Hot answers tagged

5

Groups and SGID. user1 would have group membership in www-data and you would set everything group writable under [domain]. Set user1's home directory to /var/www/[domain]. You would also want to set the SGID on [domain] and all directories under it, which would cause permissions to be inherited. (g+s) Be aware, user1 would have access to all Web content. ...


5

According to the HideFiles documentation, HideFiles only gives files "hidden-ness", it doesn't actually hide them. To hide them, you need to use IgnoreHidden within a Limit block. So, try this: <Directory /home/ftp_user/my_project> HideFiles ^\.svn$ <Limit ALL> AllowUser ftp_user IgnoreHidden on </Limit> ...


5

Any shell you want to use with proftpd should be listed in the /etc/shells file (http://www.proftpd.org/docs/directives/linked/config_ref_RequireValidShell.html) You should add /bin/false to /etc/shells or set RequireValidShell off in the proftpd config good luck!


5

Check that SElinux isn't causing you problems setenforce 0 If this fixes your problem then turn SELinux back on (setenforce 1) and then try setting the ftp_home_dir boolean setsebool -P ftp_home_dir on which will allow the ftp daemon to access user home directories.


5

Check your DNS resolver situation and /etc/hosts configuration. You want a local hostname defined and the hosts file to be properly configured. And definitely make sure your DNS servers are reachable.


4

Try commenting out DefaultRoot I think it may override the values read from the database backend. EDIT: If DefaultRoot is set and anything other than ~ then the user will be jailed in a tree rooted at DefaultRoot. If DefaultRoot is ~ then the user will be jailed in a tree rooted at theit home directory.


4

You could just use a configuration like this: <Directory ~/site/backups> <Limit WRITE> DenyAll </Limit> </Directory> which essentially does the same as this configuration: <Directory ~/site/backups> <!-- Delete Files --> <Limit DELE> DenyAll </Limit> <!-- Remove ...


4

Use netstat to see what process is holding port 21: # netstat -tnlp And from there you can use RPM to see what package owns the file to stop it and remove it from init.d.


4

The problem is, that conntrack_ftp module, which on the fly allows ftp data connections to pass through firewall even if they were to be dropped because of rules, cannot analyze the encrypted stream for PASV/PORT commands. The same applies to not being able to use active mode from behind a firewall/nat with encrypted control connection. So you need to set ...


4

The problem is that %u refers to the local user (which in your case is proftpd). You shoulduse %U (note the capital U), which refers to the FTP user. Note the last paragraph on the ProFTPd SQLUserInfo page, above "See Also".


4

Please change /etc/hosts from 88.198.61.237 Debian-70-wheezy-64-minimal 2a01:4f8:131:2a::2 Debian-70-wheezy-64-minimal to 88.198.61.237 web-amd-3700-2gb 2a01:4f8:131:2a::2 web-amd-3700-2gb or (better) fix the setup to have a proper FQDN and naming scheme.


3

The ident protocol is used to provide the username related to a TCP connection, mainly when there are many users using a single IP address like shared hosts, etc. It's not very common those days, so for FTP I think it's safe to disable it. IRC still uses it a lot. You can say it's a dying protocol but hey, you never know. It works querying pairs of tcp ...


3

chroot is an operating system call that restricts an application to be able to access only a subset of the filesystem -- in effect, that part of the filesystem becomes the root, which it can't see outside of. This is done for security reasons, to create a "jail" which an FTP client can't see beyond.


3

You don't need proftpd to do SFTP, you can do that natively with ssh. If for some reason you want to use proftpd (i.e. you want to integrated with non-system accounts easier). You'll want to deny access to the login verb for the server, then create a specific virtual host with the sftp engine on and allow the login verb. To accomplish that your ...


3

With the help of proftpd support forums, I figured this one. UIDs and GUIDs in AuthUserFile must match one(s) of real Linux user(s) with the right ownership/permissions for the relevant FTP directories.


3

To understand active vs. passive FTP: link.


3

You will have to give your proftpd virtual users ownership of their files and directories just like you would a real user. You can do this with chown. As the users aren't system users you will have to use the numeric UID:GID e.g. if username is UID 10001 and GID 1111 (from the mysql database) then chown 10001:1111 /var/www/vhosts/sites/username chown -R ...


3

The DisplayFirstChdir directive is deprecated. Comment it out and try again.


3

Yes, if you install the mod_quotatab extension: ProFTPD module mod_quotatab . You can set a quota on the number of bytes and the number of files permitted. Set up a cron-job to update the tally once every 24 hours, and voila, you have a daily quota set up, as explained here


3

If you're experiencing the same issue as I am you will find in your server's auth log that proftpd first tries pam_unix before falling back to the configured authentication method. For me I am using authuserfile and not Unix authentication. As with you my first attempts always fail and the second attempts always succeed. The proftpd documentation would have ...


3

MySQL clients which link against libmysqlclient read global options from the [client] section of /etc/my.cnf. This is a typical behavior for such clients, and ProFTPD is such a client when you use its MySQL module. The SELinux boolean ftpd_full_access will allow this access, but it also effectively disables SELinux for the entire FTP daemon's operations, so ...


3

To not be able to "see" the files (assuming that this just means blocking directory listings), the following config might work: <IfUser otropload> # Block directory listing commands <Limit LIST NLST MLSD MLST> DenyAll </Limit> </IfUser> Note that this requires that your proftpd be using the mod_ifsession module. Now, the ...


3

See: ProFTPD - Failed to retrieve directory listing while using TLS it might be a problem with the related rules of a firewall between you and the server.


2

From a quick read of the docs on limits, your limit configuration looks like it should do what you want. The problem is likely file system permissions. You may want to read up on the mode and umask settings here. ProFTPD creates files with a base mode of 666 (read/write/no execute). The umask setting is used to further restrict the permissions specified by ...


2

http://www.proftpd.org/docs/howto/Logging.html lists like 5 packages that can be used. Hey, a note though - be aware that most of these packages do NOT do ftp reporting properly, though it's probably not their fault. We do a lot of software downloads here and we bit this problem off before. Because so many people use download accelerators of one sort or ...


2

If you want to do FTPES with proftpd you basically need to follow 4 steps. 1) Install proftpd and openssl apt-get install proftpd openssl 2) Generate a cert (assuming you are going to self sign, make sure to match the common name to the ftp site dns name to make clients complain less) mkdir /etc/proftpd/ssl openssl req -new -x509 -days 365 -nodes -out ...


2

The DefaultRoot line needs to be at the end of the configuration file.


2

I believe the problem could be that you have multiple DefaultRoot(s) specified. As the ProFTPd documentation explains: If two DefaultRoot directives apply to the same user, ProFTPD arbitrarily chooses one (based on how the configuration file was parsed) You could try commenting out the first DefaultRoot directive and see if that helps to resolve the ...


2

I haven't used ProFTPd my self in quite some time, but remembered it having FTPS support. So do you really mean SFTP or did you mean FTPS? The earlier being the SSH implementation of a protocol with similar capabilities as FTP and the later being FTP secured by SSL/TLS. on a quick search I found the following document on FTPS in ProFTPd ...


2

According to the docs, you cannot set the SGID bit in the umask directive; it says: "Any arguments supplied must be an octal number, in the format 0xxx." http://proftpd.org/docs/directives/linked/config_ref_Umask.html As joschi alludes to, what you really want is "Umask 0002" - a umask is bitwise to the object, not an absolute CHMOD setting. You only need ...



Only top voted, non community-wiki answers of a minimum length are eligible