LinuxQuestions.org - proftpd multi-user configuration, user cannot show contents of directories

- Linux - Server (https://www.linuxquestions.org/questions/linux-server-73/)

- - proftpd multi-user configuration, user cannot show contents of directories (https://www.linuxquestions.org/questions/linux-server-73/proftpd-multi-user-configuration-user-cannot-show-contents-of-directories-669014/)

proftpd multi-user configuration, user cannot show contents of directories

I am running a linode server with the proftpd server configured with webmin.
When I first setup the server, I configured it for one user (named userftp) and it worked fine.
I recently added another user to the configuration (named family).
I wanted each user to not have access to each other's files, so I set it up so each user would have their own directory in /home.
Username family works as expected. However, username userftp can long in, but now show the contents of any directories.

Here are the contents of my config file for proftpd.

#
# /etc/proftpd/proftpd.conf -- This is a basic ProFTPD configuration file.
# To really apply changes reload proftpd after modifications.
#

# Includes DSO modules
Include /etc/proftpd/modules.conf

# Set off to disable IPv6 support which is annoying on IPv4 only boxes.
UseIPv6 off

AuthAliasOnly off

ServerName "Debian"
ServerType standalone
DeferWelcome off

MultilineRFC2228 on
DefaultServer on
ShowSymlinks on

TimeoutNoTransfer 600
TimeoutStalled 600
TimeoutIdle 1200

DisplayLogin welcome.msg
DisplayFirstChdir .message
ListOptions "-l"

DenyFilter \*.*/

# Use this to jail all users in their homes
#DefaultRoot /home
#DefaultRoot ~
IdentLookups off
ServerIdent on "FTP sever ready"
AccessGrantMsg Welcome.

MaxLoginAttempts 5

# Users require a valid shell listed in /etc/shells to login.
# Use this directive to release that constrain.
# RequireValidShell off

# Port 21 is the standard FTP port.
Port 21

# In some cases you have to specify passive ports range to by-pass
# firewall limitations. Ephemeral ports can be used for that, but
# feel free to use a more narrow range.
# PassivePorts 49152 65534

# If your host was NATted, this option is useful in order to
# allow passive tranfers to work. You have to use your public
# address and opening the passive ports used on your firewall as well.
MasqueradeAddress (valid ip address)

# To prevent DoS attacks, set the maximum number of child processes
# to 30. If you need to allow more than 30 concurrent connections
# at once, simply increase this value. Note that this ONLY works
# in standalone mode, in inetd mode you should use an inetd server
# that allows you to limit maximum number of processes per service
# (such as xinetd)
MaxInstances 30

# Set the user and group that the server normally runs at.
User nobody
Group nogroup

# Umask 022 is a good standard umask to prevent new files and dirs
# (second parm) from being group and world writable.
Umask 022 022
# Normally, we want files to be overwriteable.
AllowOverwrite on

# Uncomment this if you are using NIS or LDAP to retrieve passwords:
# PersistentPasswd off

# Be warned: use of this directive impacts CPU average load!
# Uncomment this if you like to see progress and transfer rate with ftpwho
# in downloads. That is not needed for uploads rates.
#
# UseSendFile off

# Choose a SQL backend among MySQL or PostgreSQL.
# Both modules are loaded in default configuration, so you have to specify the backend
# or comment out the unused module in /etc/proftpd/modules.conf.
# Use 'mysql' or 'postgres' as possible values.
#
#<IfModule mod_sql.c>
# SQLBackend mysql
#</IfModule>

TransferLog /var/log/proftpd/xferlog
SystemLog /var/log/proftpd/proftpd.log

<IfModule mod_tls.c>
TLSEngine off
</IfModule>

<IfModule mod_quota.c>
QuotaEngine on
</IfModule>

<IfModule mod_ratio.c>
Ratios on
</IfModule>

# Delay engine reduces impact of the so-called Timing Attack described in
#
# It is on by default.
<IfModule mod_delay.c>
DelayEngine on
</IfModule>

<IfModule mod_ctrls.c>
ControlsEngine on
ControlsMaxClients 2
ControlsLog /var/log/proftpd/controls.log
ControlsInterval 5
ControlsSocket /var/run/proftpd/proftpd.sock
</IfModule>

<IfModule mod_ctrls_admin.c>
AdminControlsEngine on
</IfModule>

#VALID LOGINS
<Limit LOGIN>
AllowUser userftp
AllowUser family
DenyALL
</Limit>

<Directory /home/ftp>
Umask 022 022
AllowOverwrite off
DeleteAbortedStores on
HiddenStor on
HideNoAccess on
AllowAll
</Directory>

<Directory /home/ftp/download/*>
Umask 022 022
AllowOverwrite off
<Limit MKD STOR DELE XMKD RNEF RNTO RMD XRMD>
DenyAll
</Limit>
</Directory>

