2

I would appreciate if there is anybody who can advise me if the following FTP configuration is possible. I need range of read-only users that follow this pattern:

(_[0-9]{15})

e.g., _012345678901234 that will use same password without creating all possible combinations. The use case is the following - we provisioning devices and they are using FTP to download new version of firmware. In the log I can see both username and password used to download files. The main goal is to have device serial number in the log.

I did not find a way to specify wildcard for username. Currently we have anonymous access only, but it's obviously not good enough.

1 Answer 1

2

In ProFTPD there is no straightforward way to specify a wildcard for a username. However you can use mod_sql to authenticate your users and customize queries used to get user info.

Example of custom queries taken from ProFTPD docs:

SQLAuthenticate users groups usersetfast
SQLUserInfo custom:/get-user-by-name/get-user-by-id/get-user-names/get-all-users
SQLNamedQuery get-user-by-name SELECT "userid, passwd, uid, gid, homedir, shell FROM users WHERE userid = '%U'"
SQLNamedQuery get-user-by-id SELECT "userid, passwd, uid, gid, homedir, shell FROM users WHERE uid = %{0}"
SQLNamedQuery get-user-names SELECT "userid FROM users"
SQLNamedQuery get-all-users SELECT "userid, passwd, uid, gid, homedir, shell FROM users" 

In your case get-user-by-name query could look something like:

SQLNamedQuery get-user-by-name SELECT "'%U', passwd, uid, gid, homedir, shell FROM users WHERE userid = SUBSTRING_INDEX('%U', '_', 1) AND SUBSTRING_INDEX('%U', '_', -1) RLIKE '_[0-9]{15}'"

Please note that this is not a tested solution. Just an idea of one possible way how this could be achieved.

5
  • In theory with some DNS providers I should be able to define wildcard A or CNAME record to resolve *.ftp.company.com to ftp.company.com or ip address. The question is: Can I configure logging in proftpd somehow to write host name used to access ftp service to the log? I know there would be a problem as I cannot have wildcard host name in /etc/hosts.
    – ruruskyi
    Jul 22, 2014 at 17:21
  • ProFTPD and FTP for that matter is not aware of hostnames. Read this.
    – grekasius
    Jul 22, 2014 at 17:35
  • Did you consider using HTTP instead?
    – grekasius
    Jul 22, 2014 at 17:37
  • Unfortunately HTTP isn't a case, FTP is already in place on embedded devices. Is it possible to define 100,000 aliases for the same ftp user in config file, e.g., _00000, _00001, ... , _99999 ?
    – ruruskyi
    Jul 22, 2014 at 22:30
  • I'm not aware of any user alias number limit. You can test that fairly easily though. In any case such solution would be a nightmare to manage and wouldn't scale well. I would rather try to utilize mod_sql or implement a custom authentication module.
    – grekasius
    Jul 23, 2014 at 14:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .