LinuxQuestions.org
Visit Jeremy's Blog.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Server
User Name
Password
Linux - Server This forum is for the discussion of Linux Software used in a server related context.

Notices

Reply
 
LinkBack Search this Thread
Old 09-10-2008, 04:03 PM   #1
uglyoldbob
LQ Newbie
 
Registered: Sep 2008
Posts: 5

Rep: Reputation: 0
proftpd multi-user configuration, user cannot show contents of directories


I am running a linode server with the proftpd server configured with webmin.
When I first setup the server, I configured it for one user (named userftp) and it worked fine.
I recently added another user to the configuration (named family).
I wanted each user to not have access to each other's files, so I set it up so each user would have their own directory in /home.
Username family works as expected. However, username userftp can long in, but now show the contents of any directories.

Here are the contents of my config file for proftpd.

#
# /etc/proftpd/proftpd.conf -- This is a basic ProFTPD configuration file.
# To really apply changes reload proftpd after modifications.
#

# Includes DSO modules
Include /etc/proftpd/modules.conf

# Set off to disable IPv6 support which is annoying on IPv4 only boxes.
UseIPv6 off

AuthAliasOnly off

ServerName "Debian"
ServerType standalone
DeferWelcome off

MultilineRFC2228 on
DefaultServer on
ShowSymlinks on

TimeoutNoTransfer 600
TimeoutStalled 600
TimeoutIdle 1200

DisplayLogin welcome.msg
DisplayFirstChdir .message
ListOptions "-l"

DenyFilter \*.*/

# Use this to jail all users in their homes
#DefaultRoot /home
#DefaultRoot ~
IdentLookups off
ServerIdent on "FTP sever ready"
AccessGrantMsg Welcome.

MaxLoginAttempts 5

# Users require a valid shell listed in /etc/shells to login.
# Use this directive to release that constrain.
# RequireValidShell off

# Port 21 is the standard FTP port.
Port 21

# In some cases you have to specify passive ports range to by-pass
# firewall limitations. Ephemeral ports can be used for that, but
# feel free to use a more narrow range.
# PassivePorts 49152 65534

# If your host was NATted, this option is useful in order to
# allow passive tranfers to work. You have to use your public
# address and opening the passive ports used on your firewall as well.
MasqueradeAddress (valid ip address)

# To prevent DoS attacks, set the maximum number of child processes
# to 30. If you need to allow more than 30 concurrent connections
# at once, simply increase this value. Note that this ONLY works
# in standalone mode, in inetd mode you should use an inetd server
# that allows you to limit maximum number of processes per service
# (such as xinetd)
MaxInstances 30

# Set the user and group that the server normally runs at.
User nobody
Group nogroup

# Umask 022 is a good standard umask to prevent new files and dirs
# (second parm) from being group and world writable.
Umask 022 022
# Normally, we want files to be overwriteable.
AllowOverwrite on

# Uncomment this if you are using NIS or LDAP to retrieve passwords:
# PersistentPasswd off

# Be warned: use of this directive impacts CPU average load!
# Uncomment this if you like to see progress and transfer rate with ftpwho
# in downloads. That is not needed for uploads rates.
#
# UseSendFile off

# Choose a SQL backend among MySQL or PostgreSQL.
# Both modules are loaded in default configuration, so you have to specify the backend
# or comment out the unused module in /etc/proftpd/modules.conf.
# Use 'mysql' or 'postgres' as possible values.
#
#<IfModule mod_sql.c>
# SQLBackend mysql
#</IfModule>

TransferLog /var/log/proftpd/xferlog
SystemLog /var/log/proftpd/proftpd.log

<IfModule mod_tls.c>
TLSEngine off
</IfModule>

<IfModule mod_quota.c>
QuotaEngine on
</IfModule>

<IfModule mod_ratio.c>
Ratios on
</IfModule>


# Delay engine reduces impact of the so-called Timing Attack described in
#
# It is on by default.
<IfModule mod_delay.c>
DelayEngine on
</IfModule>

<IfModule mod_ctrls.c>
ControlsEngine on
ControlsMaxClients 2
ControlsLog /var/log/proftpd/controls.log
ControlsInterval 5
ControlsSocket /var/run/proftpd/proftpd.sock
</IfModule>

<IfModule mod_ctrls_admin.c>
AdminControlsEngine on
</IfModule>

#VALID LOGINS
<Limit LOGIN>
AllowUser userftp
AllowUser family
DenyALL
</Limit>

<Directory /home/ftp>
Umask 022 022
AllowOverwrite off
DeleteAbortedStores on
HiddenStor on
HideNoAccess on
AllowAll
</Directory>

<Directory /home/ftp/download/*>
Umask 022 022
AllowOverwrite off
<Limit MKD STOR DELE XMKD RNEF RNTO RMD XRMD>
DenyAll
</Limit>
</Directory>

<Directory> /home/ftp/upload/>
Umask 022 022
AllowOverwrite on
<Limit READ RMD DELE>
DenyAll
</Limit>

<Limit STOR CWD MKD>
AllowAll
</Limit>
</Directory>

# A basic anonymous configuration, no upload directories.

# <Anonymous ~ftp>
# User ftp
# Group nogroup
# # We want clients to be able to login with "anonymous" as well as "ftp"
# UserAlias anonymous ftp
# # Cosmetic changes, all files belongs to ftp user
# DirFakeUser on ftp
# DirFakeGroup on ftp
#
# RequireValidShell off
#
# # Limit the maximum number of anonymous logins
# MaxClients 10
#
# # We want 'welcome.msg' displayed at login, and '.message' displayed
# # in each newly chdired directory.
# DisplayLogin welcome.msg
# DisplayFirstChdir .message
#
# # Limit WRITE everywhere in the anonymous chroot
# <Directory *>
# <Limit WRITE>
# DenyAll
# </Limit>
# </Directory>
#
# # Uncomment this if you're brave.
# # <Directory incoming>
# # # Umask 022 is a good standard umask to prevent new files and dirs
# # # (second parm) from being group and world writable.
# # Umask 022 022
# # <Limit READ WRITE>
# # DenyAll
# # </Limit>
# # <Limit STOR>
# # AllowAll
# # </Limit>
# # </Directory>
#
# </Anonymous>
<Global>
RootLogin off
DisplayConnect Welcome
DisplayGoAway ""Server full""
DisplayLogin ""Login successful""
DisplayQuit Goodbye
RequireValidShell off
DefaultRoot /home/ftp userftp
DefaultRoot /home/family family
DeleteAbortedStores on
HiddenStor on
ShowSymlinks off
AuthAliasOnly off
</Global>
 
Old 09-10-2008, 04:19 PM   #2
halvorls
Member
 
Registered: Jun 2008
Posts: 78

Rep: Reputation: 15
Find folow line:

ServerName "Debian"
ServerType standalone
DeferWelcome off

And add follow line:

UseFtpUsers on
DefaultRoot ~


And delete folow line:

# Use this to jail all users in their homes
#DefaultRoot /home
#DefaultRoot ~

That well work

Last edited by halvorls; 09-10-2008 at 04:23 PM.
 
Old 09-10-2008, 06:10 PM   #3
uglyoldbob
LQ Newbie
 
Registered: Sep 2008
Posts: 5

Original Poster
Rep: Reputation: 0
I managed to get it working. Here are my config files for those with similar problems. Hopefully these help out. Apparently webmin wasn't so good at setting up the config files.

/etc/proftpd/proftpd.conf
Code:
#
# /etc/proftpd/proftpd.conf -- This is a basic ProFTPD configuration file.
# To really apply changes reload proftpd after modifications.
# 

# Includes DSO modules
Include /etc/proftpd/modules.conf

# Set off to disable IPv6 support which is annoying on IPv4 only boxes.
UseIPv6				off

AuthAliasOnly			off

ServerName			"Debian"
ServerType			standalone
DeferWelcome			off
UseFtpUsers			on
DefaultRoot			~

MultilineRFC2228		on
DefaultServer			on
ShowSymlinks			on

TimeoutNoTransfer		600
TimeoutStalled			600
TimeoutIdle			1200

DisplayLogin                    welcome.msg
DisplayFirstChdir               .message
ListOptions                	"-l"

DenyFilter \*.*/

IdentLookups			off
ServerIdent 			on "FTP sever ready"
AccessGrantMsg Welcome.

MaxLoginAttempts		5

# Users require a valid shell listed in /etc/shells to login.
# Use this directive to release that constrain.
# RequireValidShell		off

# Port 21 is the standard FTP port.
Port				21

# In some cases you have to specify passive ports range to by-pass
# firewall limitations. Ephemeral ports can be used for that, but
# feel free to use a more narrow range.
# PassivePorts                  49152 65534

# If your host was NATted, this option is useful in order to
# allow passive tranfers to work. You have to use your public
# address and opening the passive ports used on your firewall as well.
MasqueradeAddress		(server ip address)

# To prevent DoS attacks, set the maximum number of child processes
# to 30.  If you need to allow more than 30 concurrent connections
# at once, simply increase this value.  Note that this ONLY works
# in standalone mode, in inetd mode you should use an inetd server
# that allows you to limit maximum number of processes per service
# (such as xinetd)
MaxInstances			30

# Set the user and group that the server normally runs at.
User				nobody
Group				nogroup

# Umask 022 is a good standard umask to prevent new files and dirs
# (second parm) from being group and world writable.
Umask				022  022
# Normally, we want files to be overwriteable.
AllowOverwrite on

# Uncomment this if you are using NIS or LDAP to retrieve passwords:
# PersistentPasswd		off

# Be warned: use of this directive impacts CPU average load!
# Uncomment this if you like to see progress and transfer rate with ftpwho
# in downloads. That is not needed for uploads rates.
#
# UseSendFile			off

# Choose a SQL backend among MySQL or PostgreSQL.
# Both modules are loaded in default configuration, so you have to specify the backend 
# or comment out the unused module in /etc/proftpd/modules.conf.
# Use 'mysql' or 'postgres' as possible values.
#
#<IfModule mod_sql.c>
# SQLBackend			mysql
#</IfModule>

TransferLog /var/log/proftpd/xferlog
SystemLog   /var/log/proftpd/proftpd.log

<IfModule mod_tls.c>
TLSEngine off
</IfModule>

<IfModule mod_quota.c>
QuotaEngine on
</IfModule>

<IfModule mod_ratio.c>
Ratios on
</IfModule>


# Delay engine reduces impact of the so-called Timing Attack described in
# http://security.lss.hr/index.php?page=details&ID=LSS-2004-10-02
# It is on by default. 
<IfModule mod_delay.c>
DelayEngine on
</IfModule>

<IfModule mod_ctrls.c>
ControlsEngine        on
ControlsMaxClients    2
ControlsLog           /var/log/proftpd/controls.log
ControlsInterval      5
ControlsSocket        /var/run/proftpd/proftpd.sock
</IfModule>

<IfModule mod_ctrls_admin.c>
AdminControlsEngine on
</IfModule>

#VALID LOGINS
<Limit CWD READ LOGIN>
Order allow,deny
AllowUser userftp
AllowUser family
DenyAll
</Limit>


# A basic anonymous configuration, no upload directories.

# <Anonymous ~ftp>
#   User				ftp
#   Group				nogroup
#   # We want clients to be able to login with "anonymous" as well as "ftp"
#   UserAlias			anonymous ftp
#   # Cosmetic changes, all files belongs to ftp user
#   DirFakeUser	on ftp
#   DirFakeGroup on ftp
# 
#   RequireValidShell		off
# 
#   # Limit the maximum number of anonymous logins
#   MaxClients			10
# 
#   # We want 'welcome.msg' displayed at login, and '.message' displayed
#   # in each newly chdired directory.
#   DisplayLogin			welcome.msg
#   DisplayFirstChdir		.message
# 
#   # Limit WRITE everywhere in the anonymous chroot
#   <Directory *>
#     <Limit WRITE>
#       DenyAll
#     </Limit>
#   </Directory>
# 
#   # Uncomment this if you're brave.
#   # <Directory incoming>
#   #   # Umask 022 is a good standard umask to prevent new files and dirs
#   #   # (second parm) from being group and world writable.
#   #   Umask				022  022
#   #            <Limit READ WRITE>
#   #            DenyAll
#   #            </Limit>
#   #            <Limit STOR>
#   #            AllowAll
#   #            </Limit>
#   # </Directory>
# 
# </Anonymous>
<Global>
RootLogin off
DisplayConnect Welcome
DisplayGoAway ""Server full""
DisplayLogin ""Login successful""
DisplayQuit Goodbye
RequireValidShell off
DeleteAbortedStores on
HiddenStor on
ShowSymlinks off
AuthAliasOnly off
</Global>
/etc/proftpd/modules.conf
Code:
#
# This file is used to manage DSO modules and features.
#

# This is the directory where DSO modules reside

ModulePath /usr/lib/proftpd

# Allow only user root to load and unload modules, but allow everyone
# to see which modules have been loaded

ModuleControlsACLs insmod,rmmod allow user root
ModuleControlsACLs lsmod allow user *

LoadModule mod_ctrls_admin.c
LoadModule mod_tls.c
LoadModule mod_sql.c
LoadModule mod_ldap.c
LoadModule mod_sql_mysql.c
LoadModule mod_sql_postgres.c
LoadModule mod_quotatab.c
LoadModule mod_quotatab_file.c
LoadModule mod_quotatab_ldap.c
LoadModule mod_quotatab_sql.c
LoadModule mod_radius.c
LoadModule mod_wrap.c
LoadModule mod_rewrite.c

# keep this module the last one
LoadModule mod_ifsession.c
<Anonymous /home/ftp>
</Anonymous>
<Directory /home/ftp/>
DeleteAbortedStores on
HiddenStor on
HideNoAccess on
AllowAll 
AllowOverwrite off
<Limit CWD RNFR DELE RETR STOR READ WRITE DIRS LOGIN ALL>
Order allow,deny
AllowUser userftp
DenyAll
</Limit>
<Limit MKD RMD>
Order allow,deny
DenyAll
</Limit>
</Directory>
<Directory /home/family>
<Limit CWD RNFR DELE RETR STOR READ WRITE DIRS LOGIN>
Order allow,deny
AllowUser family
DenyAll
</Limit>
<Limit MKD RMD>
Order allow,deny
DenyAll
</Limit>
</Directory>
<Directory /home>
<Limit ALL>
Order allow,deny
DenyAll
</Limit>
</Directory>
 
Old 09-11-2008, 08:11 AM   #4
halvorls
Member
 
Registered: Jun 2008
Posts: 78

Rep: Reputation: 15
So it works?

How many years are you?

Last edited by halvorls; 09-11-2008 at 08:12 AM.
 
Old 09-14-2008, 06:10 AM   #5
uglyoldbob
LQ Newbie
 
Registered: Sep 2008
Posts: 5

Original Poster
Rep: Reputation: 0
Quote:
Originally Posted by halvorls View Post
So it works?

How many years are you?
It works fine. I had to delete all the folder config stuff and then redo the config with webmin (because I am not so versed in hand writing config files).

How many years? I don't understand.
 
Old 09-15-2008, 07:31 AM   #6
halvorls
Member
 
Registered: Jun 2008
Posts: 78

Rep: Reputation: 15
Hi!

How old are you?
 
Old 09-15-2008, 11:18 PM   #7
uglyoldbob
LQ Newbie
 
Registered: Sep 2008
Posts: 5

Original Poster
Rep: Reputation: 0
I am 22 years old.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off
Trackbacks are Off
Pingbacks are On
Refbacks are Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Losing network connectivity between single user and multi user modes n3now Linux - Hardware 14 04-13-2008 01:13 PM
Single user or multi-user mode? hyphae Slackware 3 01-26-2007 10:52 AM
Multi-user and 3D sharing, 3D only works for the first logged in user foxy123 Suse/Novell 0 02-20-2005 04:31 AM
Mandrake 9.2 proftpd user configuration problems biniar Linux - Newbie 4 04-03-2004 02:17 PM
Pleasehelp with proftpd.conf - trying to config user to write files as other user. philg Linux - Software 1 06-21-2003 12:13 PM


All times are GMT -5. The time now is 10:42 AM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration