Navigation

geekman · #1 4th August 2007, 15:18

Ok so I've had proftpd installed on my server for a fair few years now along with apache, I also have mysql 5 running on another server which all the websites use. The ftp server was running under the permissions of websites:websites. I've changed it to run as cpanel:cpanel (I'm currently looking at developing a custom control panel - I have tried ISPconfig and many others but considering I have multiple servers running the multiple required services and I want the ability to add multiple webservers for example then centrally manage them none have worked well - and thus the want to do with virtual users with MySQL so I can more easily manage users.) I originally had proftpd installed on its own, i removed and purged that with apt, I then installed proftpd-mysql. Apart from that I then Added the bits to mysql mentioned in the guide (http://www.howtoforge.com/proftpd_my...rtual_hosting), but instead telling it to run as cpanel:cpanel. Also, I am running ubuntu 6.10 on my webserver and my database server.

Here is my proftpd.conf file:

Code:

ServerName                      "::Uberhosting::"
ServerType                      standalone
DeferWelcome                    off

MultilineRFC2228                on
DefaultServer                   on
ShowSymlinks                    on

TimeoutNoTransfer               600
TimeoutStalled                  600
TimeoutIdle                     1200

DisplayLogin                    welcome.msg
DisplayFirstChdir               .message
ListOptions                     "-l"

DenyFilter                      \*.*/

# Port 21 is the standard FTP port.
Port                            21

# In some cases you have to specify passive ports range to by-pass
# firewall limitations. Ephemeral ports can be used for that, but
# feel free to use a more narrow range.
# PassivePorts                    49152 65534

# To prevent DoS attacks, set the maximum number of child processes
# to 30.  If you need to allow more than 30 concurrent connections
# at once, simply increase this value.  Note that this ONLY works
# in standalone mode, in inetd mode you should use an inetd server
# that allows you to limit maximum number of processes per service
# (such as xinetd)
MaxInstances                    30

# Set the user and group that the server normally runs at.
User                            cpanel
Group                           cpanel

# Umask 022 is a good standard umask to prevent new files and dirs
# (second parm) from being group and world writable.
Umask                           022  022
# Normally, we want files to be overwriteable.
AllowOverwrite                  on

# Uncomment this if you are using NIS or LDAP to retrieve passwords:
# PersistentPasswd              off

# Be warned: use of this directive impacts CPU average load!
#
# Uncomment this if you like to see progress and transfer rate with ftpwho
# in downloads. That is not needed for uploads rates.
# UseSendFile                   off

TransferLog /var/log/proftpd/xferlog
SystemLog   /var/log/proftpd/proftpd.log

<IfModule mod_tls.c>
TLSEngine off
</IfModule>

<IfModule mod_quota.c>
QuotaEngine on
</IfModule>

<IfModule mod_ratio.c>
Ratios on
</IfModule>


# Delay engine reduces impact of the so-called Timing Attack described in
# http://security.lss.hr/index.php?page=details&ID=LSS-2004-10-02
# It is on by default.
<IfModule mod_delay.c>
DelayEngine on
</IfModule>

<IfModule mod_ctrls.c>
ControlsEngine        on
ControlsMaxClients    2
ControlsLog           /var/log/proftpd/controls.log
ControlsInterval      5
ControlsSocket        /var/run/proftpd/proftpd.sock
</IfModule>

<IfModule mod_ctrls_admin.c>
AdminControlsEngine on
</IfModule>

# A basic anonymous configuration, no upload directories.

# <Anonymous ~ftp>
#   User                                ftp
#   Group                               nogroup
#   # We want clients to be able to login with "anonymous" as well as "ftp"
#   UserAlias                   anonymous ftp
#   # Cosmetic changes, all files belongs to ftp user
#   DirFakeUser on ftp
#   DirFakeGroup on ftp
#
#   RequireValidShell           off
#
#   # Limit the maximum number of anonymous logins
#   MaxClients                  10
#
#   # We want 'welcome.msg' displayed at login, and '.message' displayed
#   # in each newly chdired directory.
#   DisplayLogin                        welcome.msg
#   DisplayFirstChdir           .message
#
#   # Limit WRITE everywhere in the anonymous chroot
#   <Directory *>
#     <Limit WRITE>
#       DenyAll
#     </Limit>
#   </Directory>
#
#   # Uncomment this if you're brave.
#   # <Directory incoming>
#   #   # Umask 022 is a good standard umask to prevent new files and dirs
#   #   # (second parm) from being group and world writable.
#   #   Umask                           022  022
#   #            <Limit READ WRITE>
#   #            DenyAll
#   #            </Limit>
#   #            <Limit STOR>
#   #            AllowAll
#   #            </Limit>
#   # </Directory>
#
# </Anonymous>

# MySQL Config & Hardening
# ------------------------

DefaultRoot ~

# Lets speed up login time by disabling ident and dns lookup
UseReverseDNS off
IdentLookups off

# The passwords in MySQL are encrypted using CRYPT
# SQLAuthTypes            Plaintext Crypt
# SQLAuthenticate         users* groups*


# used to connect to the database
# databasename@host database_user user_password
# SQLConnectInfo  cpanel@192.168.1.201 cpanel xxxxxxxx


# Here we tell ProFTPd the names of the database columns in the "usertable"
# we want it to interact with. Match the names with those in the db
# SQLUserInfo     ftpuser userid passwd uid gid homedir shell

# Here we tell ProFTPd the names of the database columns in the "grouptable"
# we want it to interact with. Again the names match with those in the db
# SQLGroupInfo    ftpgroup groupname gid members

# set min UID and GID - otherwise these are 999 each
# SQLMinID        500

# create a user's home directory on demand if it doesn't exist
# SQLHomedirOnDemand on

# Update count every time user logs in
# SQLLog PASS updatecount
# SQLNamedQuery updatecount UPDATE "count=count+1, accessed=now() WHERE userid='%u'" ftpuser

# Update modified everytime user uploads or deletes a file
# SQLLog  STOR,DELE modified
#SQLNamedQuery modified UPDATE "modified=now() WHERE userid='%u'" ftpuser

# User quotas
# ===========
# QuotaEngine on
# QuotaDirectoryTally on
QuotaDisplayUnits Mb
QuotaShowQuotas on

SQLNamedQuery get-quota-limit SELECT "name, quota_type, per_session, limit_type, bytes_in_avail, bytes_out_avail, bytes_xfer_avail, files_in_avail, files_out_avail, files_xfer_avail FROM ftpquotalimits WHERE name = '%{0}' AND quota_type = '%{1}'"

SQLNamedQuery get-quota-tally SELECT "name, quota_type, bytes_in_used, bytes_out_used, bytes_xfer_used, files_in_used, files_out_used, files_xfer_used FROM ftpquotatallies WHERE name = '%{0}' AND quota_type = '%{1}'"

SQLNamedQuery update-quota-tally UPDATE "bytes_in_used = bytes_in_used + %{0}, bytes_out_used = bytes_out_used + %{1}, bytes_xfer_used = bytes_xfer_used + %{2}, files_in_used = files_in_used + %{3}, files_out_used = files_out_used + %{4}, files_xfer_used = files_xfer_used + %{5} WHERE name = '%{6}' AND quota_type = '%{7}'" ftpquotatallies

SQLNamedQuery insert-quota-tally INSERT "%{0}, %{1}, %{2}, %{3}, %{4}, %{5}, %{6}, %{7}" ftpquotatallies

QuotaLimitTable sql:/get-quota-limit
QuotaTallyTable sql:/get-quota-tally/update-quota-tally/insert-quota-tally

RootLogin off
RequireValidShell off

I know I have all the mysql part commented out...just seeing if it would work without that and go back to system users, it doesn't IIRC. Also while i'm at it, where exactly would I need to add something to make it so that I could have a 'disabled' field and require that to be 0 in order to be able to login, possibly a link to documentation on the relevant MySQL directives?

