Re: vsftp configuration question
Thanks for the reply! I stumbled across a HOWTO sometime after I sent the reply. The howto is for "Debian Etch" but works on Ubuntu 7.10 and should work on any distribution (though you'll have to find the packages on your own/through your distro packaging system). The HOWTO gives the basics on virtual users authenticating against a MySQL DB. It's at:
http://www.howtoforge.com/vsftpd_mysql_debian_etch for anyone who's interested.
As far as the user-specific settings I"ll have to play with that more. The Howto didn't have any examples on it, but the man page did :)
As far as vsftp goes, I really like it! And I think it's more than enough to get my boss to want to convert from XP->linux for FTP (and later, FTP+ssl). Now we just have to migrate over....
Regards,
Robert Parkhurst
IT Engineer
Scarab Consulting
110 Broadway, Suite 190
San Antonio, TX 78205
Office: 210.527.1390
Mobile: 210.289.2538
|
On Thu, 2007-12-20 at 20:25 -0600, Daniel J. Givens wrote:
Robert Parkhurst wrote:
> What I want is to migrate the FTP server from XP/bulletproof -> Ubuntu
> (7.04/7.10?)/vsftp (or another one). VSFTP looks good because it's big
> on security.
If you go with Ubuntu, I would suggest the LTS release, which was 6.06.
No, you're not getting the bleeding edge versions, but you won't be
dist-upgrading every six months. It is supported for five years, so 6.06
will be good until 2011. The next release, 8.04 is supposed to be the
next LTS release.
You might have some say that Ubuntu isn't a great choice for servers,
but I've run several and not had any problems. At least you are sure to
get five years out of a release. Debian stable and RHEL/CentOS are good
alternatives you might want to look into. I haven't played with SUSE in
a while, so I can't recommend or discourage it.
> What I need to know is:
> I see a global option to limit number of connections per IP. Can this
> be changed on a per-account basis? For example, could we set a global
> limit of "2 connections per IP" but for account "blah1" we change that
> to "6 connections per IP"?
From the vsftpd.conf manpage:
user_config_dir
This powerful option allows the override of any config option
specified in the manual page, on a per-user basis. Usage is sim-
ple, and is best illustrated with an example. If you set
user_config_dir to be /etc/vsftpd_user_conf and then log on as
the user "chris", then vsftpd will apply the settings in the
file /etc/vsftpd_user_conf/chris for the duration of the ses-
sion. The format of this file is as detailed in this manual
page! PLEASE NOTE that not all settings are effective on a per-
user basis. For example, many settings only prior to the user’s
session being started. Examples of settings which will not
affect any behviour on a per-user basis include listen_address,
banner_file, max_per_ip, max_clients, xferlog_file, etc.
So, while you can have a lot of flexibility for most options on a
per-user basis, you can't override the per-ip max connection. It seems
that by moving the max_per_ip check to fire after the authentication
check wouldn't be too difficult, but I don't have time at the moment to
dig through the code.
> I know there's more questions I have, but that's the big one. I know
> it'd probably be easier just to set a global limit of say 10 connections
> per IP, but my boss really likes/wants that feature that comes with
> bulletproof.
There is ProFTPD, which does support per-user connection limiting[1]. It
has a pretty good record for security and they have an FAQ addressing it
that is worth looking at[2]. ProFTPD supports modules like Apache for
extended functionality, which is nice. It's robust set of features and
extensibility have always made it an attractive option for me, though
I've used vsftpd more in the past year.
[1] http://preview.tinyurl.com/yt3q7b
[2] http://www.proftpd.org/docs/faq/linked/faq-ch6.html
Cheers!
