Newbie needs help with ProFTPd

[HPB]

i searched everywhere trying to figure this out since I would feel like an idiot asking but i finally have given up and look to you guys for guidance. I haven't the slightest idea how to set my ProFTPd server up. I need help with the proper wording in the proftpd.conf file. Here is what i am using and needing.
I am trying to run ProFTPd 1.2.4 on a Redhat Linux 7.1 machine. I have one static ip address. Examples of what i am looking for. let's say i make a directory called /www/ftp. I want to set it up so that i can allow five users access to this directory but not to any other directory above it. I want them to have download and upload as well as overwrite access in this directory. Let's say one of the users i want to have access to it is named joe. Here is the steps i would take to set up his account in linux (tell me if i am wrong) i set up a new user joe and set him to group:ftp. Command interpreter i set to /bin/false (i think) then i set his home directory to /www/ftp and give him a password like joerules. i think that is all i have to do to set up the user. The part i am having a conniption over is what i put in proftpd.conf to allow joe access. But like i said i want joe and four others to have access and i don't want to let anyone else have access to the ftp server. I started out with the basic proftpd.conf file that installed with the server but i butchered it and went back to the basic.conf.

If i wrote to much to make a long story short (too late) i need step by step help on how to properly set up a user on my machine and what to put into the proftpd.conf to allow those users and no anonymous users.

Whew!

Sorry
Adam


Example of the basic proftpd.conf if you need to see it:

# This is a basic ProFTPD configuration file (rename it to
# 'proftpd.conf' for actual use. It establishes a single server
# and a single anonymous login. It assumes that you have a user/group
# "nobody" and "ftp" for normal operation and anon.

ServerName "ProFTPD Default Installation"
ServerType standalone
DefaultServer on

# Port 21 is the standard FTP port.
Port 21
# Umask 022 is a good standard umask to prevent new dirs and files
# from being group and world writable.
Umask 022

# To prevent DoS attacks, set the maximum number of child processes
# to 30. If you need to allow more than 30 concurrent connections
# at once, simply increase this value. Note that this ONLY works
# in standalone mode, in inetd mode you should use an inetd server
# that allows you to limit maximum number of processes per service
# (such as xinetd)
MaxInstances 30

# Set the user and group that the server normally runs at.
User nobody
Group nogroup

# Normally, we want files to be overwriteable.
<Directory /*>
AllowOverwrite on
</Directory>

# A basic anonymous configuration, no upload directories.
<Anonymous ~ftp>
User ftp
Group ftp
# We want clients to be able to login with "anonymous" as well as "ftp"
UserAlias anonymous ftp

# Limit the maximum number of anonymous logins
MaxClients 10

# We want 'welcome.msg' displayed at login, and '.message' displayed
# in each newly chdired directory.
DisplayLogin welcome.msg
DisplayFirstChdir .message

# Limit WRITE everywhere in the anonymous chroot
<Limit WRITE>
DenyAll
</Limit>

</Anonymous>

[MGP]

This should help you out some. I've got my ftp server setup just like you describe with a few additional things.

# This is a basic ProFTPD configuration file (rename it to
# 'proftpd.conf' for actual use). It establishes a single server
# and no anonymous login. It assumes that you have a user/group
# "nobody" and "ftp" for normal operation.

ServerName "webtoo.net ftp server"
ServerType standalone
ServerIdent on "FTP Server Ready."
DefaultServer on

# Limit LOGIN to trusted sources
<Limit LOGIN>
Order allow,deny
Allow from XX.XX.XXX.XXX
Allow from XX.XX.XXX.XXX
Allow from XX.XX.XX.XX
Deny from all
</Limit>

# Port 21 is the standard FTP port.
Port 21
# Umask 022 is a good standard umask to prevent new dirs and files
# from being group and world writable.
Umask 022

# To prevent DoS attacks, set the maximum number of child processes
# to 30. If you need to allow more than 30 concurrent connections
# at once, simply increase this value. Note that this ONLY works
# in standalone mode, in inetd mode you should use an inetd server
# that allows you to limit maximum number of processes per service
# (such as xinetd)
MaxInstances 30

# Set the user and group that the server normally runs at.
User nobody
Group nogroup

# This causes proftpd to perform a chroot into the authenticating user's
# directory immediately after login. Once this happens, the user is unable
# to "see" higher level directories.
#
DefaultRoot ~

# Normally, we want files to be overwriteable.
<Directory /*>
AllowOverwrite on
</Directory>

Make sure you put proftpd.conf in /usr/local/etc

Notice that I changed the default server message. That way you are not announcing to the world which server software you are running.

I also have a section which limits logins to trusted hosts. If you know the domain(s) your users will be logging in from, it's a good security idea. You can also allow all hosts, but deny specific ones as well

The last change I made to the basic configuration file is to "chroot jail" the user. That way they are limited to their home directory tree.

Also, you'll probably get an error the first time you start the daemon telling you it couldn't create the pid file. This is because it expects a particular directory (can't remember the name off the top of my head) to exist and it doesn't. Just note where the error message tells you the pid creation failed at and create an empty directory there. It will work fine then.

When you create a user account for each person give them all the same group name (it really doesn't matter, ftp should work fine) and make sure thay all have the same home directory of /www/ftp. The ftp server will default to their home directory after login. I think the default shell of /bin/false will work OK, I have my users set to /bin/bash since I want them to be able to ssh into the system also. Other than that, the configuration I gave you should work for all your users.

Good luck, tell us how it goes!

[ 06 December 2001: Message edited by: MGP ]

[HPB]

Matt,

It worked perfectly. Thank you very much for the help