Even though the FTP standard is long outdated and not recommended for use on networks with even a moderate level of security, it still has to be supported on many servers, especially web servers.
In this note I'll explain how to install an FTP server on Linux Debian. In our example we'll do this on Squeeze, but the same method works just as well on other versions of this OS.
InstallationSo, from the Debian console, enter:
# sudo aptitude install proftpd
During installation we'll be offered a choice of 2 delivery options:
a) From inetd. If you choose this option, the ProFTPd daemon will run under the inetd service.
b) Standalone. With this option ProFTPd will be installed as a standalone service. I choose this option, since it's more convenient for me to work with ProFTPd as a separate service.
After installation, apt will immediately start the daemon and it will become available on the standard port.
You can check availability with the following command:
$ ftp 127.0.0.1
If the ftp client connects, that means the daemon is successfully installed and running.
ConfigurationBut installing the daemon isn't enough — it also needs to be configured.
The configuration file for ProFTPd on Debian is located at /etc/proftpd and is called, appropriately, proftpd.conf.
It's worth noting that "out of the box" ProFTPd immediately grants users of this machine access to their home folders. That is, if a user registered on this computer tries to log in to FTP, they'll be let in under their (system) login and password, and their root folder will be their home directory.
However, you need to be careful!!! If a user types "cd .." they can easily move up a level and browse other users' folders, and if they run this command again, they can browse the entire server file system, which is extremely undesirable from a security standpoint.
Now let's move on to configuring our server.
The first thing to understand is that ProFTPd uses the server's own user accounts, i.e. if you want to add a user for FTP, you need to add them on the server itself as a server user. If you don't want to allow a user to connect or log in to the console, use /bin/false as the command shell — they'll still be able to connect via FTP.
Accordingly, the FTP password is the same as the user's password.
For example, let's create a user "myftpuser" who will only be allowed to connect via FTP:
$ sudo adduser myftpuser --shell /bin/false
Now let's open the file /etc/proftpd/proftpd.conf
Inside this file, let's set the following parameters:
- UseIPv6 - Whether to enable IPv6 support
- ServerName - The server name displayed in the ProFTPd welcome banner
- Port - Lets you set a non-standard port for ProFTPd to listen on
- PassivePorts - Here you can override the default range of passive FTP ports
- MaxInstances - The maximum number of connections (active sessions). Note that this is a count of connections, not users - each user can have several connections.
- Umask - the mask applied to newly created files. I recommend paying attention to this option - files uploaded to this server via FTP will be created with this mask. With the default mask of 022, directories will be created with chmod = 755 and files with 644, which grants full access only to the FTP user but read-only access to everyone else.
- AllowOverwrite - Whether to allow overwriting files or only adding new ones (i.e. if this option is disabled, a file can only be uploaded to the server once and cannot be overwritten - only a different file can be added alongside it).
- TransferLog and SystemLog - you can specify custom paths for the logs.
- RequireValidShell - If enabled, ProFTPd will not allow in users who don't have a working shell specified (i.e. users with /bin/false won't have access via FTP).
Preventing users from wandering around the server's file systemFor this we use the chroot technique, which ProFTPd supports "out of the box".
The "DefaultRoot" option controls exactly that - where to chroot users to. Users cannot go higher up the directory tree than this. Let's look at the two most common scenarios.
1) A single folder is created for all users, where they "putter around". In this case, the directory must already exist in the server's file system.
For example, we've created the directory "/var/ftp" and want all users to "hang out" there. Then the option would look like this:
DefaultRoot /var/ftp
2) All users, when logging in via FTP, end up in their own home directory. At the same time, they cannot go any higher than this directory - i.e. they cannot peek into a neighboring user's directory.
Then the option would look like this:
DefaultRoot ~/
A private CHROOT for a userThere are cases where the entire server needs to operate under a single scheme (for example, chrooting every user into their own directory), while some user (or users) needs to have a special root directory. For instance, the server works as a normal server, but there's a user who is a webmaster (say, an external user) and needs to be mapped only into the /var/www directory with no way to go up a level, while for obvious reasons the user's home directory doesn't suit this purpose.
As an example, let's create a user webadmin and set up these conditions for them.
$ sudo addgroup webadmin --ingroup www-data --shell /etc/false
Here we've created the user webadmin and added them to the same group under which the Apache server runs (www-data), while also denying them the ability to connect and see a command line (--shell /etc/false).
Now let's add the following block to the file /etc/proftpd/proftpd.conf
<Anonymous /var/www>
User webadmin
Group www-data
RequireValidShell off
AnonRequirePassword on
<Directory /var/www>
AllowOverwrite on
<Limit ALL>
AllowALL on
</Limit>
</Directory>
</Anonymous>
In this block:
User and Group - these set the username and group under which this session's work will take place; accordingly, the user will need to log in with this username and their password.
RequireValidShell off - here we allow ProFTPd to log in a user who doesn't have a command line.
AnonRequirePassword on - and with this directive we require that a user who is "anonymous" from ProFTPd's point of view cannot log in without entering the correct password.
Then comes the description of the directory and limit options.
After these changes - restart ProFTPd, and the webadmin user will land directly in the /var/www directory upon login, which will be the root directory for them and above which they cannot go, while other users will continue to log in normally according to the server's general scenario.
Virtual hostsIt sometimes happens that you need to set up several virtual FTP servers on one physical machine, each with its own settings. ProFTPd can do this.
The <VirtualHost IP> directive is used for this.
Instead of IP, you need to specify the IP address of the virtual host. It is assumed that the machine has several IP addresses, for example added as aliases. Then users connecting to one address will work with one "server", and to another - as if with a different one (although in reality it's the same one).
Servers can also be separated by ports - i.e. specifying the same IP address, but adding the Port directive inside the VirtualHost configuration. Then users will be able to connect using the same IP address, but specifying different ports - and will land on differently configured instances of the FTP server.
Inside the <VirtualHost> ... </VirtualHost> block, settings are configured the same way as inside the main block.
<VirtualHost 11.22.33.44>
Port 1050
...
</VirtualHost>
For the first steps, that's all. You can find more information on the ProFTPd website:
www.proftpd.org
Comments