Daniel
_______________________________________________
ALG-technical mailing list http://austinlug.org/cgi-bin/mailman/listinfo/alg-technical
<div>
Thanks for the reply! I stumbled across a HOWTO sometime after I sent the reply. The howto is for "Debian Etch" but works on Ubuntu 7.10 and should work on any distribution (though you'll have to find the packages on your own/through your distro packaging system). The HOWTO gives the basics on virtual users authenticating against a MySQL DB. It's at: <a href="http://www.howtoforge.com/vsftpd_mysql_debian_etch">http://www.howtoforge.com/vsftpd_mysql_debian_etch</a> for anyone who's interested.<br><br>
As far as the user-specific settings I"ll have to play with that more. The Howto didn't have any examples on it, but the man page did :) <br><br>
As far as vsftp goes, I really like it! And I think it's more than enough to get my boss to want to convert from XP->linux for FTP (and later, FTP+ssl). Now we just have to migrate over....<br><br><br><br><br><br><br><table cellspacing="0" cellpadding="0" width="100%"><tr>
<td>
Regards,<br><br><br><br>Robert Parkhurst<br>
IT Engineer<br>
Scarab Consulting<br>
110 Broadway, Suite 190<br>
San Antonio, TX 78205<br>
Office: 210.527.1390<br>
Mobile: 210.289.2538
</td>
</tr></table>
<br><br>
On Thu, 2007-12-20 at 20:25 -0600, Daniel J. Givens wrote:
<blockquote type="CITE">
Robert Parkhurst wrote:
> What I want is to migrate the FTP server from XP/bulletproof -> Ubuntu
> (7.04/7.10?)/vsftp (or another one). VSFTP looks good because it's big
> on security.
If you go with Ubuntu, I would suggest the LTS release, which was 6.06.
No, you're not getting the bleeding edge versions, but you won't be
dist-upgrading every six months. It is supported for five years, so 6.06
will be good until 2011. The next release, 8.04 is supposed to be the
next LTS release.
You might have some say that Ubuntu isn't a great choice for servers,
but I've run several and not had any problems. At least you are sure to
get five years out of a release. Debian stable and RHEL/CentOS are good
alternatives you might want to look into. I haven't played with SUSE in
a while, so I can't recommend or discourage it.
> What I need to know is:
> I see a global option to limit number of connections per IP. Can this
> be changed on a per-account basis? For example, could we set a global
> limit of "2 connections per IP" but for account "blah1" we change that
> to "6 connections per IP"?
From the vsftpd.conf manpage:
user_config_dir
This powerful option allows the override of any config option
specified in the manual page, on a per-user basis. Usage is sim-
ple, and is best illustrated with an example. If you set
user_config_dir to be /etc/vsftpd_user_conf and then log on as
the user "chris", then vsftpd will apply the settings in the
file /etc/vsftpd_user_conf/chris for the duration of the ses-
sion. The format of this file is as detailed in this manual
page! PLEASE NOTE that not all settings are effective on a per-
user basis. For example, many settings only prior to the user’s
session being started. Examples of settings which will not
affect any behviour on a per-user basis include listen_address,
banner_file, max_per_ip, max_clients, xferlog_file, etc.
So, while you can have a lot of flexibility for most options on a
per-user basis, you can't override the per-ip max connection. It seems
that by moving the max_per_ip check to fire after the authentication
check wouldn't be too difficult, but I don't have time at the moment to
dig through the code.
> I know there's more questions I have, but that's the big one. I know
> it'd probably be easier just to set a global limit of say 10 connections
> per IP, but my boss really likes/wants that feature that comes with
> bulletproof.
There is ProFTPD, which does support per-user connection limiting[1]. It
has a pretty good record for security and they have an FAQ addressing it
that is worth looking at[2]. ProFTPD supports modules like Apache for
extended functionality, which is nice. It's robust set of features and
extensibility have always made it an attractive option for me, though
I've used vsftpd more in the past year.
[1] <a href="http://preview.tinyurl.com/yt3q7b">http://preview.tinyurl.com/yt3q7b</a>
[2] <a href="http://www.proftpd.org/docs/faq/linked/faq-ch6.html">http://www.proftpd.org/docs/faq/linked/faq-ch6.html</a>
Cheers!
Daniel
_______________________________________________
ALG-technical mailing list <a href="http://austinlug.org/cgi-bin/mailman/listinfo/alg-technical">http://austinlug.org/cgi-bin/mailman/listinfo/alg-technical</a>
</blockquote>
</div>
RSS Feed