File: FAQ-config.html

package info (click to toggle)
proftpd 1.2.0pre9-4
links: PTS
area: main
in suites: slink
size: 2,392 kB
ctags: 2,648
sloc: ansic: 24,012; sh: 1,754; makefile: 536; perl: 281
file content (749 lines) | stat: -rw-r--r-- 33,069 bytes
parent folder | download | duplicates (2)
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
<html>

<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<meta name="GENERATOR" content="Microsoft FrontPage 2.0">
<title>Configuring ProFTPD - FAQ</title>
</head>

<body bgcolor="#E7E4D8">

<table border="0" cellpadding="0" cellspacing="0" width="100%">
    <tr>
        <td width="33%" bgcolor="#0000FF"><!--webbot bot="ImageMap" circle=" (90,21) 21  reference.html" circle=" (30,21) 21  download.html" src="images/next-prev.gif" border="0" width="121" height="45" startspan --><MAP NAME="FrontPageMap"><AREA SHAPE="CIRCLE" COORDS="90, 21, 21" HREF="reference.html"><AREA SHAPE="CIRCLE" COORDS="30, 21, 21" HREF="download.html"></MAP><a href="_vti_bin/shtml.exe/configuration.html/map"><img ismap usemap="#FrontPageMap" border="0" height="45" src="images/next-prev.gif" width="121"></a><!--webbot bot="ImageMap" endspan i-checksum="52116" --></td>
        <td align="center" width="33%" bgcolor="#0000FF"><img src="images/proftpd-blue.gif" width="210" height="43"></td>
        <td align="right" width="34%" bgcolor="#0000FF"><img src="images/button-configuration.gif" width="215" height="41"></td>
    </tr>
    <tr>
        <td align="center" colspan="3" width="33%" bgcolor="#000000"><font color="#00FFFF" size="3" face="Arial"><em><strong>- Professional FTP Daemon -</strong></em></font></td>
    </tr>
</table>

<p><br>
</p>

<table border="0" cellpadding="2" cellspacing="0" width="100%">
    <tr>
        <td align="center" colspan="2" bgcolor="#000000"><font color="#00FFFF" size="3" face="Arial"><em><strong>Configuration
        - Frequently Asked Questions</strong></em></font></td>
    </tr>
    <tr>
        <td><img src="images/q.gif" width="38" height="30"></td>
        <td width="100%"><strong>ProFTPD doesn't seem to work, I
        start it but it doesn't show up in a `</strong><code>ps</code><strong>'.
        What's wrong?</strong></td>
    </tr>
    <tr>
        <td valign="top"><img src="images/a.gif" width="36" height="30"></td>
        <td>It could be many things, possibly something like not
        running proftpd as root (it needs to be run as root
        initially, but will switch to a non-privileged user).
        Regardless, proftpd logs all errors via the standard
        syslog mechanism. You need to check your system logs in
        order to determine what the problem is.</td>
    </tr>
    <tr>
        <td>&nbsp;</td>
        <td>&nbsp;</td>
    </tr>
    <tr>
        <td valign="top"><img src="images/q.gif" width="38" height="30"></td>
        <td><strong>My syslog has errors in it such as
        &quot;inet_create_connection() failed: Operation not
        permitted&quot;.<br>
        I use the shadow password suite. Users cannot login to
        ProFTPD.</strong></td>
    </tr>
    <tr>
        <td valign="top"><img src="images/a.gif" width="36" height="30"></td>
        <td>You aren't starting proftpd as root, or you have
        inetd configured to run proftpd as a user other than
        root. The proftpd daemon must be started as root in order
        to bind to tcp ports lower than 1024, or to open your
        shadow password file when authenticating users. The
        daemon switches uid/gids to the user and group specified
        by the <a href="reference.html#User">User</a>/<a href="reference.html#Group">Group</a> directives during
        normal operation, so a `<code>ps</code>' will show it
        running as the user you specified.</td>
    </tr>
    <tr>
        <td>&nbsp;</td>
        <td>&nbsp;</td>
    </tr>
    <tr>
        <td valign="top"><img src="images/q.gif" width="38" height="30"></td>
        <td><strong>When I try to start proftpd from the command
        line, all I see is &quot;Fatal: Socket operation on
        non-socket&quot;, and proftpd does not start.</strong></td>
    </tr>
    <tr>
        <td valign="top"><img src="images/a.gif" width="36" height="30"></td>
        <td>You have proftpd configured to run in inetd mode
        instead of standalone. In this mode, proftpd expects that
        it will be run from the inetd super-server, which implies
        that stdin/stdout will be sockets instead of terminals.
        As a result, socket operations will fail and the above
        error will be printed. If you wish to run proftpd from
        the shell, in standalone mode, you'll need to modify your
        proftpd.conf configuration file and add or edit the <a href="reference.html#ServerType">ServerType</a> directive
        to read:<br>
        <br>
        <a href="reference.html#ServerType">ServerType standalone</a></td>
    </tr>
    <tr>
        <td>&nbsp;</td>
        <td>&nbsp;</td>
    </tr>
    <tr>
        <td valign="top"><img src="images/q.gif" width="38" height="30"></td>
        <td><strong>I'm having problems with FTP clients behind
        firewalls, they cannot seem to get directory listings or
        transfer files. I've checked and it seems that proftpd
        isn't using port 20 as the source port for it's data
        connections; can this be changed?</strong></td>
    </tr>
    <tr>
        <td valign="top"><img src="images/a.gif" width="36" height="30"></td>
        <td><strong>There is a known security problem with ALL
        unix FTP daemons</strong>, which requires the daemon to
        retain root privileges even after a client has fully
        authenticated. In proftpd versions 1.0.x, we chose to
        ignore RFC959's port 20 requirements in the interests of
        security. Unfortunately, over time, it became obvious
        that this was a bad idea. Until the RFC is
        &quot;fixed&quot;, this problem will continue to plague
        unix FTP servers.<br>
        <br>
        In proftpd versions 1.1.x and higher, we chose to go the
        &quot;standard&quot; route, retaining root at all times,
        allowing the daemon to bind to port 20 and be completely
        RFC959 compliant. The security issue remains, however the
        code is carefully structured to handle this in as secure
        a fashion as possible.<br>
        <br>
        You have two options for working around this problem:<br>
        <br>
        1. Upgrade to proftpd 1.1.x (development versions).<br>
        <br>
        2. Have your FTP clients use passive mode. Passive mode
        data connections originate from the client, and thus do
        not experience this &quot;port 20&quot; problem.</td>
    </tr>
    <tr>
        <td>&nbsp;</td>
        <td>&nbsp;</td>
    </tr>
    <tr>
        <td valign="top"><img src="images/q.gif" width="38" height="30"></td>
        <td><strong>I cannot get Anonymous FTP to work. I've
        tried all the sample configuration files, however no
        matter what I try, every time I attempt to login to
        proftpd as 'ftp' or 'anonymous' I get &quot;550 Login
        incorrect.&quot;.</strong></td>
    </tr>
    <tr>
        <td valign="top"><img src="images/a.gif" width="36" height="30"></td>
        <td>Check the following first:<br>
        <br>
        1. Make sure the user/group you specified inside the <a href="reference.html#Anonymous">&lt;Anonymous&gt;</a>
        block actually exists. This must be a real user and
        group, as it is used to control whom the daemon runs as
        and authenticates as.<br>
        <br>
        2. If <a href="reference.html#RequireValidShell">RequireValidShell</a>
        is not specifically turned off, make sure that your
        &quot;ftp user&quot; (as specified by the <a href="reference.html#User">User</a> directive inside an
        &lt;Anonymous&gt; block), has a valid shell listed in
        /etc/shells. If you do not wish to give the user a valid
        shell, you can always use &quot;RequireValidShell
        off&quot; to disable this check.<br>
        <br>
        3. If <a href="reference.html#UseFtpUsers">UseFtpUsers</a>
        is not specifically turned off, make sure that your
        &quot;ftp user&quot; is <strong>not</strong> listed in
        /etc/ftpusers.<br>
        <br>
        If all else fails, you should check your syslog. When
        authentication fails for any reason, proftpd uses the
        syslog mechanism to log the reason for failure; using the
        AUTH (or AUTHPRIV) facility. If you need further
        assistance, you can send email, including related syslog
        entries and your configuration file, to the proftpd
        mailing list at: <a href="mailto:proftpd-l@evcom.net">proftpd-l@evcom.net</a>.</td>
    </tr>
    <tr>
        <td>&nbsp;</td>
        <td>&nbsp;</td>
    </tr>
    <tr>
        <td valign="top"><img src="images/q.gif" width="38" height="30"></td>
        <td><strong>What should I add or remove from my
        /etc/inetd.conf in order to run proftpd from the inetd
        super-server?</strong></td>
    </tr>
    <tr>
        <td valign="top"><img src="images/a.gif" width="36" height="30"></td>
        <td>Find the line in /etc/inetd.conf that looks something
        like this:<br>
        <code>ftp stream tcp nowait root in.ftpd in.ftpd</code><br>
        <br>
        Replace it with:<br>
        <code>ftp stream tcp nowait root in.proftpd in.proftpd</code><br>
        <br>
        Then, find your inetd process in the process listing and
        send it the SIGHUP signal so that it will rehash and
        reconfigure itself. Example (<strong>do not type the
        following literally, as pid 189 will most likely NOT be
        your inetd process</strong>):<br>
        <code>kill -1 189</code></td>
    </tr>
    <tr>
        <td>&nbsp;</td>
        <td>&nbsp;</td>
    </tr>
    <tr>
        <td valign="top"><img src="images/q.gif" width="38" height="30"></td>
        <td><strong>Can I use tcp-wrappers with proftpd?</strong></td>
    </tr>
    <tr>
        <td valign="top"><img src="images/a.gif" width="36" height="30"></td>
        <td>Sure. Although ProFTPD has built-in IP access control
        (see the <a href="reference.html#Deny">Deny</a> and <a href="reference.html#Allow">Allow</a> directives), many
        admins choose to consolidate IP access control in one
        place via in.tcpd. Just configure proftpd to run from
        inetd as any other tcp-wrapper wrapped daemon does:<br>
        <code>ftp stream tcp nowait root in.tcpd in.proftpd</code></td>
    </tr>
    <tr>
        <td valign="top">&nbsp;</td>
        <td>&nbsp;</td>
    </tr>
    <tr>
        <td><img src="images/q.gif" width="38" height="30"></td>
        <td><strong>How do I add another anonymous login or guest
        account?</strong></td>
    </tr>
    <tr>
        <td valign="top"><img src="images/a.gif" width="36" height="30"></td>
        <td>You should look in the sample-configurations/
        directory from your distribution tarball. Basically,
        you'll need to create another user on your system for the
        guest/anonymous ftp login. For security reasons, it's
        very important that you make sure the user account either
        has a password or has an &quot;unmatchable&quot;
        password. The root directory of the guest/anonymous
        account doesn't have to be the user's directory, but it
        makes sense to do so. After you have created the account,
        put something like the following in your
        /etc/proftpd.conf file (assuming the new user/group name
        is private/private):<br>
        <br>
        &lt;<code>Anonymous ~private&gt;<br>
        AnonRequirePassword off<br>
        User private<br>
        Group private<br>
        RequireValidShell off<br>
        &lt;Directory *&gt;<br>
        &lt;Limit WRITE&gt;<br>
        DenyAll<br>
        &lt;/Limit&gt;<br>
        &lt;/Directory&gt;<br>
        &lt;/Anonymous&gt;</code><br>
        <br>
        This will allow ftp clients to login to your site with
        the username 'private' and their e-mail address as a
        password. You can change the <a href="reference.html#AnonRequirePassword">AnonRequirePassword</a>
        directive to &quot;on&quot; if you want clients to be
        forced to transmit the correct password for the 'private'
        account. This sample configuration allows clients to
        change into, list and read all directories, but denies
        write access of any kind.</td>
    </tr>
    <tr>
        <td>&nbsp;</td>
        <td>&nbsp;</td>
    </tr>
    <tr>
        <td valign="top"><img src="images/q.gif" width="38" height="30"></td>
        <td><strong>How do I allow uploads to a specific
        directory in a secure fashion? I don't want users
        downloading or creating sub-directories in it.</strong></td>
    </tr>
    <tr>
        <td valign="top"><img src="images/a.gif" width="36" height="30"></td>
        <td>The following snippet from a sample configuration
        file illustrates how to protect an &quot;upload&quot;
        directory in such a fashion (which is a very good idea if
        you don't want people using your site for
        &quot;warez&quot;):<br>
        <br>
        <code>&lt;Anonymous /home/ftp&gt;</code><blockquote>
            <p><code>User ftp<br>
            Group ftp<br>
            UserAlias anonymous ftp<br>
            <br>
            &lt;Directory *&gt;</code></p>
            <blockquote>
                <p><code>&lt;Limit WRITE&gt;<br>
                DenyAll<br>
                &lt;/Limit&gt;</code></p>
            </blockquote>
            <p><code>&lt;/Directory&gt;<br>
            <br>
            &lt;Directory incoming&gt;</code></p>
            <blockquote>
                <p><code>&lt;Limit STOR&gt;<br>
                AllowAll<br>
                &lt;/Limit&gt;<br>
                &lt;Limit READ&gt;<br>
                DenyAll<br>
                &lt;/Limit&gt;</code></p>
            </blockquote>
            <p><code>&lt;/Directory&gt;</code></p>
        </blockquote>
        <p><code>&lt;/Anonymous&gt;</code></p>
        <p>This denies all write operations to the anonymous root
        directory and sub-directories, except
        &quot;incoming/&quot; where the permissions are reversed
        and the client can store but not read. If you used
        &lt;Limit WRITE&gt; instead of &lt;Limit STOR&gt; on
        &lt;Directory incoming&gt;, ftp clients would be allowed
        to perform all write operations to the sub-dir, including
        deleting, renaming and creating directories.</p>
        </td>
    </tr>
    <tr>
        <td>&nbsp;</td>
        <td>&nbsp;</td>
    </tr>
    <tr>
        <td valign="top"><img src="images/q.gif" width="38" height="30"></td>
        <td><strong>How can I hide a directory from anonymous
        clients. I only want clients getting in to it if they
        know the exact name.</strong></td>
    </tr>
    <tr>
        <td valign="top"><img src="images/a.gif" width="36" height="30"></td>
        <td>Use the <a href="reference.html#HideUser">HideUser</a>
        or <a href="#HideGroup">HideGroup</a> directive in
        combination with the proper user/group ownership on the
        directive. For example, if you have the follow directory
        in your anonymous ftp directory tree:<br>
        <br>
        <code>drwxrwxr-x 3 ftp staff 6144 Apr 21 16:40 private<br>
        </code><br>
        You can use a directive such as &quot;HideGroup
        staff&quot; to hide the private directory from a
        directory listing. Example:<br>
        <br>
        <code>&lt;Anonymous ~ftp&gt;<br>
        ...<br>
        &lt;Directory Private&gt;<br>
        HideGroup staff<br>
        &lt;/Directory&gt;<br>
        ...<br>
        &lt;/Anonymous&gt;</code></td>
    </tr>
