Virtual Hosting With PureFTPd And MySQL (Incl. Quota And Bandwidth Management) On Debian Lenny - Page 2
5 Configure PureFTPd
Edit /etc/pure-ftpd/db/mysql.conf. It should look like this:
cp /etc/pure-ftpd/db/mysql.conf /etc/pure-ftpd/db/mysql.conf_orig
cat /dev/null > /etc/pure-ftpd/db/mysql.conf
MYSQLSocket /var/run/mysqld/mysqld.sock #MYSQLServer localhost #MYSQLPort 3306 MYSQLUser pureftpd MYSQLPassword ftpdpass MYSQLDatabase pureftpd #MYSQLCrypt md5, cleartext, crypt() or password() - md5 is VERY RECOMMENDABLE uppon cleartext MYSQLCrypt md5 MYSQLGetPW SELECT Password FROM ftpd WHERE User="\L" AND status="1" AND (ipaccess = "*" OR ipaccess LIKE "\R") MYSQLGetUID SELECT Uid FROM ftpd WHERE User="\L" AND status="1" AND (ipaccess = "*" OR ipaccess LIKE "\R") MYSQLGetGID SELECT Gid FROM ftpd WHERE User="\L"AND status="1" AND (ipaccess = "*" OR ipaccess LIKE "\R") MYSQLGetDir SELECT Dir FROM ftpd WHERE User="\L"AND status="1" AND (ipaccess = "*" OR ipaccess LIKE "\R") MySQLGetBandwidthUL SELECT ULBandwidth FROM ftpd WHERE User="\L"AND status="1" AND (ipaccess = "*" OR ipaccess LIKE "\R") MySQLGetBandwidthDL SELECT DLBandwidth FROM ftpd WHERE User="\L"AND status="1" AND (ipaccess = "*" OR ipaccess LIKE "\R") MySQLGetQTASZ SELECT QuotaSize FROM ftpd WHERE User="\L"AND status="1" AND (ipaccess = "*" OR ipaccess LIKE "\R") MySQLGetQTAFS SELECT QuotaFiles FROM ftpd WHERE User="\L"AND status="1" AND (ipaccess = "*" OR ipaccess LIKE "\R")
Make sure that you replace the string ftpdpass with the real password for the MySQL user pureftpd in the line MYSQLPassword! Please note that we use md5 as MYSQLCrypt method, which means we will store the users' passwords as an MD5 string in the database which is far more secure than using plain text passwords!
Then create the file /etc/pure-ftpd/conf/ChrootEveryone which simply contains the string yes:
echo "yes" > /etc/pure-ftpd/conf/ChrootEveryone
This will make PureFTPd chroot every virtual user in his home directory so he will not be able to browse directories and files outside his home directory.
Also create the file /etc/pure-ftpd/conf/CreateHomeDir which again simply contains the string yes:
echo "yes" > /etc/pure-ftpd/conf/CreateHomeDir
This will make PureFTPd create a user's home directory when the user logs in and the home directory does not exist yet.
Now we must configure PureFTPd as a standalone daemon (it is currently controlled by inetd). To do this, we open /etc/default/pure-ftpd-common and change the value of the parameter STANDALONE_OR_INETD to standalone:
# Configuration for pure-ftpd # (this file is sourced by /bin/sh, edit accordingly) # STANDALONE_OR_INETD # valid values are "standalone" and "inetd". # Any change here overrides the setting in debconf. STANDALONE_OR_INETD=standalone # VIRTUALCHROOT: # whether to use binary with virtualchroot support # valid values are "true" or "false" # Any change here overrides the setting in debconf. VIRTUALCHROOT=false # UPLOADSCRIPT: if this is set and the daemon is run in standalone mode, # pure-uploadscript will also be run to spawn the program given below # for handling uploads. see /usr/share/doc/pure-ftpd/README.gz or # pure-uploadscript(8) # example: UPLOADSCRIPT=/usr/local/sbin/uploadhandler.pl UPLOADSCRIPT= # if set, pure-uploadscript will spawn $UPLOADSCRIPT running as the # given uid and gid UPLOADUID= UPLOADGID=
Next, we modify /etc/inetd.conf and comment out the ftp line:
[...] #:STANDARD: These are standard services. #ftp stream tcp nowait root /usr/sbin/tcpd /usr/sbin/pure-ftpd-wrapper [...]