<Directory> /home/ftp/upload/>
Umask 022 022
AllowOverwrite on
<Limit READ RMD DELE>
DenyAll
</Limit>

<Limit STOR CWD MKD>
AllowAll
</Limit>
</Directory>

# A basic anonymous configuration, no upload directories.

# <Anonymous ~ftp>
# User ftp
# Group nogroup
# # We want clients to be able to login with "anonymous" as well as "ftp"
# UserAlias anonymous ftp
# # Cosmetic changes, all files belongs to ftp user
# DirFakeUser on ftp
# DirFakeGroup on ftp
#
# RequireValidShell off
#
# # Limit the maximum number of anonymous logins
# MaxClients 10
#
# # We want 'welcome.msg' displayed at login, and '.message' displayed
# # in each newly chdired directory.
# DisplayLogin welcome.msg
# DisplayFirstChdir .message
#
# # Limit WRITE everywhere in the anonymous chroot
# <Directory *>
# <Limit WRITE>
# DenyAll
# </Limit>
# </Directory>
#
# # Uncomment this if you're brave.
# # <Directory incoming>
# # # Umask 022 is a good standard umask to prevent new files and dirs
# # # (second parm) from being group and world writable.
# # Umask 022 022
# # <Limit READ WRITE>
# # DenyAll
# # </Limit>
# # <Limit STOR>
# # AllowAll
# # </Limit>
# # </Directory>
#
# </Anonymous>
<Global>
RootLogin off
DisplayConnect Welcome
DisplayGoAway ""Server full""
DisplayLogin ""Login successful""
DisplayQuit Goodbye
RequireValidShell off
DefaultRoot /home/ftp userftp
DefaultRoot /home/family family
DeleteAbortedStores on
HiddenStor on
ShowSymlinks off
AuthAliasOnly off
</Global>

Find folow line:

ServerName "Debian"
ServerType standalone
DeferWelcome off

And add follow line:

UseFtpUsers on
DefaultRoot ~

And delete folow line:

# Use this to jail all users in their homes
#DefaultRoot /home
#DefaultRoot ~

That well work :)

I managed to get it working. Here are my config files for those with similar problems. Hopefully these help out. Apparently webmin wasn't so good at setting up the config files.

/etc/proftpd/proftpd.conf

Code:

#

# /etc/proftpd/proftpd.conf -- This is a basic ProFTPD configuration file.

# To really apply changes reload proftpd after modifications.

# 



# Includes DSO modules

Include /etc/proftpd/modules.conf



# Set off to disable IPv6 support which is annoying on IPv4 only boxes.

UseIPv6                                off



AuthAliasOnly                        off



ServerName                        "Debian"

ServerType                        standalone

DeferWelcome                        off

UseFtpUsers                        on

DefaultRoot                        ~



MultilineRFC2228                on

DefaultServer                        on

ShowSymlinks                        on



TimeoutNoTransfer                600

TimeoutStalled                        600

TimeoutIdle                        1200



DisplayLogin                    welcome.msg

DisplayFirstChdir              .message

ListOptions                        "-l"



DenyFilter \*.*/



IdentLookups                        off

ServerIdent                        on "FTP sever ready"

AccessGrantMsg Welcome.



MaxLoginAttempts                5



# Users require a valid shell listed in /etc/shells to login.

# Use this directive to release that constrain.

# RequireValidShell                off



# Port 21 is the standard FTP port.

Port                                21



# In some cases you have to specify passive ports range to by-pass

# firewall limitations. Ephemeral ports can be used for that, but

# feel free to use a more narrow range.

# PassivePorts                  49152 65534



# If your host was NATted, this option is useful in order to

# allow passive tranfers to work. You have to use your public

# address and opening the passive ports used on your firewall as well.

MasqueradeAddress                (server ip address)