    <tr>
        <td>&nbsp;</td>
        <td>&nbsp;</td>
    </tr>
    <tr>
        <td valign="top"><img src="images/q.gif" width="38" height="30"></td>
        <td><strong>File/Directory hiding isn't working for me! I
        can still see the file or directory when performing an
        anonymous FTP?</strong></td>
    </tr>
    <tr>
        <td valign="top"><img src="images/a.gif" width="36" height="30"></td>
        <td>You need to make sure that the group you are hiding
        isn't the anonymous ftp user's primary group, or <a href="reference.html#HideGroup">HideGroup</a> won't
        apply.</td>
    </tr>
    <tr>
        <td>&nbsp;</td>
        <td>&nbsp;</td>
    </tr>
    <tr>
        <td valign="top"><img src="images/q.gif" width="38" height="30"></td>
        <td><strong>I have a hidden directory, but I want to
        prevent users from accessing it altogether. How can I do
        this?</strong></td>
    </tr>
    <tr>
        <td valign="top"><img src="images/a.gif" width="36" height="30"></td>
        <td>You can either change the permissions on the
        directory to prevent the anonymous FTP user from
        accessing it, or if you want to make it appear completely
        invisible (as though there is no such directory), use the
        <a href="reference.html#IgnoreHidden">IgnoreHidden</a>
        directive inside a &lt;Limit&gt; block for one or more
        commands that you want to completely ignore the hidden
        directory entries (ignore = act as if the directory entry
        does not exist).</td>
    </tr>
    <tr>
        <td>&nbsp;</td>
        <td>&nbsp;</td>
    </tr>
    <tr>
        <td valign="top"><img src="images/q.gif" width="38" height="30"></td>
        <td><strong>How do I setup a virtual FTP server?</strong></td>
    </tr>
    <tr>
        <td valign="top"><img src="images/a.gif" width="36" height="30"></td>
        <td>First off, have you read the documentation that came
        with the server? If not, do so now. If you still have
        questions, read on:<br>
        <br>
        You'll need to configure your host to be able to handle
        multiple IP addresses. This is often called
        &quot;aliasing&quot;, and can generally be configured
        through an IP alias or dummy interface. You need to read
        your operating system documentation to figure out how to
        do this. Once your have the host configured to accept the
        additional IP address that you wish to offer a virtual
        FTP server on, use the &lt;VirtualHost&gt; configuration
        directive to create the virtual server:<br>
        <br>
        <code>&lt;VirtualHost 10.0.0.1&gt;<br>
        ServerName &quot;My virtual FTP server&quot;<br>
        &lt;/VirtualHost&gt;</code><br>
        <br>
        You can add additional directive blocks into the
        &lt;VirtualHost&gt; block in order to create
        anonymous/guest logins and the like which are only
        available on the virtual host.</td>
    </tr>
    <tr>
        <td>&nbsp;</td>
        <td>&nbsp;</td>
    </tr>
    <tr>
        <td valign="top"><img src="images/q.gif" width="38" height="30"></td>
        <td><strong>I don't want to let my normal FTP users into
        my virtual FTP servers using their usernames/passwords. I
        only want anonymous FTP to work for a virtual server. How
        can I do this?</strong></td>
    </tr>
    <tr>
        <td valign="top"><img src="images/a.gif" width="36" height="30"></td>
        <td>Use a &lt;Limit LOGIN&gt; block to deny access at the
        top-level of the virtual host, then use &lt;Limit
        LOGIN&gt; again in your &lt;Anonymous&gt; block to allow
        access to the anonymous login. This permits logins to a
        virtual anonymous server, but denies to everything else.
