Proftpd problem, total dir acces on server.

Discussion in 'Server Operation' started by Mathias, Dec 9, 2007.

  1. Mathias

    Mathias ISPConfig Developer ISPConfig Developer

    Hi.

    I've installed Proftpd with ISP_Config and all what is needed to this ...

    But ...

    When I connect to my FTP account, I can access the whole server with this.
    And that is a big problem.

    My /etc/proftpd/proftpd.conf looks like this:
    Code:
    # /etc/proftpd.conf -- This is a basic ProFTPD configuration file.
    # To really apply changes reload proftpd after modifications.
    #
    
    ServerName                      "Debian"
    ServerType                      standalone
    DeferWelcome                    off
    
    MultilineRFC2228                on
    DefaultServer                   on
    ShowSymlinks                    on
    
    TimeoutNoTransfer               600
    TimeoutStalled                  600
    TimeoutIdle                     1200
    
    DisplayLogin                    welcome.msg
    DisplayFirstChdir               .message
    ListOptions                     "-l"
    
    DenyFilter                      \*.*/
    
    # Uncomment this if you are using NIS or LDAP to retrieve passwords:
    #PersistentPasswd               off
    
    # Uncomment this if you would use TLS module:
    #TLSEngine                      on
    
    # Uncomment this if you would use quota module:
    #Quotas                         on
    
    # Uncomment this if you would use ratio module:
    #Ratios                         on
    
    # Port 21 is the standard FTP port.
    Port                            21
    
    # To prevent DoS attacks, set the maximum number of child processes
    # to 30.  If you need to allow more than 30 concurrent connections
    # at once, simply increase this value.  Note that this ONLY works
    # in standalone mode, in inetd mode you should use an inetd server
    # that allows you to limible to login with "anonymous" as well as "ftp"
    #   UserAlias                   anonymous ftp
    #   # Cosmetic changes, all files belongs to ftp user
    #   DirFakeUser on ftp
    #   DirFakeGroup on ftp
    #
    #   RequireValidShell           off
    #
    #   # Limit the maximum number of anonymous logins
    #   MaxClients                  10
    #
    #   # We want 'welcome.msg' displayed at login, and '.message' displayed
    #   # in each newly chdired directory.
    #   DisplayLogin                        welcome.msg
    #   DisplayFirstChdir           .message
    #
    #   # Limit WRITE everywhere in the anonymous chroot
    #   <Directory *>
    #     <Limit WRITE>
    #       DenyAll
    #     </Limit>
    #   </Directory>
    #
    #   # Uncomment this if you're brave.
    #   # <Directory incoming>
    #   #   # Umask 022 is a good standard umask to prevent new files and dirs
    #   #   # (second parm) from being group and world writable.
    #   #   Umask                           022  022
    #   #            <Limit READ WRITE>
    #   #            DenyAll
    #   #            </Limit>
    #   #            <Limit STOR>
    #   #            AllowAll
    #   #            </Limit>
    #   # </Directory>
    #
    DefaultRoot ~
    IdentLookups off
    ServerIdent on "FTP Server ready."
    # </Anonymous>
    
    
    Include /etc/proftpd_ispconfig.conf
    
     
  2. falko

    falko Super Moderator ISPConfig Developer

    Did you modify that file? It looks a little bit strange (for example, the opening <Anonymous> is missing (although that section is commented out).
     
  3. Mathias

    Mathias ISPConfig Developer ISPConfig Developer

    Yes I modify'ed that part away.
    And insert the:
    Code:
    DefaultRoot ~
    IdentLookups off
    ServerIdent on "FTP Server ready."
    
    But that should not solve the problem by inserting the commented text again, should it ?
     
  4. falko

    falko Super Moderator ISPConfig Developer

    And you're sure that you didn't accidentally delete anything in that file?
     
  5. Mathias

    Mathias ISPConfig Developer ISPConfig Developer

    You can see my proftpd.conf file in my first post ...
     
  6. falko

    falko Super Moderator ISPConfig Developer

    Please try this one instead:

    Code:
    # This is a basic ProFTPD configuration file (rename it to
    # 'proftpd.conf' for actual use.  It establishes a single server
    # and a single anonymous login.  It assumes that you have a user/group
    # "nobody" and "ftp" for normal operation and anon.
    
