please doublecheck my proftpd.conf

tw001_tw · 12-05-2004, 08:39 PM

Hello one and all.

I'm setting up proftpd to be used JUST from my computer to my server. I don't want
any other computer on the network OR from the 'outside' to be allowed in.
I created an account on the server for me to use, and that is commented out in
the /etc/ftpusers file. root, and ftp are uncommented.

Here is my proftpd.conf file. Any suggestions to make it better or more secure?

Code:

# MY proftpd.conf 

# Global stuff
ServerName			"ProFTPD is used for this ftp"
# ServerType			standalone
ServerType			inetd
DefaultServer			on
Port				21
Umask				022
TimeoutIdle                    1200 
MaxInstances			1
SystemLog			/var/log/proftpd.log
TransferLog			/var/log/xferlog
MaxClients			1
DisplayLogin			welcome.msg
DisplayFirstChdir		.message

<Limit LOGIN>
order Allow,Deny
Allow from 192.168.1.100
Deny from all
</Limit>

# Allow overwriting of files?
<Directory /*>
  AllowOverwrite		off
</Directory>

# Allow reading of incoming
<Directory /home/ftp/incoming/*>
 <Limit READ>
    Order allow,deny
    Allow from 192.168.1.100
    DenyAll
 </Limit>


# Deny write access from all except trusted hosts
<Limit WRITE>
  Order     allow,deny
  Allow     from 192.168.1.100
  Deny      from all
</Limit>

Thanks in advance
-tw

P.S. - it appears to be working, but I can't read the incoming directory.
please advise.

Cerbere · 12-06-2004, 12:06 AM

Quote:

Originally posted by tw001_tw

Code:

# Allow reading of incoming
<Directory /home/ftp/incoming/*>
 <Limit READ>
    Order allow,deny
    Allow from 192.168.1.100
    DenyAll
 </Limit>

P.S. - it appears to be working, but I can't read the incoming directory.
please advise. [/B]

The 'DenyAll' in this section needs to be changed to 'Deny from all', or at least to 'Deny all'. The DenyAll directive is more stringent than 'Deny from all', and has higher precedence than the Allow directive.

BTW you may want to close port 21 to all but 192.168.1.100 using iptables, just to be sure.

Enjoy!
--- Cerbere