        Example:<br>
        <br>
        <code>...<br>
        &lt;VirtualHost 10.0.0.1&gt;<br>
        ServerName &quot;My virtual FTP server&quot;<br>
        &lt;Limit LOGIN&gt;<br>
        DenyAll<br>
        &lt;/Limit&gt;<br>
        &lt;Anonymous /usr/local/private&gt;<br>
        User private<br>
        Group private<br>
        &lt;Limit LOGIN&gt;<br>
        AllowAll<br>
        &lt;/Limit&gt;<br>
        ...<br>
        &lt;/Anonymous&gt;<br>
        &lt;/VirtualHost&gt;</code></td>
    </tr>
    <tr>
        <td>&nbsp;</td>
        <td>&nbsp;</td>
    </tr>
    <tr>
        <td valign="top"><img src="images/q.gif" width="38" height="30"></td>
        <td><strong>Can I run an FTP server on another port
        besides the standard ftp port (21) without running a
        separate copy of ProFTPD?</strong></td>
    </tr>
    <tr>
        <td valign="top"><img src="images/a.gif" width="36" height="30"></td>
        <td>Yes. Use a <a href="reference.html#VirtualHost">&lt;VirtualHost&gt;</a>
        block with your machine's FQDN (Fully Qualified Domain
        Name) or IP address, and a <a href="reference.html#Port">Port</a>
        directive inside the &lt;VirtualHost&gt; block. For
        example, if your host is named
        &quot;myhost.mydomain.com&quot; and you want to run an
        additional FTP server on port 2001, you would:<br>
        <br>
        ...<br>
        <code>&lt;VirtualHost myhost.mydomain.com&gt;<br>
        Port 2001<br>
        ...<br>
        &lt;/VirtualHost&gt;</code></td>
    </tr>
    <tr>
        <td>&nbsp;</td>
        <td>&nbsp;</td>
    </tr>
    <tr>
        <td valign="top"><img src="images/q.gif" width="38" height="30"></td>
        <td><strong>How does &lt;Limit LOGIN&gt; work, and where
        should I use it?</strong></td>
    </tr>
    <tr>
        <td valign="top"><img src="images/a.gif" width="36" height="30"></td>
        <td>The &lt;Limit LOGIN&gt; directive is used to control
        connection or login access to a particular context (the
        directive block which contains it). When a client
        initially connects to proftpd, the daemon searches the
        configuration tree for &lt;Limit LOGIN&gt; directives,
        and attached parameters (such as Allow, Deny, etc). If it
        determines that there is no possible way for the client
        to ever be allowed to login, such as a &quot;Deny
        from&quot; matching the client's source address, without
        an overriding &quot;Allow from&quot; at a lower level,
        the client is disconnected without being offered the
        opportunity to transmit a user and password. However, if
        it is possible for the client to be allowed a login,
        proftpd continues as per normal, allowing the client to
        login only if the proper &lt;Limit LOGIN&gt; applies.
        Normally, &lt;Limit&gt; directive blocks are allowed in
        the server config, <a href="reference.html">&lt;VirtualHost&gt;</a>,
        <a href="reference.html#Anonymous">&lt;Anonymous&gt;</a>
        and <a href="reference.html#Directory">&lt;Directory&gt;</a>
        contexts. However, &lt;Limit LOGIN&gt; should not be used
        in a &lt;Directory&gt; context, as clients do not
        connect/login to a directory (and thus it is
        meaningless).<br>
        <br>
        By way of example, the following configuration snippit
        illustrates a &lt;Limit LOGIN&gt; deny which will cause
        any incoming connections from the 10.1.1.x subnet to be
        immediately disconnected, without a welcome message:<br>
        <br>
        <code>...<br>
        &lt;Limit LOGIN&gt;<br>
        Order deny,allow<br>
        Deny from 10.1.1.<br>
        Allow from all<br>
        &lt;/Limit&gt;<br>
        ...</code><br>
        <br>
        Next, an example of a configuration using &lt;Limit
        LOGIN&gt; that will not immediately disconnect an
        incoming client, but will return &quot;Login
        invalid&quot; for all login attempts except anonymous.<br>
        <br>
        <code>...<br>
        &lt;Limit LOGIN&gt;<br>
        DenyAll<br>
        &lt;/Limit&gt;<br>
        &lt;Anonymous ~ftp&gt;<br>
        ...<br>
        &lt;Limit LOGIN&gt;<br>
        AllowAll<br>
        &lt;/Limit&gt;<br>
        ...</code></td>
    </tr>
    <tr>
        <td>&nbsp;</td>
        <td>&nbsp;</td>
    </tr>
    <tr>
        <td valign="top"><img src="images/q.gif" width="38" height="30"></td>
        <td><strong>How can I limit one or more user sessions to
        a particular directory tree? (chroot jail)</strong></td>
    </tr>
    <tr>
        <td valign="top"><img src="images/a.gif" width="36" height="30"></td>
        <td valign="top">You can use an <a href="reference.html#anonymous">&lt;Anonymous&gt;</a>
        directive context block, possibly in combination with a <a href="reference.html#userpassword">UserPassword</a>/<a href="reference.html#anonrequirepassword">AnonRequirePassword</a>
        directive. If you wish to jail an entire group (or
        groups) of users, you can use the <a href="reference.html#defaultroot">DefaultRoot</a>
        directive (<strong>available only in 0.99.0pl7 and above</strong>).