Here is the modules.conf file:

Code:

#
# This file is used to manage DSO modules and features.
#

# This is the directory where DSO modules resides

ModulePath /usr/lib/proftpd

# Allow only user root to load and unload modules, but allow everyone
# to see which modules have been loaded

ModuleControlsACLs insmod,rmmod allow user root
ModuleControlsACLs lsmod allow user *

#LoadModule mod_ctrls_admin.c
LoadModule mod_tls.c
LoadModule mod_sql.c
LoadModule mod_ldap.c
LoadModule mod_sql_mysql.c
LoadModule mod_sql_postgres.c
LoadModule mod_quotatab.c
LoadModule mod_quotatab_file.c
LoadModule mod_quotatab_ldap.c
LoadModule mod_quotatab_sql.c
LoadModule mod_radius.c
LoadModule mod_wrap.c
LoadModule mod_rewrite.c

# keep this module the last one
LoadModule mod_ifsession.c

Please look on to next post.

geekman · #2 4th August 2007, 15:19

netstat -tap shows proftpd is running...

Code:

tcp6       0      0 *:www                   *:*                     LISTEN     3482/apache2
tcp6       0      0 *:82                    *:*                     LISTEN     3482/apache2
tcp6       0      0 *:ftp                   *:*                     LISTEN     4085/proftpd: (acce

And...

Code:

root@trinity:~/src/mod_mysql_userdir-1.2# ps auxwwwf | grep "ftp"
root      4786  0.0  0.1   2800   752 pts/0    S+   22:56   0:00                  \_ grep ftp
cpanel    4085  0.0  0.3   9132  1528 ?        Ss   20:51   0:00 proftpd: (accepting connections)

So i'm pretty sure it's running...

I checked syslog which shows nothing...probably since it only shows information once a user logs in IIRC, but proftpd.log shows nothing of use from what I can tell either, still....

Code:

