70 4]: /images/20220519/f94c39c670fc49a786e1699503a9bbb8.png
[70 5]: /images/20220519/cb359d9fcbef460a9160a114b4ac14c8.png
[70 6]: /images/20220519/7d194f34421a49258b26c5a2600b038b.png
[70 7]: /images/20220519/b9231782bf1a4e0d9549fdcfc97ee667.png