Gentoo Forums
Gentoo Forums
Gentoo Forums
Quick Search: in
Proftp and multiple users
View unanswered posts
View posts from last 24 hours

 
Reply to topic    Gentoo Forums Forum Index Networking & Security
View previous topic :: View next topic  
Author Message
gouranga
Tux's lil' helper
Tux's lil' helper


Joined: 05 Aug 2005
Posts: 113

PostPosted: Sun Feb 05, 2006 4:21 pm    Post subject: Proftp and multiple users Reply with quote

What I want:
A users connects to the ftp-server and is automatically chrooted in his own homedir.
Is this possible with proftpd , and how?

I don't want the users to see the dirlisting of the home-folder, and having them to click their own folder.
Back to top
View user's profile Send private message
adaptr
Watchman
Watchman


Joined: 06 Oct 2002
Posts: 6730
Location: Rotterdam, Netherlands

PostPosted: Sun Feb 05, 2006 8:43 pm    Post subject: Reply with quote

You can do both.
The drawback to using chrooting is that you can never link to a folder outside their home dir (to give read access to other stuff, for example.)
It's really very simple: set the initial folder to something inside their home dir (like ~/ftp for example) and deny access from the root on down.
Then you follow the sample config to allow them to access their home dir.

Much more flexible than using chrooting.
_________________
>>> emerge (3 of 7) mcse/70-293 to /
Essential tools: gentoolkit eix profuse screen
Back to top
View user's profile Send private message
gouranga
Tux's lil' helper
Tux's lil' helper


Joined: 05 Aug 2005
Posts: 113

PostPosted: Mon Feb 06, 2006 12:28 pm    Post subject: Reply with quote

A config example would be handy.

*Update*
Code:

DefaultRoot ~


But now I have another problem, passv hangs...

Code:

localhost (84.194.47.254[84.194.47.254]) - unable to find open port in PassivePorts range 49152-49155: defaulting to INPORT_ANY
localhost (84.194.47.254[84.194.47.254]) - Entering Passive Mode (192,168,1,113,128,85).


When the DefaultRoot was /dir1/
everything was working fine, and that the only directive I changed.
Back to top
View user's profile Send private message
adaptr
Watchman
Watchman


Joined: 06 Oct 2002
Posts: 6730
Location: Rotterdam, Netherlands

PostPosted: Tue Feb 07, 2006 7:44 pm    Post subject: Reply with quote

Nonono, don't use defaultroot!
At least, I don't use it, and you don't need it.
Use DefaultChDir to set an initial directory.
If you prohibit users from moving up through the directory tree like I said, you don't need (or want) a chroot.
_________________
>>> emerge (3 of 7) mcse/70-293 to /
Essential tools: gentoolkit eix profuse screen
Back to top
View user's profile Send private message
gouranga
Tux's lil' helper
Tux's lil' helper


Joined: 05 Aug 2005
Posts: 113

PostPosted: Thu Feb 09, 2006 11:20 am    Post subject: Reply with quote

Here is my config file.
The PASV transfer keeps doing nothing when defaultchdir is ~ of defaultroot is ~.
However, when I change it to /dir1/ everything is working.


Code:
# This is a basic ProFTPD configuration file (rename it to
# 'proftpd.conf' for actual use. It establishes a single server
# and a single anonymous login. It assumes that you have a user/group
# "nobody" and "ftp" for normal operation and anon.

ServerName "Customers-FTP"
ServerType Standalone
DeferWelcome off

ShowSymlinks off
MultilineRFC2228 on
DefaultServer on
AllowOverwrite on

TimeoutNoTransfer 600
TimeoutStalled 600
TimeoutIdle 1200

DisplayLogin welcome.msg
DisplayFirstChdir .message


DenyFilter \*.*/

# Uncomment this if you are using NIS or LDAP to retrieve passwords:
#PersistentPasswd off

# Port 21 is the standard FTP port.
Port 2100
PassivePorts 49152 49155
AllowForeignAddress on
# To prevent DoS attacks, set the maximum number of child processes
# to 30. If you need to allow more than 30 concurrent connections
# at once, simply increase this value. Note that this ONLY works
# in standalone mode, in inetd mode you should use an inetd server
# that allows you to limit maximum number of processes per service
# (such as xinetd)
MaxInstances 30

# Set the user and group that the server normally runs at.
User nobody
Group nogroup

# Normally, we want files to be overwriteable.
<Directory /*>
# Umask 022 is a good standard umask to prevent new files and dirs
# (second parm) from being group and world writable.
Umask 022 022

AllowOverwrite on
</Directory>

# here are my improvements

# chroot for all users of the group ftpuser
#DefaultRoot ~
#DefaultRoot ~ ftpcustomers
DefaultChDir ~

 <IfModule mod_clamav.c>
    # Enable virus scanning and removal
    ClamAV on
    ClamWarn On
  </IfModule>

# grant login only for members of the group
<Limit LOGIN>
DenyGroup !ftpcustomers
</Limit>

# disable root login and require a valid shell (from /etc/shells)
<Global>
RootLogin off
RequireValidShell Off

</Global>
# increase
UseReverseDNS off
IdentLookups off

# Logging formats
LogFormat default "%h %l %u %t \"%r\" %s %b"
LogFormat auth "%v [%P] %h %t \"%r\" %s"
LogFormat write "%h %l %u %t \"%r\" %s %b"

# activate logging

# every login
ExtendedLog /ftpbase/log/ftp_auth.log AUTH auth

# file/dir access
ExtendedLog /ftpbase/log/ftp_access.log WRITE,READ write

# forr paranoid (big logfiles!)
ExtendedLog /ftpbase/log/ftp_paranoid.log ALL default
   
Back to top
View user's profile Send private message
Display posts from previous:   
Reply to topic    Gentoo Forums Forum Index Networking & Security All times are GMT
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum