HOWTO : Create a FTP server with user access (proftpd)

[frodon]

You have one in your own home directory. I mean that you should set the same umask for your whole ubuntu system as proftpd never overwrite your ubuntu system settings. That's why i told you that you should set a "umask 022" for your ubuntu system too.
You can type the command in the terminal directly or put it in your .bashrc file if you wish this command to be executed automatically each time you open your terminal.

Not sure it will solve your problem but it is something you should try first.

[mcleod9]

Wow, there is a ton of useful information and generous people here. Thanks very much!

I couldn't find the answer to this issue:

I seem to connect to my server from outside my LAN, but this error comes up:

Command: CWD /home/FTP-shared/
Response: 550 /home/FTP-shared/: No such file or directory
Error: Failed to retrieve directory listing

the /home/FTP-shared directory does exist though...any thoughts?

[frodon]

My guess is rights problems on this folder (if you didn't modify the original configuration i gave in first post, if you did please post it).
At the is step you are connected to your server which mean that you global config is ok however the user loged in don't have enough rights to see the directories there.

Check the rights of you FTP directories, it should be 777 for upload directories and 755 for download directories, 755 is enough for the FTP-shared directory.

[mcleod9]

@Frodon -- Thanks for your thoughts. I have slightly modified the original proftpd config file, maingly to change the port and UserAlias.

The permissions are ok on my installation, so I'm not sure what's wrong.

Here's the config file. Thanks again!

#
# Includes required DSO modules. This is mandatory in proftpd 1.3
#
Include /etc/proftpd/modules.conf
# /etc/proftpd.conf -- This is a basic ProFTPD configuration file.
# To really apply changes reload proftpd after modifications.
#

ServerName "mouse"
ServerType standalone
DeferWelcome on

MultilineRFC2228 on
DefaultServer on
ShowSymlinks off

TimeoutNoTransfer 600
TimeoutStalled 100
TimeoutIdle 2200
TimeoutLogin 20

# It's better for debug to create log files
ExtendedLog /var/log/ftp.log
TransferLog /var/log/xferlog
SystemLog /var/log/syslog.log

DisplayLogin welcome.msg
DisplayFirstChdir .message
ListOptions "-l"

DefaultRoot /home/FTP-shared
#IdentLookups off
#ServerIdent off

# Lock all the users in home directory, ***** really important *****
# DefaultRoot ~

RootLogin off

MaxLoginAttempts 3

UseFtpUsers off

DenyFilter \*.*/

# Allow to restart a download
AllowStoreRestart on

# Uncomment this if you are using NIS or LDAP to retrieve passwords:
#PersistentPasswd off

# Uncomment this if you would use TLS module:
TLSEngine on

# Uncomment this if you would use quota module:
#Quotas on

# Uncomment this if you would use ratio module:
#Ratios on

# Port 21 is the standard FTP port.
Port 2121

MaxInstances 8

MasqueradeAddress xxxxxxx.org
MasqueradeAddress xx.xxx.xxx175
PassivePorts 60000 60100

PersistentPasswd off

MaxClients 8
MaxClientsPerHost 8
MaxClientsPerUser 8
MaxHostsPerUser 8

# Display a message after a successful login
AccessGrantMsg "welcome to the SFTP Server"

# To prevent DoS attacks, set the maximum number of child processes
# to 30. If you need to allow more than 30 concurrent connections
# at once, simply increase this value. Note that this ONLY works
# in standalone mode, in inetd mode you should use an inetd server
# that allows you to limit maximum number of processes per service
# (such as xinetd)
# MaxInstances 10

# Set the user and group that the server normally runs at.
User nobody
Group nogroup

#VALID LOGINS
<Limit LOGIN>
AllowUser userftp
DenyALL
</Limit>

# Umask 022 is a good standard umask to prevent new files and dirs
# (second parm) from being group and world writable.
Umask 022 022
# Normally, we want files to be overwriteable.
AllowOverwrite on
AuthAliasOnly on

UserAlias share userftp

# Delay engine reduces impact of the so-called Timing Attack described in
# http://security.lss.hr/index.php?pag...LSS-2004-10-02
# It is on by default.
#DelayEngine off

<Directory /home/FTP-shared>
Umask 022 022
AllowOverwrite off
<Limit MKD STOR DELE XMKD RNRF RNTO RMD XRMD>
DenyAll
</Limit>
</Directory>

<Directory /home/FTP-shared/download/*>
Umask 022 022
AllowOverwrite off
<Limit MKD STOR DELE XMKD RNEF RNTO RMD XRMD>
DenyAll
</Limit>
</Directory>

