Professional FTP Daemon FAQ(2)

--------------------------------------------------------------------------------

6.5 I want to show a message prior to login
Use the DisplayConnect directive to specify a file containing a message to be displayed prior to login.

--------------------------------------------------------------------------------

DisplayConnect /ftp/ftp.virtualhost/login.msg

--------------------------------------------------------------------------------

6.6 I want to display a message after login
Use the DisplayLogin directive, this sends a specified ASCII file to the connected user.

--------------------------------------------------------------------------------

DisplayLogin /etc/proftp.msg

--------------------------------------------------------------------------------

6.7 Can I have a custom welcome response?
Use the AccessGrantMsg directive, this sends a simple single line message back to the user after a successful authentication. Magic cookies appear to be honoured in this directive.

--------------------------------------------------------------------------------

AccessGrantMsg "Guest access granted for %u."

--------------------------------------------------------------------------------

Note, this directive has an overriding default and needs to be specified in both VirtualHost and Anonymous blocks.

6.8 External Programs
ProFTPD has been designed to run as a secure ftp server, this means that it tries to keep as much as possible under it's control. An external program is a security risk in itself because it's behaviour is not controllable from within the ftpd code.

7. User Authentication
This section is being re-written due to major structural changes to the SQL module prior to 1.2.0

7.1 Why is PAM the default authentication system?
Security, pure and simple. PAM is the most secure (or securable) of the available authentication systems. Many of the issues and configuration hints for PAM are contained in README.PAM which is bundled with the server source and in the various packaged builds. To use /etc/passwd manual compilation will be required with the configure script being run with the --without-pam flag. Unless the PAM subsystem is properly configured authentication will fail.

7.2 Authentication methods supported

PAM
Standard /etc/passwd lookups
NIS
Shadow passwords
Indvidual passwd/group files for each virtual
SQL databases

If these don't fit in with your system then writing a custom module or using such as the 'ld.so.preload' approach to intercept getpwbynam() system calls works happily with ProFTPD.

7.3 Problems with non-PAM authentication
Generally these problems will be cured by either disabling PAM completely or by ensuring that these directives are set

--------------------------------------------------------------------------------

PersistentPasswd off
AuthPAMAuthoritative off

--------------------------------------------------------------------------------

7.4 AuthPAMAuthorative is an unknown directive!
Check the spelling it should be AuthPAMAuthoritative not AuthPAMAuthorative or any other variation.

7.5 Configuring PAM
There is a README.Pam in the top directory of the ProFTPD install directory :

Redhat Linux

--------------------------------------------------------------------------------

#%PAM-1.0
auth required /lib/security/pam_listfile.so item=user
sense=deny file=/etc/ftpusers onerr=succeed
auth required /lib/security/pam_pwdb.so shadow nullok
account required /lib/security/pam_pwdb.so
session required /lib/security/pam_pwdb.so

--------------------------------------------------------------------------------

SuSE Linux
SuSE appears to uses pam_unix rather than pam_pwdb which is the Redhat approach. All references to pam_pwdb should be replaced with "pam_unix" on SuSE systems.

The following fragment is reported to work fine on SuSE 6.2

--------------------------------------------------------------------------------

/etc/pam.d/ftpd
#%PAM-1.0

# Uncomment this to achieve what used to be ftpd -A.
# auth required /lib/security/pam_listfile.so item=user sense=allow file=/etc/ftpchroot onerr=fail

auth required /lib/security/pam_listfile.so item=user
sense=deny file=/etc/ftpusers onerr=succeed
auth sufficient /lib/security/pam_ftp.so
auth required /lib/security/pam_unix.so
auth required /lib/security/pam_shells.so
account required /lib/security/pam_unix.so
password required /lib/security/pam_unix.so
session required /lib/security/pam_unix.so

--------------------------------------------------------------------------------

FreeBSD
FreeBSD does not support PAM session directives. If you remove the following line from the FreeBSD section of README.PAM, PAM should work properly under recent versions of FreeBSD.

--------------------------------------------------------------------------------

ftp session required pam_unix.so try_first_pass

--------------------------------------------------------------------------------

7.6 pam_sm_open_session errors
ProFTPD requires PAM version 0.59 or better. pam_sm_open_session is not part of previous versions.

