Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Im looking for some FTP server software for Debain 6.0 Squeeze that can support the following:

  • Username/password from MySQL.
  • Separates each user login into its own directory.
  • In the users directory, I need to be able to setup specific sub-directories that the user can have any combination of the following permissions on:
    • List files
    • Read files
    • Write files
    • Delete/over-write files
  • Also when a user uploads a file, I need to be able to set the files Linux permission flags/ownership
  • Preferably run in both secure (SFTP) and non secure modes

Does anyone have any recommendations for some software that can do most (if not all) of this?

share|improve this question

1 Answer 1

up vote 1 down vote accepted

Most of this is pretty straightforward. Either pure-ftpd-mysql or vsftpd+libpam-mysql can use (with enough configuring) a MySQL table for "virtual" users, chroot them to their own little directory, and configure incoming files' umask bits. Both can use SSL (FTPS) and can either force clients to use SSL or allow both insecure and secure logins.

The permissions will require some elbow grease. The obvious solution would be to use the unix filesystem permissions:

  • "x" bit on directories allows users to "enter" the directory
  • "r" bit on directories allows users to list the directory
  • "w" bit on directories allows users to create or delete files and subdirectories.
  • .... unless the sticky "t" bit is set, in which case they cannot delete files owned by someone else.
  • "r" bit on files allows users to read the file
  • "w" bit on files allows users to write to the file

There are two potential issues with this based on your requirements.

The smaller issue is the distinction between "writing" and "overwriting". Someone with write access to the file can erase all the data in the file (truncate it) and fill the file with completely different data. I'm not sure if the FTP protocol allows for this (resume from an offset of 0 perhaps?). Someone without write access to the file but with write access to the directory can delete the file and create a new file with the same filename.

The bigger issue is that creating and deleting files is a single flag. If you need to have files that users can't delete in the same directory as files they can, the easiest workaround is to create two users: an ftpuser user which all your virtual users will map to, and an ftpnodel user who will own all of the files you don't want them to delete but which nobody logs in as. Then, you set the sticky bit on all of the directories, chown the undeletable files to ftpnodel.

With this solution, you'd use the "user" rwx bits to control normal access to files and directories, and the "world" (aka "other") rwx bits to control access to the ftpnodel files.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.