Proftpd Without UNIX Users on Debian
Posted in Guides, Technology on February 1st, 2009 by thomasp – 1 Comment“So how do I setup a Proftpd FTP server on Debian without the hassle of using UNIX accounts for users of my server“, you might ask. “Brilliant question” I might respond. For the sake of clarity however, here follow what information I’ve been able to piece together during the last few units of time.
Before we go into detail on how it’s actually done, let’s take some time to reflect upon what we shall expect of this server:
- No need for having UNIX users in order to log in
- In particular do not allow UNIX users to log in
- Jail users into their home directory
- Make delicious coffee
First become root with
su
or
sudo su
if you’re on a weird system (e.g. Ubuntu).
Fetch the package typing
apt-get install proftpd
The installer will ask you if you whether you want it to run on top of inetd or as a standalone service. Choose standalone because the other is rubbish or at least not very good (thank God this is a blog, so I don’t have to justify my opinions!).
Editing the Configuration File
Next up is the configuration. I won’t go into irrelevant features such as virtual hosts, but if that’s what you want you’d best check out the example configurations at the official site. They’re actually pretty explanatory.
Start editing the configuration file using your editor of choice. This example features emacs.
emacs /etc/proftpd/proftpd.conf
The order in which the following is written is not important. It is important though, that it does NOT get stuck inside any XMLish tags such as …
This is what my /etc/proftpd/proftpd.conf includes:
# enable virtual users' shell to be /bin/false
RequireValidShell off
# disable logins from UNIX users.
# to enable UNIX users too,
# add mod_unix.c to the space-separated list
AuthOrder mod_auth_file.c
# auth files
AuthUserFile /etc/proftpd/ftpd.passwd
AuthGroupFile /etc/proftpd/ftpd.group
# jail the users in their home directories
DefaultRoot ~
The alert user instantly notices the files /etc/proftpd/ftpd.passwd and /etc/proftpd/ftpd.group. They are the virtual user equivalent of /etc/passwd and /etc/group which are the files Proftpd would have used had we not told it otherwise. Other than the fact that they share the exact same format, they are in no way connected in our setup. Proftpd doesn’t know about any other password/group files than the two specified in the new configuration file.
Creating the ftpd.passwd file
If you’re not into editing the ftpd.passwd by hand, you can use the ftpasswd script made available from http://www.castaglia.org/proftpd/. At the time of writing it can be obtained using
wget http://www.castaglia.org/proftpd/contrib/ftpasswd
It is a Perl script. First make it executable
chmod +x ftpasswd
The usage example featured here has will make a user with the username ‘john‘ with user id ‘1‘ and group id ‘1‘, having a disabled shell and save this user to the /etc/proftpd/ftpd.passwd password file.
./ftpasswd --passwd --file=/etc/proftpd/ftpd.passwd --name=john --uid=1 --gid=1 --home=/home/ftp --shell=/bin/false
The next user should have a different id (e.g. ‘2′).
To allow users to modify files you can choose to make it writable by any user of the system. Recall however that you’ve already jailed each user to his/her home directory, so the damage potential is rather limited. My example uses the /home/ftp folder as the home dir, so let’s remove the restrictions on that directory.
chmod 777 /home/ftp
Now all that’s left to do is restarting the server.
/etc/init.d/proftpd restart
If you’ve read this far I really hope it’s working for you! If not or if you have rants/comments about this guide, feel free to vent in the comments-section.