<Directory> /home/FTP-shared/upload/>
Umask 022 022
AllowOverwrite on
<Limit READ RMD DELE>
DenyAll
</Limit>

<Limit STOR CWD MKD>
AllowAll
</Limit>
</Directory>

<IfModule mod_tls.c>
TLSEngine on
TLSLog /var/ftpd/tls.log
TLSProtocol TLSv1

# Are clients required to use FTP over TLS when talking to this server?
TLSRequired on

# Server's certificate
TLSRSACertificateFile /etc/ftpcert/server.crt
TLSRSACertificateKeyFile /etc/ftpcert/server.key

# CA the server trusts
TLSCACertificateFile /etc/ftpcert/ca.crt

# Authenticate clients that want to use FTP over TLS?
TLSVerifyClient off
</IfModule>

[frodon]

Hum, you broke all the security of the server commenting the defaultroot line, users will be able to browse your whole computer if you comment this line, i prefer to warn you that it is in general a really unsafe configuration.

Except this your config file looks ok so i would check the directory permissions on your system.

[mcleod9]

Hum, you broke all the security of the server commenting the defaultroot line, users will be able to browse your whole computer if you comment this line, i prefer to warn you that it is in general a really unsafe configuration.

Except this your config file looks ok so i would check the directory permissions on your system.

Thanks Frodon. The permissions are all as you have written, but it still doesn't work :\ Same message about the directory not existing.

[bionnaki]

so, how do people connect to the ftp server if you do not have a static ip?

[frodon]

In this case use a domain name, dyndns can provide you one for free. To keep your domain name up to date you can use ddclient or the script made for dyndns, o think i have left some links about this in first post.

@mcleod9, it is strange, i don't see for the moment what could be wrong. I still think there's somewhere a too restrictive permission which block the directory listing. I will try to review this again as soon as i get some free time this week.

[krelkor]

thanks for the tutorial, but i have a little problem

im trying to setup an FTP server so that i can backup a log from my router

i can login fine, but i cannot upload anything to the directory /data/FTP/ nor can i see anything within that directory from within my ftp client on another machine

here is the output form ls -la

drwxrwxrwx 2 wrt54g wrt54g 4096 2008-01-04 17:22 FTP



and here is my .conf

AllowOverwrite on
AuthAliasOnly off

UseReverseDNS off
IdentLookups off

# Choose here the user alias you want !!!!
UserAlias steve wrt54g

ServerName "server"
ServerType standalone
DeferWelcome off

MultilineRFC2228 on
DefaultServer on
ShowSymlinks off

TimeoutNoTransfer 600
TimeoutStalled 100
TimeoutIdle 2200

#DisplayFirstChdir .message
ListOptions "-l"

RequireValidShell off

TimeoutLogin 20

RootLogin off

# It's better for debug to create log files
ExtendedLog /var/log/ftp.log
TransferLog /var/log/xferlog
SystemLog /var/log/syslog.log

#DenyFilter \*.*/

# I don't choose to use /etc/ftpusers file (set inside the users you want to ban, not useful for me)
UseFtpUsers off

# Allow to restart a download
AllowStoreRestart on

# Port 21 is the standard FTP port, so you may prefer to use another port for security reasons (choose here the port you want)
Port 21

# To prevent DoS attacks, set the maximum number of child processes
# to 30. If you need to allow more than 30 concurrent connections
# at once, simply increase this value. Note that this ONLY works
# in standalone mode, in inetd mode you should use an inetd server
# that allows you to limit maximum number of processes per service
# (such as xinetd)
MaxInstances 8

# Set the user and group that the server normally runs at.
User nobody
Group nogroup

# Umask 022 is a good standard umask to prevent new files and dirs
# (second parm) from being group and world writable.
Umask 022 022

PersistentPasswd off

MaxClients 8
MaxClientsPerHost 8
MaxClientsPerUser 8
MaxHostsPerUser 8

# Display a message after a successful login
#AccessGrantMsg "welcome !!!"
# This message is displayed for each access good or not
#ServerIdent on "you're at home"

# Set /home/FTP-shared directory as home directory
DefaultRoot /data/FTP

# Lock all the users in home directory, ***** really important *****
DefaultRoot ~

MaxLoginAttempts 5

#VALID LOGINS
<Limit LOGIN>
AllowUser wrt54g
DenyALL
</Limit>

<Directory /data/FTP>
Umask 022 022
AllowOverwrite off
<Limit MKD STOR DELE XMKD RNRF RNTO RMD XRMD>
DenyAll
</Limit>
</Directory>

[krelkor]

bump!