Re: limiting ftp logins of a specific user

Jeroen,

Well, I would have suggested putting the user into a class and using the
limit command, but I'm not sure if that counts every login by the same user
against the limit, or just the number of different users in the class who
log in.  Might be worth a try if you haven't done so already.

Does the version of WU-FTPD you are using support the host-limit command ?
I'm not sure that this is available in the current production version, but
it is in the development CVS snapshot.  Here's the ftpaccess documentation
from the last CVS snapshot I have :-

   host-limit <class> <n> <times> <message_file>

   Limit <class> to <n> simultaneous connections per host IP address at
   times <times>, displaying <message_file> if the user is denied access.
   Limit check is performed at login time only.
   If multiple "host-limit" commands can apply to the current session, the first
   applicable one is used.  Failing to define a valid limit, or a limit of -1,
   is equivalent to unlimited. <times> is in same format as the times in the
   UUCP L.sys file. See 'Time Format' below for the syntax.

This is still a per-IP address limit, but assuming the user is running the
parallel uploader on a single system at any one time, this might still work
for you.

Cheers, Bob

On Tue, Nov 27, 2007 at 11:13:05AM -0800, Jeroen van Aart wrote:
> Hello,
> 
> I am wondering if it is possible to configure wu-ftpd to limit logins by 
> a specific user (using Debian etch here). I have set a maximum amount of 
> connections globally. The problem is, even after rising the max 
> connections a bit, this user still saturates all available connections 
> (probably a badly configured parallel uploader tool). So far I have not 
> been able to find out how, through wu-ftpd, I checked docs and faqs of 
> course. I could use the IP address but it changes.
> 
> I did try to use /etc/security/limits.conf with pam, but somehow it will 
> not work. Testing this with another service like ssh works. 
> Authentication goes through pam which checks an ldap database. Also 
> wu-ftpd uses openbsd-inetd.
> 
> /etc/security/limits.conf reads:
> username        hard    maxlogins       4
> 
> /etc/pam.d/wu-ftpd reads (not that I added the last entry to try and 
> have it obey limits.conf):
> # Standard behaviour for ftpd(8).
> auth    required        pam_listfile.so item=user sense=deny 
> file=/etc/ftpusers onerr=succeed
> 
> # This line is required by ftpd(8).
> auth    sufficient      /lib/security/pam_ldap.so
> 
> # Uncomment this to achieve what used to be ftpd -A.
> #auth   required        pam_listfile.so item=user sense=allow 
> file=/etc/ftpchroot onerr=fail
> 
> # Standard blurb.
> auth    required        pam_unix_auth.so shadow nullok use_first_pass
> auth    required        pam_shells.so
> account required        pam_unix_acct.so
> session required        pam_unix_session.so
> session required        /lib/security/pam_limits.so
> 
> Thank you,
> Jeroen

-- 
Bob Luckin      [email protected]      "Coder, adapt; FTP Ada, redo C"