no way to compare when less than two revisions
Differences
This shows you the differences between two versions of the page.
| — | pure-ftpd [2015/06/01 23:19] (current) – created - external edit 127.0.0.1 | ||
|---|---|---|---|
| Line 1: | Line 1: | ||
| + | ====== pure-ftpd ====== | ||
| + | * [[http:// | ||
| + | |||
| + | ==== Configuration ==== | ||
| + | |||
| + | pure-ftpd can be setup with virtual users, that exist outside of the PAM and Unix authentication methods. | ||
| + | |||
| + | First, setup and configure pure-ftpd. | ||
| + | |||
| + | Here's the generic list of settings being applied: | ||
| + | |||
| + | * Compatability-mode for broken FTP clients | ||
| + | * No anonymous user login | ||
| + | * Logins only allowed through pure-ftpd user database | ||
| + | * Don't allow chmod of files | ||
| + | * Don't allow reading or writing dot files | ||
| + | |||
| + | == Setup user authentication == | ||
| + | |||
| + | |||
| + | < | ||
| + | ln -s / | ||
| + | ln -s / | ||
| + | ln -s / | ||
| + | </ | ||
| + | |||
| + | == Setup FTP configuration == | ||
| + | |||
| + | You can see the configuration options in the '' | ||
| + | |||
| + | < | ||
| + | cd / | ||
| + | echo clf:/ | ||
| + | echo yes > BrokenClientsCompatibility | ||
| + | echo yes > ChrootEveryone | ||
| + | echo yes > CustomerProof | ||
| + | echo yes > DontResolve | ||
| + | echo UTF-8 > FSCharset | ||
| + | echo 20 > MaxClientsNumber | ||
| + | echo 4 > MaxClientsPerIP | ||
| + | echo 1000 > MinUID | ||
| + | echo yes > NoAnonymous | ||
| + | echo yes > NoChmod | ||
| + | echo yes > NoTruncate | ||
| + | echo no > PAMAuthentication | ||
| + | echo 40000 50000 > PassivePortRange | ||
| + | echo yes > ProhibitDotFilesRead | ||
| + | echo yes > ProhibitDotFilesWrite | ||
| + | echo / | ||
| + | echo 0 > TLS | ||
| + | echo no > UnixAuthentication | ||
| + | </ | ||
| + | |||
| + | == Use only pure-ftpd authentication == | ||
| + | |||
| + | < | ||
| + | rm / | ||
| + | ln -s / | ||
| + | </ | ||
| + | |||
| + | ==== TLS Support ==== | ||
| + | |||
| + | TLS support works in tandem with normal FTP, being optional to use the extra security. | ||
| + | |||
| + | pure-ftpd needs a PEM file located at ''/ | ||
| + | |||
| + | < | ||
| + | cat / | ||
| + | </ | ||
| + | |||
| + | Enable optional TLS support: | ||
| + | |||
| + | < | ||
| + | echo 1 > / | ||
| + | </ | ||
| + | |||
| + | ==== FTP Users ==== | ||
| + | |||
| + | You can create users separate from system accounts so that they each have their own login and password. | ||
| + | |||
| + | Always run '' | ||
| + | |||
| + | == Create an FTP user and bind them to a system account == | ||
| + | |||
| + | < | ||
| + | pure-pw useradd ftp-steve -u steve -g users -d /home/steve | ||
| + | pure-pw mkdb | ||
| + | </ | ||
| + | |||
| + | == Delete an FTP user == | ||
| + | |||
| + | < | ||
| + | pure-pw userdel ftp-steve | ||
| + | pure-pw mkdb | ||
| + | </ | ||
| + | |||
| + | == Show FTP user details == | ||
| + | |||
| + | < | ||
| + | pure-pw show ftp-steve | ||
| + | </ | ||
| + | |||
| + | === IPTables === | ||
| + | |||
| + | iptables must have a rule set for a port range for passive ports. | ||
| + | |||
| + | < | ||
| + | iptables -A INPUT -p tcp --match multiport --dports 40000:50000 -j ACCEPT | ||
| + | </ | ||