Afterwards, we restart Inetd and PureFTPd:
6 Populate The Database And Test
To populate the database you can use the MySQL shell:
mysql -u root -p
Now we create the user exampleuser with the status 1 (which means his ftp account is active), the password secret (which will be stored encrypted using MySQL's MD5 function), the UID and GID 2001 (use the userid and groupid of the user/group you created at the end of step two!), the home directory /home/www.example.com, an upload and download bandwidth of 100 KB/sec. (kilobytes per second), and a quota of 50 MB:
INSERT INTO `ftpd` (`User`, `status`, `Password`, `Uid`, `Gid`, `Dir`, `ULBandwidth`, `DLBandwidth`, `comment`, `ipaccess`, `QuotaSize`, `QuotaFiles`) VALUES ('exampleuser', '1', MD5('secret'), '2001', '2001', '/home/www.example.com', '100', '100', '', '*', '50', '0');
Now open your FTP client program on your work station (something like WS_FTP or SmartFTP if you are on a Windows system or gFTP on a Linux desktop) and try to connect. As hostname you use server1.example.com (or the IP address of the system), the username is exampleuser, and the password is secret.
If you are able to connect - congratulations! If not, something went wrong.
Now, if you run
ls -l /home
you should see that the directory /home/www.example.com (exampleuser's home directory) has been automatically created, and it is owned by ftpuser and ftpgroup (the user/group we created at the end of step three):
server1:~# ls -l /home
drwxr-xr-x 2 administrator administrator 4096 2009-02-16 13:18 administrator
drwxr-xr-x 2 ftpuser ftpgroup 4096 2009-06-05 16:09 www.example.com
7 Database Administration
For most people it is easier if they have a graphical front-end to MySQL; therefore you can also use phpMyAdmin (in this example under http://server1.example.com/phpmyadmin/) to administrate the pureftpd database.
Whenever you want to create a new user, you have to create an entry in the table ftpd so I will explain the columns of this table here:
- User: The name of the virtual PureFTPd user (e.g. exampleuser).
- status: 0 or 1. 0 means the account is disabled, the user cannot login.
- Password: The password of the virtual user. Make sure you use MySQL's MD5 function to save the password encrypted as an MD5 string:
- UID: The userid of the ftp user you created at the end of step two (e.g. 2001).
- GID: The groupid of the ftp group you created at the end of step two (e.g. 2001).
- Dir: The home directory of the virtual PureFTPd user (e.g. /home/www.example.com). If it does not exist, it will be created when the new user logs in the first time via FTP. The virtual user will be jailed into this home directory, i.e., he cannot access other directories outside his home directory.
- ULBandwidth: Upload bandwidth of the virtual user in KB/sec. (kilobytes per second). 0 means unlimited.
- DLBandwidth: Download bandwidth of the virtual user in KB/sec. (kilobytes per second). 0 means unlimited.
- comment: You can enter any comment here (e.g. for your internal administration) here. Normally you leave this field empty.
- ipaccess: Enter IP addresses here that are allowed to connect to this FTP account. * means any IP address is allowed to connect.
- QuotaSize: Storage space in MB (not KB, as in ULBandwidth and DLBandwidth!) the virtual user is allowed to use on the FTP server. 0 means unlimited.
- QuotaFiles: amount of files the virtual user is allowed to save on the FTP server. 0 means unlimited.
8 Anonymous FTP
If you want to create an anonymous ftp account (an ftp account that everybody can login to without a password), you can do it like this:
First create a user ftp (with the homedir /home/ftp) and group ftp:
useradd -s /bin/false -d /home/ftp -m -c "anonymous ftp" -g ftp ftp
Then create the file /etc/pure-ftpd/conf/NoAnonymous which contains the string no:
echo "no" > /etc/pure-ftpd/conf/NoAnonymous
With this configuration, PureFTPd will allow anonymous logins.
Then we create the directory /home/ftp/incoming which will allow anonymous users to upload files. We will give the /home/ftp/incoming directory permissions of 311 so that users can upload, but not see or download any files in that directory. The /home/ftp directory will have permissions of 555 which allows seeing and downloading of files:
chown ftp:nogroup incoming/
chmod 311 incoming/
chmod 555 ftp/
Now anonymous users can login, and they can download files from /home/ftp, but uploads are limited to /home/ftp/incoming (and once a file is uploaded into /home/ftp/incoming, it cannot be read nor downloaded from there; the server admin has to move it into /home/ftp first to make it available to others).