HOWTO : Create a FTP server with user access (proftpd)

[jorge.maravi]

Hey Frodon
I just downloaded the filezilla client and it works great with the FTPES protocol....

Thanks for your help, and sorry for the initial post about the how-to was no up-to-date, actually it is and is great, sorry Frodo my bad

Only a question: with the FTPES protocol the authentication process will be encripted, but what about the data transmitted. is that encrypted too?

Thanks

[frodon]

np, you're welcome

With TLS encription all is encripted (authentification + datas) so you are safe transfering sensible datas with your FTP server. You can even force users to use FTPES using "TLSRequired on" but your friends will have to find a FTPES compliant client like filezilla.

[jorge.maravi]

Hi frodon if I am going to use a masquerade address (nat) in the proftpd.conf file i should add the fields: MasqueradeAddress and PassivePorts right?
The MasqueradeAddress should be the public IP address (IP in the internet) right?

[frodon]

Yes it should be your IP or domain name, however i'm not expert on this as i don't have NAT configuration myself.

[sotoskawasaki]

Ok, I followed your tutorial and everything is working just fine! Great tut!!
I am using xampp 1.6.6 on Kubuntu 8.04. Thanks..

[arvvvs]

I can't connect using FileZilla and i've used everything I can. I have tried other clients and can't connect
this is my thing:
ServerType standalone
DefaultServer on
Umask 022
ServerName "192.168.1.3"
ServerIdent off "My FTPD"
ServerAdmin arvvvs@gmail.com
IdentLookups off
UseReverseDNS off
Port 21
PassivePorts 49152 65534
#MasqueradeAddress None
TimesGMT off
MaxInstances 30
MaxLoginAttempts 3
TimeoutLogin 300
TimeoutNoTransfer 120
TimeoutIdle 120
DisplayLogin welcome.msg
User nobody
Group nobody
DirFakeUser off nobody
DirFakeGroup off nobody
DefaultTransferMode binary
AllowForeignAddress off
AllowRetrieveRestart on
AllowStoreRestart on
DeleteAbortedStores off
TransferRate RETR 30
TransferRate STOR 40
TransferRate STOU 40
TransferRate APPE 40
SystemLog /var/log/secure
RequireValidShell off
#gp_random_username_length 6
#gp_random_password_length 6
#gp_randomize_case lower
#gp_useradd_homedir_path /var/ftp
#gp_html_path /var/www/html/ftp.htm
#gp_welcome_name welcome.msg
<IfModule mod_tls.c>
TLSEngine off
TLSRequired off
TLSVerifyClient off
TLSProtocol TLSv1
TLSLog /var/log/proftpd_tls.log
TLSRSACertificateFile /etc/gproftpd/gproftpd.pem
</IfModule>
<IfModule mod_ratio.c>
Ratios off
SaveRatios off
RatioFile "/restricted/proftpd_ratios"
RatioTempFile "/restricted/proftpd_ratios_temp"
CwdRatioMsg "Please upload first!"
FileRatioErrMsg "FileRatio limit exceeded, upload something first..."
ByteRatioErrMsg "ByteRatio limit exceeded, upload something first..."
LeechRatioMsg "Your ratio is unlimited."
</IfModule>
<Limit LOGIN>
AllowUser userftp
AllowUser userftp
AllowUser arvvvs
DenyALL
</Limit>

<Anonymous /var/ftp>
User userftp
Group FTP
AnonRequirePassword on
MaxClients 3 "The server is full, hosting %m users"
DisplayLogin welcome.msg
AllowOverwrite off
<Limit LOGIN>
Allow from all
Deny from all
</Limit>
<Limit RETR LIST NLST MDTM SIZE STAT CWD XCWD PWD XPWD CDUP XCUP>
AllowAll
</Limit>
<Limit DELE APPE STOR STOU SITE_CHMOD SITE_CHGRP RNFR RNTO MKD XMKD RMD XRMD>
DenyAll
</Limit>
</Anonymous>

<Anonymous /home/FTP>
User userftp
Group FTP
AnonRequirePassword on
MaxClients 5 "The server is full, hosting %m users"
DisplayLogin welcome.msg
<Limit LOGIN>
Allow from all
Deny from all
</Limit>
AllowOverwrite off
<Limit LIST NLST RETR SITE_CHMOD PWD XPWD SIZE STAT CWD XCWD CDUP XCUP >
AllowAll
</Limit>
<Limit STOR STOU APPE RNFR RNTO DELE MKD XMKD SITE_MKDIR RMD XRMD SITE_RMDIR SITE SITE_CHGRP MTDM >
DenyAll
</Limit>
</Anonymous>

<Anonymous /home/FTP>
User arvvvs
Group FTP
AnonRequirePassword on
MaxClients 5 "The server is full, hosting %m users"
DisplayLogin welcome.msg
<Limit LOGIN>
Allow from all
Deny from all
</Limit>
<Limit LIST NLST RETR SITE_CHMOD PWD XPWD SIZE STAT CWD XCWD CDUP XCUP >
AllowAll
</Limit>
<Limit STOR STOU APPE RNFR RNTO DELE MKD XMKD SITE_MKDIR RMD XRMD SITE_RMDIR SITE SITE_CHGRP MTDM >
DenyAll
</Limit>
</Anonymous>

[jorge.maravi]

Hi
I have my ftp server connected to the internet when i try to connect using the ftp protocol it works fine, but when i try to use the FTPES protocol it fails. This is my log's output in my client:
13:42:19 Trace: ControlSocket.cpp(1057): CRealControlSocket::ContinueConnect(0p22dcc8) m_pEngine=0p128f6d8 caller=0p1332b60
13:42:19 Status: Connecting to <my-ip-address>:21...
13:42:19 Status: Connection established, waiting for welcome message...
13:42:33 Trace: CFtpControlSocket::OnReceive()
13:42:33 Response: 220 ProFTPD 1.3.0 Server ready.
13:42:33 Trace: CFtpControlSocket::SendNextCommand()
13:42:33 Command: AUTH TLS
13:42:33 Trace: CFtpControlSocket::OnReceive()
13:42:33 Response: 234 AUTH TLS successful
13:42:33 Status: Initializing TLS...
13:42:33 Trace: CTlsSocket::Handshake()
13:42:33 Trace: CFtpControlSocket::SendNextCommand()
13:42:33 Command: USER <user-name>
13:42:34 Trace: CTlsSocket::OnSocketEvent(): wxSOCKET_LOST received
13:42:34 Trace: CRealControlSocket::OnClose()
13:42:34 Trace: CFtpControlSocket::ResetOperation(66)
13:42:34 Trace: CControlSocket::ResetOperation(66)
13:42:34 Error: Could not connect to server
13:42:34 Status: Waiting to retry...

I checked the proftpd mini how-to and they said there is a problem with TSL and NAT and that is fixable if you add this in the config file: TLSRequired auth+data(to use the Clear Command Channel) I tried to add this in my config file but it threw an error when i restart the daemon.

Is there any way to force this in a proftod server ver 1.3.0?

Thanks

[jorge.maravi]

frodon u there?

[frodon]

Yep, but there's nothing i can do for you, i don't use NAT on my home config. In your case i would try at least once to regenerate the rsa key.

Maybe some users who used this howto and who use a NAT can help you.

[jorge.maravi]

I already figured out the problem. It was a port problem in my dsl modem.
If I want that my internal clients access to my FTP server behind my dsl modem i have to create a virtual server right?

Why when i try to connect from my internal IP addresses to my internet IP address my clients fail to connect to the FTP server?