HOWTO : Create a FTP server with user access (proftpd)

[Hawkowl]

My setup is a little different from most.
I have a webserver that i want to allow users to update their own webpages on by FTP.

I have installed Proftp as per the early directions but changed some of it in an attempt to get access to a folder called testftp which resides in this folder /var/www/xxxxxxxxx/ftptest

I have set up a test user called fred with a password flintstone in system User and Groups.

this is a copy of my proftp.conf file, does it look ok?
and is this setup of mine the best way to go about this thing?

# To really apply changes reload proftpd after modifications.
AllowOverwrite on
AuthAliasOnly on

# Choose here the user alias you want !!!!
UserAlias hawkowl userftp

ServerName			"xxxxxxx"
ServerType 			standalone
DeferWelcome			on

MultilineRFC2228 on
DefaultServer			on
ShowSymlinks			off

TimeoutNoTransfer 600
TimeoutStalled 100
TimeoutIdle 2200

DisplayFirstChdir               .message
ListOptions                	"-l"

RequireValidShell 		off

TimeoutLogin 20

RootLogin 			off

# It's better for debug to create log files ;-)
ExtendedLog 			/var/log/ftp.log
TransferLog 			/var/log/xferlog
SystemLog			/var/log/syslog.log

#DenyFilter			\*.*/

# I don't choose to use /etc/ftpusers file (set inside the users you want to ban, not useful for me)
UseFtpUsers off

# Allow to restart a download
AllowStoreRestart		on

# Port 21 is the standard FTP port
Port				21

# To prevent DoS attacks, set the maximum number of child processes
# to 30.  If you need to allow more than 30 concurrent connections
# at once, simply increase this value.  Note that this ONLY works
# in standalone mode, in inetd mode you should use an inetd server
# that allows you to limit maximum number of processes per service
# (such as xinetd)
MaxInstances 8

# Set the user and group that the server normally runs at.
User                  nobody
Group                 nogroup

# Umask 022 is a good standard umask to prevent new files and dirs
# (second parm) from being group and world writable.
Umask				022	022

PersistentPasswd		off

MaxClients 8
MaxClientsPerHost 8
MaxClientsPerUser 8
MaxHostsPerUser 8

# Display a message after a successful login
AccessGrantMsg "welcome !!!"
# This message is displayed for each access good or not
ServerIdent                  on       "you're at home"

# Set /home/FTP-shared directory as home directory
DefaultRoot /var/www/downtowncentral/ftptest

# Lock all the users in home directory, ***** really important *****
DefaultRoot ~

MaxLoginAttempts    5

#VALID LOGINS
<Limit LOGIN>
AllowUser userftp
DenyALL
</Limit>

<Directory /var/www/downtowncentral/ftptest>
Umask 022 022
AllowOverwrite off
	<Limit MKD STOR DELE XMKD RNRF RNTO RMD XRMD>
	DenyAll
	</Limit>
</Directory>

<Directory /var/www/downtowncentral/ftptest/download/*>
Umask 022 022
AllowOverwrite off
	<Limit MKD STOR DELE XMKD RNEF RNTO RMD XRMD>
	DenyAll
	</Limit>
</Directory>

<Directory> /var/www/downtowncentral/ftptest/upload/>
Umask 022 022
AllowOverwrite on
	<Limit READ RMD DELE>
      	DenyAll
    	</Limit>

    	<Limit STOR CWD MKD>
      	AllowAll
    	</Limit>
</Directory>

[frodon]

It looks all good for me, don't forget to set /var/www/downtowncentral/ftptest as home directory for your user fred and to give the good rights the directory you use for the ftp (755 for a dowload directory and 777 for an upload directory).

[Coogan]

I need some help. I don't know what I did, but as early as this morning I was able to upload to my ftp server with no problem, and now all of a sudden I cannot upload or download to/from it. I've removed and reinstalled proftp using the steps in the 1st post, and removed and recreated the userftp account, but it's still not working.

My conf file was a cut 'n paste straight from the 1st post, with some minor changes (I changed the home dir from FTP-shared to just ftp) and I changed the server name, user alias, and port. I'm 99% sure it's a permissions problem but can't figure out why.