        DefaultRoot lets you specify a root jailed directory (or
        '~' for the user's home directory), and an optional
        group-expression argument which can be used to control
        which groups of users the jail will be applied to. For
        example:<br>
        <br>
        <code>...<br>
        &lt;VirtualHost myhost.mynet.foo&gt;<br>
        DefaultRoot ~<br>
        ...<br>
        &lt;/VirtualHost&gt;</code><br>
        <br>
        This creates a configuration where all users who log into
        myhost.mynet.foo are jailed into their home directories
        (cannot chdir into a higher level directory).
        Alternatively, you could:<br>
        <br>
        <code>...<br>
        &lt;VirtualHost myhost.mynet.foo&gt;<br>
        DefaultRoot /u2/public users,!staff<br>
        ...<br>
        &lt;/VirtualHost&gt;</code><br>
        <br>
        In this sample, all users who are members of group
        'users', but not members of group 'staff' are jailed into
        /u2/public. If a user does not meet the group-expression
        requirements, they login as per normal (not jailed,
        default directory is their home).<br>
        <br>
        You can use multiple DefaultRoot directives to create
        multiple jails inside the same directive context. If two
        DefaultRoot directives apply to the same user, proftpd
        arbitrarily chooses one (based on how the configuration
        file was parsed).</td>
    </tr>
    <tr>
        <td>&nbsp;</td>
        <td>&nbsp;</td>
    </tr>
    <tr>
        <td>&nbsp;</td>
        <td><font size="3"><em><strong>The following questions
        and answers apply to proftpd version 1.1.3 and later
        only! None of these features will work in 1.0.x versions.</strong></em></font></td>
    </tr>
    <tr>
        <td>&nbsp;</td>
        <td>&nbsp;</td>
    </tr>
    <tr>
        <td valign="top"><img src="images/q.gif" width="38" height="30"></td>
        <td><strong>How do I create anonymous FTP sites for my
        users? Creating a separate &lt;Anonymous&gt;
        configuration for each user is too difficult.</strong></td>
    </tr>
    <tr>
        <td valign="top"><img src="images/a.gif" width="36" height="30"></td>
        <td>There are two methods of accomplishing this (possibly
        more). First, you can create a directory structure inside
        your anonymous FTP root directory, creating a single
        directory for each user and setting ownership/permissions
        as appropriate. Then, either create a symlink from each
        user's home directory into the FTP site, or instruct your
        users on how to access their directory.<p>The alternate
        method (and more versatile) of accomplishing per-user
        anonymous FTP is to use <a href="reference.html#AnonymousGroup">AnonymousGroup</a>
        in combination with the <a href="reference.html#DefaultRoot">DefaultRoot</a>
        directory. You'll probably want to do this inside a <a href="reference.html#VirtualHost">&lt;VirtualHost&gt;</a>,
        otherwise none of your users will be able to access your
        system without being stuck inside their per-user FTP
        site. Additionally, you'll want to use a defered <a href="reference.html#Directory">&lt;Directory&gt;</a>
        block to carefully limit outside access to each user's
        site.</p>
        <p><strong>Step 1:</strong> Create a new unix group on
        your system named `anonftp'. Please each user who will
        have per-user anonymous FTP in this group.<br>
        <strong>Step 2:</strong> Create an `anon-ftp' and
        `anon-ftp/incoming' directory in each user's home
        directory.<br>
        <strong>Step 3:</strong> Modify your /etc/proftpd.conf
        file to look something like this (you'll probably want to
        customize this to your needs):</p>
        <blockquote>
            <p align="left"><code>&lt;VirtualHost
            my.per-user.virtual.host.address&gt;</code></p>
            <blockquote>
                <p align="left"><code># the next line limits all
                logins to this virtualhost, so that only anonftp
                users can connect</code></p>
