Softpanorama (slightly skeptical) Open Source Software Educational Society

May the source be with you, but remember the KISS principle ;-) Softpanorama Search

Pure FTP configuration in Suse

Pure-ftp has very interesting built-in security mechanisms, probably the most elaborate and well though out that I ever saw in any ftp daemon.

1. The first and pretty brilliant idea is to created two groups of users with different levels of access: one caged and the other privileged, usually wheel group -- 10 in the example below, not.

   Cage in every user in his home directory
   
   ChrootEveryone no
   
   
   # If the previous option is set to "no", members of the following group
   # won't be caged. Others will be. If you don't want chroot()ing anyone,
   # just comment out ChrootEveryone and TrustedGID.
   
   TrustedGID 10

2. The second very good idea is to set lower limit on UID of users who can use FTP. In the example below it is 100.  that excludes possibility to use system accounts like httpd or apache2 for ftp access.

   MinUID 100
    

3. The third good idea is to block access to dot file for users outside of trusted group.\

   # Users can't delete/write files beginning with a dot ('.')
   # even if they own them. If TrustedGID is enabled, this group
   # will have access to dot-files, though.
   
   ProhibitDotFilesWrite yes

4.  Separation of IP spaces for anonymous FTP and authenticated users.

   # Only connections to this specific IP address are allowed to be
   # non-anonymous. You can use this directive to open several public IPs for
   # anonymous FTP, and keep a private firewalled IP for remote administration.
   # You can also only allow a non-routable local IP (like 10.x.x.x) to
   # authenticate, and keep a public anon-only FTP server on another IP.
   
   #TrustedIP 10.1.1.1

5. Apache style file transfer log

   # Create an additional log file with transfers logged in a Apache-like format :
   # fw.c9x.org - jedi [13/Dec/1975:19:36:39] "GET /ftp/linux.tar.bz2" 200 21809338
   # This log file can then be processed by www traffic analyzers.

6. Ability to work either iv IPv4 or IPv6
   
   AltLog clf:/var/log/pureftpd.log

Example of configuration

# grep -v "^#" pure-ftpd.conf | grep -v "^$"
ChrootEveryone              no
TrustedGID                  10
BrokenClientsCompatibility  no
MaxClientsNumber            10
Daemonize                   yes
MaxClientsPerIP             3
VerboseLog                  no
AllowDotFiles               yes
DisplayDotFiles             yes
AnonymousOnly               no
NoAnonymous                 yes
SyslogFacility              ftp
DontResolve                 no
MaxIdleTime                 45
PAMAuthentication           yes
LimitRecursion              2000 8
AnonymousCanCreateDirs      no
MaxLoad                     4
AntiWarez                   yes
MinUID                      100
AllowUserFXP                yes
AllowAnonymousFXP           no
ProhibitDotFilesWrite       yes
ProhibitDotFilesRead        no
AutoRename                  no
AnonymousCantUpload         yes
AltLog                      clf:/var/log/pureftpd.log
NoChmod                     no
CreateHomeDir               yes
MaxDiskUsage                99
NoRename                    no
CustomerProof               yes
IPV4Only                    yes