    ServerName                      "Debian"
    ServerType                      standalone
    DeferWelcome                    off
    
    ShowSymlinks                    on
    MultilineRFC2228                on
    DefaultServer                   on
    ShowSymlinks                    on
    AllowOverwrite                  on
    
    TimeoutNoTransfer               600
    TimeoutStalled                  600
    TimeoutIdle                     1200
    
    DisplayLogin                    welcome.msg
    DisplayFirstChdir               .message
    LsDefaultOptions                "-l"
    
    DenyFilter                      \*.*/
    
    # Uncomment this if you are using NIS or LDAP to retrieve passwords:
    #PersistentPasswd               off
    
    # Port 21 is the standard FTP port.
    Port                            21
    
    # To prevent DoS attacks, set the maximum number of child processes
    # to 30.  If you need to allow more than 30 concurrent connections
    # at once, simply increase this value.  Note that this ONLY works
    # in standalone mode, in inetd mode you should use an inetd server
    # that allows you to limit maximum number of processes per service
    # (such as xinetd)
    MaxInstances                    30
    
    # Set the user and group that the server normally runs at.
    User                            nobody
    Group                           nogroup
    
    DefaultRoot ~
    IdentLookups off
    ServerIdent on "FTP Server ready."
    
    # Normally, we want files to be overwriteable.
    <Directory /*>
      # Umask 022 is a good standard umask to prevent new files and dirs
      # (second parm) from being group and world writable.
      Umask                         022  022
    
      AllowOverwrite                on
    </Directory>
    
    # A basic anonymous configuration, no upload directories.
    
    ## <Anonymous ~ftp>
    ##   User                               ftp
    ##   Group                              nogroup
    ##   # We want clients to be able to login with "anonymous" as well as "ftp"
    ##   UserAlias                  anonymous ftp
    ##
    ##   RequireValidShell          off
    ##
    ##   # Limit the maximum number of anonymous logins
    ##   MaxClients                 10
    ##
    ##   # We want 'welcome.msg' displayed at login, and '.message' displayed
    ##   # in each newly chdired directory.
    ##   DisplayLogin                       welcome.msg
    ##   DisplayFirstChdir          .message
    ##
    ##   # Limit WRITE everywhere in the anonymous chroot
    ##   <Directory *>
    ##     <Limit WRITE>
    ##       DenyAll
    ##     </Limit>
    ##   </Directory>
    ##
    ##   # Uncomment this if you're brave.
    ##   # <Directory incoming>
    ##   #   # Umask 022 is a good standard umask to prevent new files and dirs
    ##   #   # (second parm) from being group and world writable.
    ##   #   Umask                          022  022
    ##   #            <Limit READ WRITE>
    ##   #            DenyAll
    ##   #            </Limit>
    ##   #            <Limit STOR>
    ##   #            AllowAll
    ##   #            </Limit>
    ##   # </Directory>
    ##
    ## </Anonymous>
    
    
    Include /etc/proftpd_ispconfig.conf
     
  7. Mathias

    Mathias ISPConfig Developer ISPConfig Developer

    Code:
    ripper23:/etc/proftpd# /etc/init.d/proftpd start
    Starting ftp server: proftpd - Fatal: unknown configuration directive 'LsDefaultOptions' on line 22 of '/etc/proftpd/proftpd.conf'
     failed!
    
    Why does it write this ?
     
  8. falko

    falko Super Moderator ISPConfig Developer

    Replace that line with
    Code:
    ListOptions                     "-l"
    My configuration was taken from an old Debian system that I had at hand when I answered your post; it's possible that some of the options are outdated.
     
  9. Mathias

    Mathias ISPConfig Developer ISPConfig Developer

    All users can still access the whole server ...

    We are back to my first configuration then.

    //Mathias

    But why can they access the whole server?
     
  10. falko

    falko Super Moderator ISPConfig Developer

    Are your users using FTP or maybe SCP?
     
  11. Mathias

    Mathias ISPConfig Developer ISPConfig Developer

    They are using FTP.

    //Mathias
     
  12. Appie Thrasher

    Appie Thrasher Member HowtoForge Supporter

    was this problem solved?
    If yes how? I have the same problem. I am using the server for over 2 years now for my own purpose so that wasn't a security risk.

    Now I want to allow others to make use of my server and with the test I now preformed I see an user can access the whole server via its FTP.
     

Share This Page