            </blockquote>
            <blockquote>
                <p align="left"><code>&lt;Limit LOGIN&gt;<br>
                DenyGroup !anonftp<br>
                &lt;/Limit&gt;</code></p>
            </blockquote>
            <blockquote>
                <p align="left"><code># limit access to each
                user's anon-ftp directory, we want read-only
                except on incoming</code></p>
            </blockquote>
            <blockquote>
                <p align="left"><code>&lt;Directory
                ~/anon-ftp&gt;</code></p>
            </blockquote>
            <blockquote>
                <blockquote>
                    <p align="left"><code>&lt;Limit WRITE&gt;<br>
                    DenyAll<br>
                    &lt;/Limit&gt;</code></p>
                </blockquote>
            </blockquote>
            <blockquote>
                <p align="left"><code>&lt;/Directory&gt;</code></p>
            </blockquote>
            <blockquote>
                <p align="left"><code># permit stor access to
                each user's anon-ftp/incoming directory, but deny
                everything else</code></p>
            </blockquote>
            <blockquote>
                <p align="left"><code>&lt;Directory
                ~/anon-ftp/incoming&gt;</code></p>
            </blockquote>
            <blockquote>
                <blockquote>
                    <p align="left"><code>&lt;Limit STOR&gt;<br>
                    AllowAll<br>
                    &lt;/Limit&gt;<br>
                    <br>
                    &lt;Limit READ WRITE&gt;<br>
                    DenyAll<br>
                    &lt;/Limit&gt;</code></p>
                </blockquote>
            </blockquote>
            <blockquote>
                <p align="left"><code>&lt;/Directory&gt;</code></p>
            </blockquote>
            <blockquote>
                <p align="left"><code># provide a default root
                for all logins to this virtualhost.<br>
                DefaultRoot ~/anon-ftp<br>
                # Finally, force all logins to be anonymous for
                the anonftp group<br>
                AnonymousGroup anonftp</code></p>
            </blockquote>
            <p align="left"><code>&lt;/VirtualHost&gt;</code></p>
        </blockquote>
        </td>
    </tr>
    <tr>
        <td valign="top"><img src="images/q.gif" width="38" height="30"></td>
        <td><strong>How do I create an Anonymous configuration
        that runs as a particular user, but still allow the user
        to login normally? I don't want to have to use a separate
        virtual host.</strong></td>
    </tr>
    <tr>
        <td valign="top"><img src="images/a.gif" width="36" height="30"></td>
        <td>You can use the <a href="reference.html#AuthAliasOnly">AuthAliasOnly</a>
        directive to control how and where real usernames get
        authenticated (as opposed to aliased names, via the <a href="reference.html#UserAlias">UserAlias</a> directive).
        Note that it is still impossible to have two identical
        aliased names login to different anonymous sites; for
        that you would need <a href="reference.html#VirtualHost">&lt;VirtualHost&gt;</a>.<p>Example:</p>
        <p><code>...<br>
        &lt;Anonymous ~jrluser&gt;</code></p>
        <blockquote>
            <p><code>User jrluser<br>
            Group jrluser<br>
            UserAlias ftp jrluser<br>
            UserAlias anonymous jrluser<br>
            AuthAliasOnly on<br>
            ...</code></p>
        </blockquote>
        <p><code>&lt;/Anonymous&gt;</code></p>
        <p>Here, the <a href="reference.html#Anonymous">&lt;Anonymous&gt;</a>
        configuration for ~jrluser is set to allow alias
        authentication only. Thus, if a client attempts to
        authenticate as 'jrluser', the anonymous config will be
        ignored and the client will be authenticated as if they
        were a normal user (typically resulting in `jrluser'
        logging in normally). However, if the client uses the
        aliased username `ftp' or `anonymous', the anonymous
        block is applied.</p>
        </td>
    </tr>
</table>
</body>
</html>