7.7 Normal users can't login, only anon.
Check that the /etc/pam.d/ftp file exists on the system and is configured as detailed in README.PAM

7.8 AuthPAMAuthoritative
Currently AuthPAMAuthoritative defaults on "ON" resulting in login failures if PAM cannot authenticate the user. This breaks the AuthUserFile directive as it never gets a chance to authenticate the user unless the AuthPAMAuthoritative directive is set to "OFF"

The reasoning behind the current default is to ensure that the system is secure by default requiring that the admin explicitly and knowingly has to disable it. There are discussions underway which may result in the directive flipping to a default of "Off" if AuthUserFile is specified.

Note: as of the current CVS and the forthcoming pre9 release the default has changed to "Off"

7.9 LDAP
mod_ldap is currently stable; there were a couple bugs that were squashed after release 1.0 of the module. it is still udner development , check the website for more information. There is an example config fragment on the author's site which gives a reasonable idea on how to use this module.

7.10 Encrypted passwords
There are patches which are being merged in at the moment to provide SHA encryption. The plan is to have the server get all user information except passwords via an anonymous bind. The server will then reconnect as a user is logging in and attempt to get the password via an encrypted connection. This should be in the next major release (2.5)

7.11 SecureID
No support yet

7.12 One time passwords
This is possible using either PAM or the Opie modules. The module passes back a challenge which the user puts into a key generator along with their 'pass phrase' and it gives them back 5 words which get sent as the password. As long as you do it correctly it will never repeat.

It requires opie to be installed on the server. There are key gen clients for win95/98, *nix, mac.

ftp://ftp.urbanrage.com/pub/c/mod_opie.c

7.13 RADIUS
Radius support isn't built into ProFTPD, though there's nothing stopping someone writing a module and submitting it for inclusion in the code tree. Possibly the easist way to implement Radius is by using the modules available for PAM and using the inbuilt PAM support.

7.14 Anonymous password checking
Is it possible to check an offered email address in an anonymous login before allowing access. Simple answer, not a hope in hell, anonymous access is pretty much designed to be freely open without checks and restrictions other than those placed on upload/download from the site. The best that can be hoped for is decent logging and tracking of accesses, and the requesting IP.

7.15 Configuring for SQL authentication ith-modules=mod_sqlpw:mod_mysql

configure --with-modules=mod_sqlpw:mod_mysql
Edit Make.rules
Compile with: make
Then install per the Proftpd instructions: make install
Edit the proftpd configuration file/usr/local/etc/proftpd.conf
Set up your system so libmysqlclient.so can be found

Note the ordering of the modules in the configure command is significant, incorrect ordering will cause problems.

Edit Make.rules

Add the location of the MySQL include files to the CPPFLAGS in Make.rules:
CPPFLAGS=$(DEFAULT_PATHS) $(PLATFORM) -I.. -I$(top_srcdir)/include -I/usr/local/mysql/include/mysql
Add the location of the MySQL client library to the LDFLAGS in Make.rules:
LDFLAGS=-L/home/builds/proftpd-1.2.0pre10/lib -L/usr/local/mysql/lib/mysql
Add the MySQL client library to the LIBS variable so that it will be required at link time.
LIBS=-lsupp -ldl -lcrypt -lm -lmysqlclient -lpam

Edit the proftpd.conf file
Make sure to add these lines and change where appropriate (example: the password)

--------------------------------------------------------------------------------

--[ proftpd.conf ]--
# auth using mysql host login pass db
MySQLInfo localhost hamster ***** proftpd
SQLUserTable ftp
SQLUsernameField username
SQLUidField uid
SQLGidField gid
SQLPasswordField password
SQLHomedirField homedir
SQLLoginCountField count
SQLAuthoritative on
SQLPlaintextPasswords on
--[ proftpd.conf ]--

--------------------------------------------------------------------------------

Set up your system so libmysqlclient.so can be found

First decide how to do it:
On Linux: make it system wide by editing /etc/ld.so.conf Modify the LD_LIBRARY_PATH for root, or in a shell wrapper script to proftpd. Note: if you have Linux and are not installing more than one version of MySQL use the edit ld.so.conf solution. Linux: Editing /etc/ld.so.conf, as root: Add the same path you added to LDFLAGS at the bottom of the file /usr/local/mysql/lib/mysql Run the ldconfig program. Note: there will be no visible sign that this has worked, it just will... Modify the LD_LIBRARY_PATH Add these lines to either root's .profile (or .bashrc) or to a shell script that is wrappering proftpd

--------------------------------------------------------------------------------

if [ -z "$LD_LIBRARY_PATH" ] ; then

export LD_LIBRARY_PATH="/usr/local/mysql/lib/mysql"
else
export LD_LIBRARY_PATH="/usr/local/mysql/lib/mysql:$LD_LIBRARY_PATH"

--------------------------------------------------------------------------------

Detailing how to use MySQL is outside the scope of this document, so here's some links.

