Virtual Hosting With Proftpd And MySQL (Incl. Quota) On Debian Etch

Version 1.0
Author: Falko Timme
Last edited 04/23/2007

This document describes how to install a Proftpd server that uses virtual users from a MySQL database instead of real system users. This is much more performant and allows to have thousands of ftp users on a single machine. In addition to that I will show the use of quota with this setup.

For the administration of the MySQL database you can use web based tools like phpMyAdmin which will also be installed in this howto. phpMyAdmin is a comfortable graphical interface which means you do not have to mess around with the command line.

This tutorial is based on Debian Etch (Debian 4.0). You should already have set up a basic Debian Etch system, as described in the first six chapters of this tutorial:

This howto is meant as a practical guide; it does not cover the theoretical backgrounds. They are treated in a lot of other documents in the web.

This document comes without warranty of any kind! I want to say that this is not the only way of setting up such a system. There are many ways of achieving this goal but this is the way I take. I do not issue any guarantee that this will work for you!


1 Preliminary Note

In this tutorial I use the hostname with the IP address These settings might differ for you, so you have to replace them where appropriate.


2 Install MySQL And phpMyAdmin

This can all be installed with one single command:

apt-get install mysql-server mysql-client libmysqlclient15-dev phpmyadmin apache2

Create a password for the MySQL user root (replace yourrootsqlpassword with the password you want to use):

mysqladmin -u root password yourrootsqlpassword

Then check with

netstat -tap | grep mysql

on which addresses MySQL is listening. If the output looks like this:

tcp        0      0 localhost.localdo:mysql *:*                     LISTEN     2713/mysqld

which means MySQL is listening on localhost.localdomain only, then you're safe with the password you set before. But if the output looks like this:

tcp        0      0 *:mysql *:*                     LISTEN     2713/mysqld

you should set a MySQL password for your hostname, too, because otherwise anybody can access your database and modify data:

mysqladmin -h -u root password yourrootsqlpassword


3 Install Proftpd With MySQL Support

For Debian there is a pre-configured proftpd-mysql package available. Install it as a standalone daemon like this:

apt-get install proftpd-mysql

You will be asked the following question:

Run proftpd from inetd or standalone? <-- standalone

Then we create an ftp group (ftpgroup) and user (ftpuser) that all our virtual users will be mapped to. Replace the group- and userid 2001 with a number that is free on your system:

groupadd -g 2001 ftpgroup
useradd -u 2001 -s /bin/false -d /bin/null -c "proftpd user" -g ftpgroup ftpuser


4 Create The MySQL Database For Proftpd

Now we create a database called ftp and a MySQL user named proftpd which the proftpd daemon will use later on to connect to the ftp database:

mysql -u root -p

create database ftp;
GRANT SELECT, INSERT, UPDATE, DELETE ON ftp.* TO 'proftpd'@'localhost' IDENTIFIED BY 'password';
GRANT SELECT, INSERT, UPDATE, DELETE ON ftp.* TO 'proftpd'@'localhost.localdomain' IDENTIFIED BY 'password';

Replace the string password with whatever password you want to use for the MySQL user proftpd. Still on the MySQL shell, we create the database tables we need:

USE ftp;

CREATE TABLE ftpgroup (
groupname varchar(16) NOT NULL default '',
gid smallint(6) NOT NULL default '5500',
members varchar(16) NOT NULL default '',
KEY groupname (groupname)
) TYPE=MyISAM COMMENT='ProFTP group table';

CREATE TABLE ftpquotalimits (
name varchar(30) default NULL,
quota_type enum('user','group','class','all') NOT NULL default 'user',
per_session enum('false','true') NOT NULL default 'false',
limit_type enum('soft','hard') NOT NULL default 'soft',
bytes_in_avail int(10) unsigned NOT NULL default '0',
bytes_out_avail int(10) unsigned NOT NULL default '0',
bytes_xfer_avail int(10) unsigned NOT NULL default '0',
files_in_avail int(10) unsigned NOT NULL default '0',
files_out_avail int(10) unsigned NOT NULL default '0',
files_xfer_avail int(10) unsigned NOT NULL default '0'

CREATE TABLE ftpquotatallies (
name varchar(30) NOT NULL default '',
quota_type enum('user','group','class','all') NOT NULL default 'user',
bytes_in_used int(10) unsigned NOT NULL default '0',
bytes_out_used int(10) unsigned NOT NULL default '0',
bytes_xfer_used int(10) unsigned NOT NULL default '0',
files_in_used int(10) unsigned NOT NULL default '0',
files_out_used int(10) unsigned NOT NULL default '0',
files_xfer_used int(10) unsigned NOT NULL default '0'

CREATE TABLE ftpuser (
id int(10) unsigned NOT NULL auto_increment,
userid varchar(32) NOT NULL default '',
passwd varchar(32) NOT NULL default '',
uid smallint(6) NOT NULL default '5500',
gid smallint(6) NOT NULL default '5500',
homedir varchar(255) NOT NULL default '',
shell varchar(16) NOT NULL default '/sbin/nologin',
count int(11) NOT NULL default '0',
accessed datetime NOT NULL default '0000-00-00 00:00:00',
modified datetime NOT NULL default '0000-00-00 00:00:00',
UNIQUE KEY userid (userid)
) TYPE=MyISAM COMMENT='ProFTP user table';


As you may have noticed, with the quit; command we have left the MySQL shell and are back on the Linux shell.

BTW, (I'm assuming that the hostname of your ftp server system is you can access phpMyAdmin under (you can use the IP address instead of in a browser and log in as proftpd. Then you can have a look at the database. Later on you can use phpMyAdmin to manage your Proftpd server.

Share this page:

4 Comment(s)

Add comment


From: at: 2007-04-27 11:22:42

Dear falko!

Please make virtual_postfix_mysql_quota_courier how to for etch. The last mail how to was great.


From: at: 2008-01-27 17:56:03

Debian comes with some standard users which dont't have a password (displayed as an asterix in /etc/shadow) like the user backup.

[CODE]# cat /etc/shadow /etc/passwd | grep backup

When de parameter SQLAuthTypes includes "Plaintext" the password (*) will be considered a real password and the user can login on your system without any problem using backup / * as username / password combination.

I had to discover this the wrong way by adding the user FTP and find unwanted files on my system within a few weeks time.

The solution:

- Change "SQLAuthTypes Plaintext Crypt" to "SQLAuthTypes Crypt" in the proftpd.conf
- Encrypt the passwords in de MySQL table where the users are stored
- /etc/init.d/proftpd restart 

From: at: 2008-12-09 09:04:18

You might want to add the following lines to your config, to prevent logging in of system accounts.( which happened to me)


SQLMinUserGID 100
SQLMinUserUID 500


gr. Jottie

From: Spiffy at: 2009-02-08 19:18:11

One thing. If you are getting this error:

 421 Service not available, remote server has closed connection

Make sure that you comment out the following in /etc/proftpd/modules.conf:

#LoadModule mod_sql_postgres.c

It took me an hour to figure that one out!