Virtual Hosting With PureFTPd And MySQL (Incl. Quota And Bandwidth Management) On Debian Etch

Version 1.0
Author: Falko Timme
Last edited 04/23/2007

This document describes how to install a PureFTPd server that uses virtual users from a MySQL database instead of real system users. This is much more performant and allows to have thousands of ftp users on a single machine. In addition to that I will show the use of quota and upload/download bandwidth limits with this setup. Passwords will be stored encrypted as MD5 strings in the database.

For the administration of the MySQL database you can use web based tools like phpMyAdmin which will also be installed in this howto. phpMyAdmin is a comfortable graphical interface which means you do not have to mess around with the command line.

This tutorial is based on Debian Etch (Debian 4.0). You should already have set up a basic Debian Etch system, as described in the first six chapters of this tutorial:

This howto is meant as a practical guide; it does not cover the theoretical backgrounds. They are treated in a lot of other documents in the web.

This document comes without warranty of any kind! I want to say that this is not the only way of setting up such a system. There are many ways of achieving this goal but this is the way I take. I do not issue any guarantee that this will work for you!


1 Preliminary Note

In this tutorial I use the hostname with the IP address These settings might differ for you, so you have to replace them where appropriate.


2 Install MySQL And phpMyAdmin

This can all be installed with one single command:

apt-get install mysql-server mysql-client libmysqlclient15-dev phpmyadmin apache2

Create a password for the MySQL user root (replace yourrootsqlpassword with the password you want to use):

mysqladmin -u root password yourrootsqlpassword

Then check with

netstat -tap | grep mysql

on which addresses MySQL is listening. If the output looks like this:

tcp        0      0 localhost.localdo:mysql *:*                     LISTEN     2713/mysqld

which means MySQL is listening on localhost.localdomain only, then you're safe with the password you set before. But if the output looks like this:

tcp        0      0 *:mysql *:*                     LISTEN     2713/mysqld

you should set a MySQL password for your hostname, too, because otherwise anybody can access your database and modify data:

mysqladmin -h -u root password yourrootsqlpassword


3 Install PureFTPd With MySQL Support

For Debian there is a pre-configured pure-ftpd-mysql package available. Install it like this:

apt-get install pure-ftpd-mysql

Then we create an ftp group (ftpgroup) and user (ftpuser) that all our virtual users will be mapped to. Replace the group- and userid 2001 with a number that is free on your system:

groupadd -g 2001 ftpgroup
useradd -u 2001 -s /bin/false -d /bin/null -c "pureftpd user" -g ftpgroup ftpuser


4 Create The MySQL Database For PureFTPd

Now we create a database called pureftpd and a MySQL user named pureftpd which the PureFTPd daemon will use later on to connect to the pureftpd database:

mysql -u root -p

GRANT SELECT, INSERT, UPDATE, DELETE, CREATE, DROP ON pureftpd.* TO 'pureftpd'@'localhost' IDENTIFIED BY 'ftpdpass';
GRANT SELECT, INSERT, UPDATE, DELETE, CREATE, DROP ON pureftpd.* TO 'pureftpd'@'localhost.localdomain' IDENTIFIED BY 'ftpdpass';

Replace the string ftpdpass with whatever password you want to use for the MySQL user pureftpd. Still on the MySQL shell, we create the database table we need (yes, there is only one table!):

USE pureftpd;

User varchar(16) NOT NULL default '',
status enum('0','1') NOT NULL default '0',
Password varchar(64) NOT NULL default '',
Uid varchar(11) NOT NULL default '-1',
Gid varchar(11) NOT NULL default '-1',
Dir varchar(128) NOT NULL default '',
ULBandwidth smallint(5) NOT NULL default '0',
DLBandwidth smallint(5) NOT NULL default '0',
comment tinytext NOT NULL,
ipaccess varchar(15) NOT NULL default '*',
QuotaSize smallint(5) NOT NULL default '0',
QuotaFiles int(11) NOT NULL default 0,
UNIQUE KEY User (User)


As you may have noticed, with the quit; command we have left the MySQL shell and are back on the Linux shell.

BTW, (I'm assuming that the hostname of your ftp server system is you can access phpMyAdmin under (you can also use the IP address instead of in a browser and log in as the user pureftpd. Then you can have a look at the database. Later on you can use phpMyAdmin to administrate your PureFTPd server.

Share this page:

2 Comment(s)

Add comment


From: at: 2007-05-09 07:49:46

Of course, both pureftp and ProFTP support using LDAP as the backend (which may provide a better backend store, depending on what other features you are providing to your users).

From: at: 2009-06-22 20:58:02

There´s no need to recompile, TLS is supported in the apt-get package for Debian.


1) To support SSL/TLS, the OpenSSL library must already be installed on your system. This is a common requirement so your operating system probably already ships with it, but you never now

apt-get install openssl

2) Now you need an SSL Certificate, you can buy one from a certified authority or you can create your own certificate. To create a self-signed certificate, you can use the following commands :

mkdir -p /etc/ssl/private

openssl req -x509 -nodes -newkey rsa:1024 -keyout \
  /etc/ssl/private/pure-ftpd.pem \
  -out /etc/ssl/private/pure-ftpd.pem

chmod 600 /etc/ssl/private/*.pem

3) Now we add TLS support in the configuration files

echo 1 > /etc/pure-ftpd/conf/TLS

4) Finally we restart the daemon, the output should look like this:

/etc/init.d/pure-ftpd-mysql restart
Restarting ftp server: Running: /usr/sbin/pure-ftpd-mysql -l mysql:/etc/pure-ftpd/db/mysql.conf -l pam -j -Y 1 -A -E -O clf:/var/log/pure-ftpd/transfer.log -u 1000 -B

(the -Y option enables the TLS Support)

5) If everything worked fine , now we have a TLS capable pure-ftpd server. When some client connects to the server trough TLS you should see something like this in the log files:

Jun 22 17:35:48 console pure-ftpd: (?@ [INFO] SSL/TLS: Enabled TLSv1/SSLv3 with AES256-SHA, 256 secret bits cipher


Hope this helps!

BTW: the guide was great, everything worked fine from scratch! :-)