Administration
Intro

Quick rundown of what's needed to make a database

Create a user for proftpd to access the database as
Create permissions for this user
Create new database (mine is called proftpd)
Reload as required to make this live
Create a table within proftpd (mine is ftp)

Creating a user

Connect to the MySQL access DB: mysql mysql
Use Insert to the user you want proftpd to use to access the DB
insert into user values ('%', 'hamster', password('mypasswd'),'Y','N','Y','N','N','N','N','N','N','N' ,'N','N','N','N');

The above insert will work for MySQL v3.23.x, if you are using an older MySQL remove the last 4 'N'. Your User access table in MySQL v3.23.x should look like:

--------------------------------------------------------------------------------

+------+-----------+------------------+-------------+-------------+-------------+-------------+-------------+-----------+-------------+---------------+--------------+-----------+------------+-----------------+------------+------------+
| Host | User | Password | Select_priv | Insert_priv | Update_priv | Delete_priv | Create_priv | Drop_priv | Reload_priv | Shutdown_priv | Process_priv | File_priv | Grant_priv | References_priv | Index_priv | Alter_priv |
+------+-----------+------------------+-------------+-------------+-------------+-------------+-------------+-----------+-------------+---------------+--------------+-----------+------------+-----------------+------------+------------+
| % | hamster | 0d26d1e75ffa7efb | Y | N | Y | N | N | N | N | N | N | N | N | N | N | N |
+------+-----------+------------------+-------------+-------------+-------------+-------------+-------------+-----------+-------------+---------------+--------------+-----------+------------+-----------------+------------+------------+

--------------------------------------------------------------------------------

Creating the DB

Use the mysqladmin command to create the database:
mysqladmin create proftpd

Reloading and refreshing the MySQL daemon

Use the mysqladmin command to refresh and reload its DB pointers and configurations
mysqlamdin refresh
mysqlamdin reload

Creating the Table

Copy the following SQL create statement to a file and run it.
mysql proftpddb < table_create_file

--------------------------------------------------------------------------------

#mysqldump proftpd ftp
# MySQL dump 8.2
#
# Host: localhost Database: proftpd
#--------------------------------------------------------
# Server version 3.23.13a-alpha-log

#
# Table structure for table 'ftp'
#

CREATE TABLE ftp (
username varchar(60) binary,
uid int(11),
gid int(11),
password varchar(30),
homedir varchar(250),
count int(11)
);

--------------------------------------------------------------------------------

You may want to refresh and reload MySQL again, how to is listed above. What you should end up with is something that looks like this:

--------------------------------------------------------------------------------

Database changed
mysql> show tables;
+-------------------+
| Tables in proftpd |
+-------------------+
| ftp |
+-------------------+
1 row in set (0.02 sec)

--------------------------------------------------------------------------------

Note: in MySQL v3.23.x and above you will see a Privileges column, if you are running an older version, you will not see that.

Database Permissions
At the very least the user/host the profptd daemon uses to connect to the SQL server should have SELECT permission. If the "count" field is being used to track a users usage then UPDATE is also required. The lack of these permissions may cause the server to fail.

Gotcha's

421 Service not availible
Make sure that the home directory of the user concerned actually exists and has the right ownerships/permissions

Can't connect to the database

Is it running?
Is it listening?
Does the user proftpd is using have the right permissions?

7.16 Can I run the whole process in a chroot()?
No, not at the moment, ProFTPD was not designed to run chrooted and needs access to various system files through out it's normal running lifetime. (/etc/passwd for example). -->

8. Hamster droppings
8.1 Why...
This chapter is not meant to be meaningful, it's where I cut and paster ideas, comments, code fragments before I work them into the main part of the document.

8.2 Odds and ends
Why can't I delete a directory with dele ?

Port bouncing, ftp bouncing, priv ports

hiding dire

协议分析网

搜索

Professional FTP Daemon FAQ(2)