Setting Up FTP user accounts on Debian

Question

I'm trying to set up an FTP account on my server which is running a Debian install and proftpd. I'm in need of some basic commands that will allow me to view, edit, create ftp users. I'm also not clear on whether I need to then add these users specifically to proftpd or if just having them on the server is enough.

Ultimately, I'd like to have an FTP user that I can connect to with beanstalkapp, an svn deployment tool, so that it might deploy content to my /var/www/ directory.

Any help would be appreciated, even if it's just links to some shell commands that I should be using to view and update users.

Answer 1

ProFTPd does support the concept of FTP-only users. In order to make this work, you would need to first make the following changes to your proftpd.conf file:

AuthOrder mod_auth_unix.c mod_auth_file.c #add mod_auth_file.c
AuthUserFile /etc/proftpd/ftpasswd #Add this entire line

Make sure that the file /etc/proftpd/ftpasswd exists and is readable by the user that the proftpd daemon runs under.

In addition, you would need to add the following lines:

RequireValidShell off  
UseFtpUsers off

Restart the ProFTPd daemon. Your FTP service will now allow connections from FTP-only accounts. You can create your FTP-only account using the following syntax:

ftpasswd --passwd --file=/etc/proftpd/ftpasswd --name=ftpuser --uid=5001 --gid=5001 --home=/var/www/beanstalkapp --shell=/bin/false

Pay close attention to the options "--uid" and "--gid". If you supply a numeric value here that does not correspond to any existing user/group, the FTP user will have the same file permissions that the user running the proftpd daemon has (typically read-only access to most directories). If you wanted to allow the FTP user to be able to actually overwrite the files, set the uid to match the UID of the actual system user which owns the directory (Something I found out from another SF Question).

For additional security, you could also add the following lines to your proftpd.conf file:

<Directory "/var/www/beanstalkapp">
DirFakeUser on ~
DirFakeGroup on ~
</Directory>

This will trick the FTP client into showing the files as if owned by the FTP-user/FTP-group in the FTP User's root directory.

Answer 2

Why not use SSH/SFTP? It's much more secure than FTP and requires minimal configuration.

Answer 3

As far as I know, proFTPd uses system accounts by default. You just create system accounts with useradd and you should be good to go...

However, I am used to pure-ftpd, wherer there are commands to create 'virtual' users that map to the same system account, which is a philosophy I prefer.