| + | |||
| + | === Notes === | ||
| + | |||
| + | < | ||
| + | pure-ftpd | ||
| + | |||
| + | - all directives passed to binary as switches | ||
| + | - FTP accounts can be distinct from system accounts!!! | ||
| + | - Can setup separate FTP user passwords from system account!! | ||
| + | - MySQL support | ||
| + | - quota support | ||
| + | - bandwidth throttling | ||
| + | - CLI app to see connections, | ||
| + | - restrict access to IP address ranges, or only to it's own virtual host!! | ||
| + | - chroot | ||
| + | - connection during configured time-ranges | ||
| + | - .ftpaccess support | ||
| + | - Restrict access to dot files | ||
| + | - can disable chmod completely | ||
| + | - allows symbolic links, even when chrooted | ||
| + | - directory aliases supported | ||
| + | - uploads are atomic!! | ||
| + | |||
| + | More: | ||
| + | RFC conformance is great, but in the real-life, there are a lot of buggy clients. It’s why Pure-FTPd has also workarounds for some versions of popular Windows clients that totally violates the FTP protocol. Pure-FTPd also works with broken home-made clients that don’t properly terminate lines. | ||
| + | |||
| + | Firewalling is easy: Pure-FTPd can restrict the port range for passive connections, | ||
| + | |||
| + | |||
| + | |||
| + | / | ||
| + | |||
| + | |||
| + | -0 (zero) - while uploading a file, don't overwrite it until it's finished uploading | ||
| + | -A chroot everyone | ||
| + | -B start in background (daemon mode) | ||
| + | -E authenticated users only (no anonymous) | ||
| + | -l < | ||
| + | -N NAT mode -- use if remote connections can't get a directory listing | ||
| + | -O output to file | ||
| + | -p < | ||
| + | -R don't let users use chmod (for their own protection) | ||
| + | -u <uid> - don't allow users under uid to login | ||
| + | -c - max number of sessions | ||
| + | -C - max number of connections from one IP address | ||
| + | -y - max number of connections with the same user name | ||
| + | -Y 1 - Accept standard and encrypted sessions | ||
| + | -Z enable options for ISPs to protect users from doing stupid stuff (no chmod) | ||
| + | |||
| + | -0 --notruncate | ||
| + | -A --chrooteveryone | ||
| + | -B --daemonize | ||
| + | -E --noanonymous | ||
| + | -l --login pam | puredb:/ | ||
| + | -N --natmode | ||
| + | -O --altlog | ||
| + | -p --passiveportrange < | ||
| + | -R --nochmod | ||
| + | -u --minuid <uid> | ||
| + | -c --maxclientsnumber | ||
| + | -C --maxclientsperip | ||
| + | -y --peruserlimits | ||
| + | -x --prohibitdotfileswrite | ||
| + | -X --prohibitdotfilesread | ||
| + | -Y --tls 1 | ||
| + | -Z --customerproof | ||
| + | </ | ||
| + | |||
| + | === OS X === | ||
| + | |||
| + | Finder does not allow anonymous ftp write access. | ||
| + | |||
| + | ==== Configuration Flags ==== | ||
| + | |||
| + | * -0, --notruncate | ||
| + | * -4, --ipv4only | ||
| + | * -A, --chrooteveryone | ||
| + | * -b --brokenclientscompatibility | ||
| + | * -I --maxidletime | ||
| + | * -M --anonymouscancreatedirs | ||
| + | * -R --nochmod | ||
| + | * -x --prohibitdotfileswrite | ||
| + | * -X --prohibitdotfilesread | ||
| + | * -Y --tls < | ||
| + | * -Z --customerproof | ||
| + | |||
| + | ==== Gentoo ==== | ||
| + | |||
| + | Gentoo configuration for pure-ftpd is located at ''/ | ||