root@trinity:~/src/mod_mysql_userdir-1.2# cat /var/log/proftpd/proftpd.log
Aug 03 10:16:15 trinity proftpd[28294] trinity: error setting IPV6_V6ONLY: Protocol not available
Aug 03 10:16:15 trinity proftpd[28294] trinity: ProFTPD 1.3.0 (stable) (built Sat Jul 22 12:08:18 UTC 2006) standalone mode STARTUP
Aug 03 10:41:16 trinity proftpd[3456] trinity: error setting IPV6_V6ONLY: Protocol not available
Aug 03 10:41:16 trinity proftpd[3456] trinity: ProFTPD 1.3.0 (stable) (built Sat Jul 22 12:08:18 UTC 2006) standalone mode STARTUP
Aug 03 17:16:08 trinity proftpd[3429] trinity: error setting IPV6_V6ONLY: Protocol not available
Aug 03 17:16:08 trinity proftpd[3429] trinity: ProFTPD 1.3.0 (stable) (built Sat Jul 22 12:08:18 UTC 2006) standalone mode STARTUP
Aug 04 07:37:02 trinity proftpd[4933] trinity (::ffff:211.234.98.162[::ffff:211.234.98.162]): error setting IPV6_V6ONLY: Protocol not available
Aug 04 07:37:03 trinity proftpd[4933] trinity (::ffff:211.234.98.162[::ffff:211.234.98.162]): FTP session opened.
Aug 04 07:37:03 trinity proftpd[4933] trinity (::ffff:211.234.98.162[::ffff:211.234.98.162]): FTP session closed.
Aug 04 15:59:50 trinity proftpd[3437] trinity: error setting IPV6_V6ONLY: Protocol not available
Aug 04 15:59:50 trinity proftpd[3437] trinity: ProFTPD 1.3.0 (stable) (built Sat Jul 22 12:08:18 UTC 2006) standalone mode STARTUP
Aug 04 20:37:28 trinity proftpd[3437] trinity: ProFTPD killed (signal 15)
Aug 04 20:37:28 trinity proftpd[3437] trinity: ProFTPD 1.3.0 standalone mode SHUTDOWN
Aug 04 20:37:51 trinity proftpd[3957] trinity: error setting IPV6_V6ONLY: Protocol not available
Aug 04 20:37:51 trinity proftpd[3957] trinity: ProFTPD 1.3.0 (stable) (built Sat Jul 22 12:08:18 UTC 2006) standalone mode STARTUP
Aug 04 20:38:55 trinity proftpd[3974] trinity (::ffff:192.168.0.1[::ffff:192.168.0.1]): FTP session closed.
Aug 04 20:39:01 trinity proftpd[3975] trinity (::ffff:192.168.0.1[::ffff:192.168.0.1]): FTP session closed.
Aug 04 20:39:07 trinity proftpd[3985] trinity (::ffff:192.168.0.1[::ffff:192.168.0.1]): FTP session closed.
Aug 04 20:39:13 trinity proftpd[3987] trinity (::ffff:192.168.0.1[::ffff:192.168.0.1]): FTP session closed.
Aug 04 20:39:19 trinity proftpd[3989] trinity (::ffff:192.168.0.1[::ffff:192.168.0.1]): FTP session closed.
Aug 04 20:39:25 trinity proftpd[3990] trinity (::ffff:192.168.0.1[::ffff:192.168.0.1]): FTP session closed.
Aug 04 20:39:28 trinity proftpd[3992] trinity (::ffff:127.0.0.1[::ffff:127.0.0.1]): FTP session closed.
Aug 04 20:51:20 trinity proftpd[4054] trinity (::ffff:192.168.0.1[::ffff:192.168.0.1]): FTP session closed.
Aug 04 20:51:26 trinity proftpd[4055] trinity (::ffff:192.168.0.1[::ffff:192.168.0.1]): FTP session closed.
Aug 04 20:51:32 trinity proftpd[4056] trinity (::ffff:192.168.0.1[::ffff:192.168.0.1]): FTP session closed.
Aug 04 20:51:34 trinity proftpd[3957] trinity: ProFTPD killed (signal 15)
Aug 04 20:51:34 trinity proftpd[3957] trinity: ProFTPD 1.3.0 standalone mode SHUTDOWN
Aug 04 20:51:57 trinity proftpd[4085] trinity: error setting IPV6_V6ONLY: Protocol not available
Aug 04 20:51:57 trinity proftpd[4085] trinity: ProFTPD 1.3.0 (stable) (built Sat Jul 22 12:08:18 UTC 2006) standalone mode STARTUP
Aug 04 20:52:46 trinity proftpd[4118] trinity (::ffff:192.168.0.1[::ffff:192.168.0.1]): FTP session closed.
Aug 04 20:52:52 trinity proftpd[4120] trinity (::ffff:192.168.0.1[::ffff:192.168.0.1]): FTP session closed.
Aug 04 20:52:58 trinity proftpd[4121] trinity (::ffff:192.168.0.1[::ffff:192.168.0.1]): FTP session closed.
Aug 04 20:53:04 trinity proftpd[4133] trinity (::ffff:192.168.0.1[::ffff:192.168.0.1]): FTP session closed.
Aug 04 20:53:10 trinity proftpd[4134] trinity (::ffff:192.168.0.1[::ffff:192.168.0.1]): FTP session closed.
Aug 04 20:53:16 trinity proftpd[4135] trinity (::ffff:192.168.0.1[::ffff:192.168.0.1]): FTP session closed.
Aug 04 20:54:12 trinity proftpd[4142] trinity (::ffff:127.0.0.1[::ffff:127.0.0.1]): FTP session closed.
Aug 04 20:54:21 trinity proftpd[4144] trinity (::ffff:127.0.0.1[::ffff:127.0.0.1]): FTP session closed.
Aug 04 21:58:56 trinity proftpd[4393] trinity (::ffff:127.0.0.1[::ffff:127.0.0.1]): FTP session closed.
root@trinity:~/src/mod_mysql_userdir-1.2#

My cpanel user has the uid of 1005 as far as I can tell anyways:

Code:

cpanel:x:1005:1001::/home/cpanel:/bin/sh

and the gid is 1004...I think

Code:

cpanel:x:1004:cpanel

Now I have the ftp tables inside my cpanel databse:

Code:

-- 
-- Table structure for table `ftpgroup`
-- 

CREATE TABLE `ftpgroup` (
  `groupname` varchar(16) NOT NULL default '',
  `gid` smallint(6) NOT NULL default '5500',
  `members` varchar(16) NOT NULL default '',
  KEY `groupname` (`groupname`)
) ENGINE=MyISAM DEFAULT CHARSET=latin1 COMMENT='ProFTP group table';