Coog

[frodon]

Be sure to give 755 rights to your ftp directory and dowload directory and 777 rights for your upload directory.
Post your conf file if you changed something, sometimes a typo may be hard to see and it easier if several people have a look to it.

[Tavathlon]

Hello everyone!

I'd like to begin with saying that I'm impressed over your dedication to this thread, rodon! I've just read the whole thread, and people seldom have to wait for long before you give them a good answer - creds to you!

However, in spite of reading the whole thread, I still have one question - the same one that made me search this thread.

In the original howto, you refer to a simple way of mounting folders into the folder that my ftp-users may access (which is their own respective home folders). In fstab, this line should be added:

'the_directory_to_mount /home/FTP-shared/download vfat bind 0 0'

I have used this kind of hard linking for about a year, and it works really well! (however I mount the folder into every users home folder instead, since that is the only part of my computer that they may access) However, as it is now, all users have complete access to the folder I mount into their home directory. I want them to have full access to their own Home, but I don't want them to be able to write or delete in the folder I mount into their Home - I only want them to have read access there. I've tried to use the umask function to limit their access in the mounting atself, but without any success. The line in fstab looks like this right now:


'the_directory_to_mount /home/user/name_of_folder vfat bind,umask=777 0 0'

I've also tried umask=000, umask=222 and so on... But the users always have full access anyway.

Am I making the umask thing wrong? Is there any way to achieve the same goal by configuring proftpd.conf?

Unfortunately, I cannot just simply chmod the directory - I don't know why, but I cannot, even if I am root. It just simply doesn't work. On the other hand, it doesn't really matter, because I want _some_ users so have full access to the same folder.

Finally, I do not use gproftpd, and I do not intend to either, mostly because I think it works fine the old way. There is only one function in gproftpd that I would like to have, and that is the logging of what users are online, and what did they download/upload. But nah, that doesn't really matter that much... =P

Hope to get some help with this problem, it would be really nice to have my stored files secured!

[frodon]

Hi and thanks for being so kind with me.

There is only one function in gproftpd that I would like to have, and that is the logging of what users are online, and what did they download/upload. But nah, that doesn't really matter that much... =P

Open a terminal and type ftptop while your ftp server is running, you will see who is connected on the server in real time and what he's downloading, if you press the character t you will even see the transfert rate.
There also the ftpwho command which gave you the same kind of information but not in real time.

If you want to prevent write and deletion in a folder just modify the section corresponding to this folder in your proftpd.conf file.
For example the download directory on my guide :

<Directory /home/FTP-shared/download/*>
Umask 022 022
AllowOverwrite off
	<Limit MKD STOR DELE XMKD RNEF RNTO RMD XRMD>
	DenyAll
	</Limit>
</Directory>

The parameters DELE and RMD are denied therefore the users will not be able to delete a file or a directory in the coreesponding folder.

See the limit page on the proftpd site for more details :
http://www.proftpd.org/localsite/Use...ref_Limit.html

[Tavathlon]

*pointing at the two most recent posts* 10 hours. That _is_ impressive!

The commands ftptop and ftpwho were really useful, thanks a lot! Someone told me once that such information was not available in proftpd, but apparently they were wrong.

However, the limit configuration did not work =/ (and yes, I did restart the server before I tried it out )
I've been looking at the limit configuration before, but didn't really understand how it worked back then. This time, I copied the text in your post straight off, but it didn't work. (I changed the directory, of course.)

I'm not quite sure why the limit does not work, but on the other hand, the umask should have worked too...

[frodon]

Could you post your proftpd.conf file and tell me the name and path of the directories you want to protect from DEL and RMD commands ?
I'll have a look to it and see if something sounds wrong in your config file.

[Tavathlon]

Absolutely. The path to the directory (or rather an example - there are as many as I have ftp-users, but I use this particular one for testing)

Thanks a lot!

[Tavathlon]

By the way, the directory that is linked into user morot's home folder is actually a HD mounted at another spot. I'm not sure whether that might make any difference?