Configuring An FTP Server II

Summary:

• Allowing Anonymous Uploads
• Authenticated FTP
• More Security

Allowing Anonymous Uploads

To allow anonymous uploads, insert these lines into the 'Anonymous' section of your 'proftpd.conf' file:

<Directory incoming>
<Limit STOR CWD>
~AllowAll
</Limit>
<Limit READ RMD DELE MKD>
~DenyAll
</Limit>
</Directory>

and create as 'root' an 'incoming' directory in '/var/ftp' with write permissions for the 'ftp' user:

chmod 770 /var/ftp/incoming
chown ~ftp:ftp 1.1 $

The options in detail:

<Directory incoming>
<Limit STOR CWD>
~AllowAll
</Limit>

Anonymous users are allowed to change into (CWD) the 'incoming' directory and put files (STOR) there.

<Limit READ RMD DELE MKD SITE_CHMOD>
~DenyAll
</Limit>

But they are not allowed to read the contents of 'incoming' (but they may list the files), to delete or create or change permissions on files or directories in that directory. This prevents people from turning your 'incoming' directory into a warez relay.

section index

Authenticated FTP

Well, if you insist …

Full Accounts

Every user on the system running the FTP server can access their home directory via FTP logging in with their user name and password.

If you don't want that, i.e if you only want to allow anonymous access to the FTP server, add the directive

<Limit LOGIN>
~DenyAll
</Limit>

to the general section of 'proftpd.conf'.

Like with anonymous users, you can put authenticated users into a change rooted 'jail' by using the '~DefaultRoot' directive:

~DefaultRoot /var/ftp

will redirect all users logging in via FTP to the '/var/ftp' directory and 'jail' them in there (i.e. they won't be able to change into any directory outside the '/var/ftp' hierarchy).

Guest Accounts

In order to create a password protected anonymous login, a so-called 'guest account', you have to create a user account on the server with a password (e.g. using useradd or 'Userdrake'). The directive you need is '~AnonRequirePassword on'. Let's assume you have created the user account 'ftplogin'. Your 'Anonymous' section would then look like this:

<Anonymous ~ftp>
User ftplogin
Group ftp
~AnonRequirePassword on
~RequireValidShell off
<Limit WRITE>
~DenyAll
</Limit>
</Anonymous>

Now your anonymous FTP users have to login with the user name 'ftplogin' and the password you've provided when creating the account.

Security notice: you shouldn't provide that user account with a valid login shell. Use '/bin/false' instead, either by using the appropriate option to 'useradd' or in 'Userdrake', or by editing the file '/etc/passwd' after creating the account. With 'useradd', you'd do something like this (as 'root'):

useradd -d /var/ftp -s /bin/false -g ftp -p password ftplogin

This creates a user account 'ftplogin', group 'ftp', with the home directory '/var/ftp', the (invalid) shell '/bin/false' and the password password.

Adopting this configuration, you can create 'home directories' for particular users by creating accounts for them with home directories in the '/var/ftp' tree.

For more options and features like ratios, virtual servers etc, have a look at the fine ~ProFTPd documentation site, especially the FAQ.

section index

More Security

Running any kind of server for untrusted clients poses a security threat. If you want to do this, you are advised to follow security advisories closely, e.g. by subscribing to lists like the famous Bugtraq. Mandrakesoft also offers two security mailing lists, security-announce and security-discuss.

There are some more options for '/etc/proftpd.conf' which you should consider for the sake of security.

Restricting Access

You can restrict access to certain IP ranges or hostnames with the

Limit LOGIN

<Limit LOGIN>
Order Allow,Deny
Allow from 128.44.26.,myhost.mydomain.edu
Deny from all
</Limit>

Notice that you are advised to use IP addresses instead of domain names.

Setting Filters

~AllowFilter

~DenyFilter

~AllowFilter

~DenyFilter

~AllowFilter "^{a-zA-Z0-9 ,}*$"

lets only alphanumeric characters and the whitespace trough. A similar option is

~CommandBufferSize number

~PathAllowFilter

~PathDenyFilter

~PathDenyFilter "(^|/){-.}"

Limiting Resources

~ProFTPd lets you limit resources in various ways: you can limit the storage place, the number of connections, the amount of bytes transferred simultaneously and the resources for the server itself.

To prevent people from filling up the file system '/var/ftp/incoming' is on, you can set a quota with:

Quotas on<br> ~DefaultQuota bytes

Other quota options like

~QuotaExempt UID

setquota

To set a maximum number of simultaneous connections, you use the already mentioned

maxclients

~MaxClientsPerUser

To prevent certain kinds of Denial-of-Service or fork attacks, you can limit the number of child processes ~ProFTPd spawns (each child is one connection) with

~MaxInstances

~RateReadBPS

~RateReadFreeBytes

~RateReadHardBPS

~RateWriteBPS

~RateWriteFreeBytes

~RateWriteHardBPS

RLimitCPU

RLimitMemory

RLimitOpenFiles

Others

To make it harder for a potential attacker, you can hide the name of the software and its version either by giving

~ServerIdent

off

section index

Related Resources:

~ProFTPd Homepage
~ProFTPd FAQ
~ProFTPd User Guide
Directive List
Example configurations and more in '/usr/share/ doc/proftpd-{...}'

Revision / Modified: May 04, 2002
Author: Tom Berger

Legal: This page is covered by the GNU Free Documentation License. Standard disclaimers of warranty apply. Copyright LSTB and Mandrakesoft.