-- 
-- Dumping data for table `ftpgroup`
-- 

INSERT INTO `ftpgroup` (`groupname`, `gid`, `members`) VALUES ('cpanel', 1004, 'cpanel');

-- --------------------------------------------------------

-- 
-- Table structure for table `ftpquotalimits`
-- 

CREATE TABLE `ftpquotalimits` (
  `name` varchar(30) default NULL,
  `quota_type` enum('user','group','class','all') NOT NULL default 'user',
  `per_session` enum('false','true') NOT NULL default 'false',
  `limit_type` enum('soft','hard') NOT NULL default 'soft',
  `bytes_in_avail` int(10) unsigned NOT NULL default '0',
  `bytes_out_avail` int(10) unsigned NOT NULL default '0',
  `bytes_xfer_avail` int(10) unsigned NOT NULL default '0',
  `files_in_avail` int(10) unsigned NOT NULL default '0',
  `files_out_avail` int(10) unsigned NOT NULL default '0',
  `files_xfer_avail` int(10) unsigned NOT NULL default '0'
) ENGINE=MyISAM DEFAULT CHARSET=latin1;

-- 
-- Dumping data for table `ftpquotalimits`
-- 

INSERT INTO `ftpquotalimits` (`name`, `quota_type`, `per_session`, `limit_type`, `bytes_in_avail`, `bytes_out_avail`, `bytes_xfer_avail`, `files_in_avail`, `files_out_avail`, `files_xfer_avail`) VALUES ('exampleuser', 'user', 'true', 'hard', 15728640, 0, 0, 0, 0, 0);

-- --------------------------------------------------------

-- 
-- Table structure for table `ftpquotatallies`
-- 

CREATE TABLE `ftpquotatallies` (
  `name` varchar(30) NOT NULL default '',
  `quota_type` enum('user','group','class','all') NOT NULL default 'user',
  `bytes_in_used` int(10) unsigned NOT NULL default '0',
  `bytes_out_used` int(10) unsigned NOT NULL default '0',
  `bytes_xfer_used` int(10) unsigned NOT NULL default '0',
  `files_in_used` int(10) unsigned NOT NULL default '0',
  `files_out_used` int(10) unsigned NOT NULL default '0',
  `files_xfer_used` int(10) unsigned NOT NULL default '0'
) ENGINE=MyISAM DEFAULT CHARSET=latin1;

-- 
-- Dumping data for table `ftpquotatallies`
-- 


-- --------------------------------------------------------

-- 
-- Table structure for table `ftpuser`
-- 

CREATE TABLE `ftpuser` (
  `id` int(10) unsigned NOT NULL auto_increment,
  `userid` varchar(32) NOT NULL default '',
  `passwd` varchar(32) NOT NULL default '',
  `uid` smallint(6) NOT NULL default '5500',
  `gid` smallint(6) NOT NULL default '5500',
  `homedir` varchar(255) NOT NULL default '',
  `shell` varchar(16) NOT NULL default '/sbin/nologin',
  `count` int(11) NOT NULL default '0',
  `accessed` datetime NOT NULL default '0000-00-00 00:00:00',
  `modified` datetime NOT NULL default '0000-00-00 00:00:00',
  PRIMARY KEY  (`id`),
  UNIQUE KEY `userid` (`userid`)
) ENGINE=MyISAM AUTO_INCREMENT=2 DEFAULT CHARSET=latin1 COMMENT='ProFTP user table' AUTO_INCREMENT=2 ;

-- 
-- Dumping data for table `ftpuser`
-- 

INSERT INTO `ftpuser` (`id`, `userid`, `passwd`, `uid`, `gid`, `homedir`, `shell`, `count`, `accessed`, `modified`) VALUES (1, 'exampleuser', 'secret', 1005, 1004, '/home/www.example.com', '/sbin/nologin', 0, '0000-00-00 00:00:00', '0000-00-00 00:00:00');

Also Just wondering while i'm here what I would need to do to change it so that passwords are MD5 encrypted? I assume you just store the passwords in that way then change SQLAuthTypes.

And finally to show you what exactly it does when I try to connect...