# To prevent DoS attacks, set the maximum number of child processes

# to 30.  If you need to allow more than 30 concurrent connections

# at once, simply increase this value.  Note that this ONLY works

# in standalone mode, in inetd mode you should use an inetd server

# that allows you to limit maximum number of processes per service

# (such as xinetd)

MaxInstances                        30



# Set the user and group that the server normally runs at.

User                                nobody

Group                                nogroup



# Umask 022 is a good standard umask to prevent new files and dirs

# (second parm) from being group and world writable.

Umask                                022  022

# Normally, we want files to be overwriteable.

AllowOverwrite on



# Uncomment this if you are using NIS or LDAP to retrieve passwords:

# PersistentPasswd                off



# Be warned: use of this directive impacts CPU average load!

# Uncomment this if you like to see progress and transfer rate with ftpwho

# in downloads. That is not needed for uploads rates.

#

# UseSendFile                        off



# Choose a SQL backend among MySQL or PostgreSQL.

# Both modules are loaded in default configuration, so you have to specify the backend 

# or comment out the unused module in /etc/proftpd/modules.conf.

# Use 'mysql' or 'postgres' as possible values.

#

#<IfModule mod_sql.c>

# SQLBackend                        mysql

#</IfModule>



TransferLog /var/log/proftpd/xferlog

SystemLog  /var/log/proftpd/proftpd.log



<IfModule mod_tls.c>

TLSEngine off

</IfModule>



<IfModule mod_quota.c>

QuotaEngine on

</IfModule>



<IfModule mod_ratio.c>

Ratios on

</IfModule>





# Delay engine reduces impact of the so-called Timing Attack described in

# http://security.lss.hr/index.php?page=details&ID=LSS-2004-10-02

# It is on by default. 

<IfModule mod_delay.c>

DelayEngine on

</IfModule>



<IfModule mod_ctrls.c>

ControlsEngine        on

ControlsMaxClients    2

ControlsLog          /var/log/proftpd/controls.log

ControlsInterval      5

ControlsSocket        /var/run/proftpd/proftpd.sock

</IfModule>



<IfModule mod_ctrls_admin.c>

AdminControlsEngine on

</IfModule>



#VALID LOGINS

<Limit CWD READ LOGIN>

Order allow,deny

AllowUser userftp

AllowUser family

DenyAll

</Limit>





# A basic anonymous configuration, no upload directories.



# <Anonymous ~ftp>

#  User                                ftp

#  Group                                nogroup

#  # We want clients to be able to login with "anonymous" as well as "ftp"

#  UserAlias                        anonymous ftp

#  # Cosmetic changes, all files belongs to ftp user

#  DirFakeUser        on ftp

#  DirFakeGroup on ftp

# 

#  RequireValidShell                off

# 

#  # Limit the maximum number of anonymous logins

#  MaxClients                        10

# 

#  # We want 'welcome.msg' displayed at login, and '.message' displayed

#  # in each newly chdired directory.

#  DisplayLogin                        welcome.msg

#  DisplayFirstChdir                .message

# 

#  # Limit WRITE everywhere in the anonymous chroot

#  <Directory *>

#    <Limit WRITE>

#      DenyAll

#    </Limit>

#  </Directory>

# 

#  # Uncomment this if you're brave.

#  # <Directory incoming>

#  #  # Umask 022 is a good standard umask to prevent new files and dirs

#  #  # (second parm) from being group and world writable.

#  #  Umask                                022  022

#  #            <Limit READ WRITE>

#  #            DenyAll

#  #            </Limit>

#  #            <Limit STOR>

#  #            AllowAll

#  #            </Limit>

#  # </Directory>

# 

# </Anonymous>

<Global>

RootLogin off

DisplayConnect Welcome

DisplayGoAway ""Server full""

DisplayLogin ""Login successful""

DisplayQuit Goodbye

RequireValidShell off

DeleteAbortedStores on

HiddenStor on

ShowSymlinks off

AuthAliasOnly off

</Global>

/etc/proftpd/modules.conf

Code:

#

# This file is used to manage DSO modules and features.

#



# This is the directory where DSO modules reside



ModulePath /usr/lib/proftpd



# Allow only user root to load and unload modules, but allow everyone

# to see which modules have been loaded



ModuleControlsACLs insmod,rmmod allow user root

ModuleControlsACLs lsmod allow user *



LoadModule mod_ctrls_admin.c

LoadModule mod_tls.c

LoadModule mod_sql.c

LoadModule mod_ldap.c

LoadModule mod_sql_mysql.c

LoadModule mod_sql_postgres.c

LoadModule mod_quotatab.c

LoadModule mod_quotatab_file.c

LoadModule mod_quotatab_ldap.c

LoadModule mod_quotatab_sql.c

LoadModule mod_radius.c

LoadModule mod_wrap.c

LoadModule mod_rewrite.c



# keep this module the last one

LoadModule mod_ifsession.c

<Anonymous /home/ftp>

</Anonymous>

<Directory /home/ftp/>

DeleteAbortedStores on

HiddenStor on

HideNoAccess on

AllowAll 

AllowOverwrite off

<Limit CWD RNFR DELE RETR STOR READ WRITE DIRS LOGIN ALL>

Order allow,deny

AllowUser userftp

DenyAll

</Limit>

<Limit MKD RMD>

Order allow,deny

DenyAll

</Limit>

</Directory>

<Directory /home/family>

<Limit CWD RNFR DELE RETR STOR READ WRITE DIRS LOGIN>

Order allow,deny

AllowUser family

DenyAll

</Limit>

<Limit MKD RMD>

Order allow,deny

DenyAll

</Limit>

</Directory>

<Directory /home>

<Limit ALL>

Order allow,deny

DenyAll

</Limit>

</Directory>

So it works?

How many years are you?

Quote:

Originally Posted by halvorls (Post 3277065)

So it works?

How many years are you?

It works fine. I had to delete all the folder config stuff and then redo the config with webmin (because I am not so versed in hand writing config files).

How many years? I don't understand.

Hi!

How old are you?