Re: ProFTP login horror

On Tue, 2006-02-28 at 21:24 +0100, Marcel Janssen wrote:
Hi Les,
I haven't used proftpd for a while. Does it have any security
options (like not running as root or living in a chroot jail)
that would keep it from reading your shadow password file?

Yes, it doesn't run as root and can live in a chroot jail.

Here's what I use:

In proftpd.conf:

...
# Use pam to authenticate (default) and be authoritative
AuthPAMConfig proftpd
AuthOrder mod_auth_pam.c* mod_auth_unix.c
# Do not perform ident lookups (hangs when the port is filtered)
IdentLookups off
# Turn off reverse DNS lookups
# Not having this option can cause problems for chrooted users e.g.
anonymous
#UseReverseDNS off
# This sometimes helps too
PersistentPasswd off
...

And in /etc/pam.d/proftpd

#%PAM-1.0
auth required pam_listfile.so item=user sense=deny
file=/etc/ftpusers onerr=succeed
auth required pam_stack.so service=system-auth
auth required pam_shells.so
account required pam_stack.so service=system-auth
session required pam_stack.so service=system-auth

Paul.

--
fedora-list mailing list
fedora-list@xxxxxxxxxx
To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list

Relevant Pages

  • Re: Mandrake 8.1 Desktop Gone
    ... You want to set up anonymous ftp with a chroot jail. ... Use chmod to remove "others" access to all directories in root. ... database using the same package specification ...
    (alt.os.linux)
  • Re: ProFTP login horror
    ... it doesn't run as root and can live in a chroot jail. ... read/write access but limited only to the ftp directory when accessed over ... Perhaps I haven't checked out vsftp well enough though. ...
    (Fedora)
  • Re: Linux chroot
    ... chroot jail natively. ... this error when I try to su to root: ... Shared Hosting, Reseller Hosting, Dedicated & Semi-Dedicated servers ... OpenSSH 5 does support some useful chroot utilities, ...
    (comp.os.linux.security)
  • Re: SSH and restricting to a chroot jail
    ... mount a chroot jail on a seperate partition to stop ... Hasty advice is seldom good advice, ... > have needed root permitions you certainly make one ... >> useful features that make breaking out of a chroot jail that ...
    (comp.os.linux.security)