Code:

root@trinity:~/src/mod_mysql_userdir-1.2# ftp localhost
Connected to localhost.
421 Service not available, remote server has closed connection
ftp>

Thanks in Advance.

falko · #3 5th August 2007, 13:18

Quote:

Aug 04 20:51:57 trinity proftpd[4085] trinity: error setting IPV6_V6ONLY: Protocol not available

Try to add

Code:

UseIPv6                         off

to your proftpd.conf and restart ProFTPd.

geekman · #4 5th August 2007, 13:35

Ok I tried seeing if the mysql module actually loads and it looks as though it doesnt...

Code:

root@trinity:/home# proftpd --list
Compiled-in modules:
  mod_core.c
  mod_xfer.c
  mod_auth_unix.c
  mod_auth_file.c
  mod_auth.c
  mod_ls.c
  mod_log.c
  mod_site.c
  mod_delay.c
  mod_dso.c
  mod_auth_pam.c
  mod_readme.c
  mod_cap.c
  mod_ctrls.c

But the modules.conf file has it listed and the files are in the right directory...and I would hope proftpd would error about incorrect directives if mysql wasn't activated.

Code:

root@trinity:/usr/lib/proftpd# ls
mod_ctrls_admin.so  mod_ifsession.so  mod_quotatab_file.so  mod_quotatab.so      mod_radius.so  mod_rewrite.so    mod_sql_postgres.so  mod_tls.so
mod_facl.so         mod_ldap.so       mod_quotatab_ldap.so  mod_quotatab_sql.so  mod_ratio.so   mod_sql_mysql.so  mod_sql.so           mod_wrap.so
root@trinity:/usr/lib/proftpd# cat /etc/proftpd/modules.conf
#
# This file is used to manage DSO modules and features.
#

# This is the directory where DSO modules resides

ModulePath /usr/lib/proftpd

# Allow only user root to load and unload modules, but allow everyone
# to see which modules have been loaded

ModuleControlsACLs insmod,rmmod allow user root
ModuleControlsACLs lsmod allow user *

#LoadModule mod_ctrls_admin.c
LoadModule mod_tls.c
LoadModule mod_sql.c
LoadModule mod_ldap.c
LoadModule mod_sql_mysql.c
LoadModule mod_sql_postgres.c
LoadModule mod_quotatab.c
LoadModule mod_quotatab_file.c
LoadModule mod_quotatab_ldap.c
LoadModule mod_quotatab_sql.c
LoadModule mod_radius.c
LoadModule mod_wrap.c
LoadModule mod_rewrite.c

# keep this module the last one
LoadModule mod_ifsession.c

As for your suggestion, I will try this now, but I have gotten this error for a long time now and it never seemed to do any harm...I hope that I can support IPv6 when I need to in the future anyways...

Thanks.

geekman · #5 5th August 2007, 13:37

UseIPv6 seems to be an unknown directive...i'll see if there if one for my OS, though I was pretty sure that was it for Ubuntu as well :/

geekman · #6 6th August 2007, 09:51

Ok well the general consensus seems to be that the IPv6 warning will do nothing to affect your installation, but If you do want to get rid of it then the only way to do that in ubuntu is add the IPv6 address to /etc/hots.

Personally I have no idea why this isn't working...it isn't really accepting connections at all....but the logging for proftpd at it's default really doesn't seem helpful, i'm going to try stepping it up.

Thanks.

jasenward · #7 8th August 2007, 14:06

I realize that this thread is for ProFTP and I don't mean to start anything by adding to it, but as a complete newbie to Fedora 7 I ran into a similar error message and searched the internet high and low for a solution and didn't find the one I needed (probably because it should be obvious), but since I spent numerous looking for why I was getting error 421 when I logged in I hope that this warning will help others avoid a DOH moment...

When you turn on the feature of Pure-FTP to bind users to the home directory of the mapped FTPDUSER, it will not auto-create a folder outside of the "home" directory nor will it autocreate anything until you actually include the user name in the path of every* virtual user's directory

(Oy).

So, if you are new, a bit slow on the uptake or just plain in too big of a hurry to pay attention and you are getting an error 421 stating that the service has stopped and the login failed, check your home directory paths that user name MUST be in there somewhere.

Navigation

Facebook

News

Recent comments

Newsletter