Re: [Proftpd-user] Setting up restricted ftp/sftp site

On 15.11.19 11:50, John Stoffel wrote:
>Been plugging away at setting up a new ftp/sftp site and I have some
>specific requirements which I need to meet.  I've been reading and
>re-reading the site trying to get a working configuration for what I
>need, but I'm missing some something subtle here.  Looking at the FAQ
>and sample configurations doesn't help since I just want one site, but
>with very locked down users, both internal and external.
>
>So my requirements are:
>
>- customers are restricted to their own home directories.  This is
>  solved using the mod_vroot stuff.  And DefaultRoot ~ as default.

you can do this without mod_vroot, if proftpd runs under root user.

>- internal users can only see and access the directories of customers
>  if they are in that customer's group.  This is working.
>
>- Customers can only put files into the 'to_corp' directory, and only
>  read files in the 'from_corp' directory, but I can't seem to make
>  this work.

which one? 
what is the error message?
note that when reading or writing, proftpd permissions are not enough.
Logged users must have filesystem permissions to be allowed to access/write
files.

>  All customers belong to a group called 'cust'.  Internal users are
>  members of the 'dmzftp' group, and then are added to /etc/groups as
>  members of those customer groups the need access to.  The idea is
>  that intneral users only see those customers they have access to,
>  nothing else.

>  <Directory /path/to/cust1>

what are those users home directories? 

>    HideNoAccess on
>
>  <Limit CWD PWD LIST MLST STAT READ>
>    AllowUser cust1
>    AllowGroup cust1
>  </Limit>
>  <Limit ALL>
>    DenyAll
>  </Limit>
>  </Directory>
>
>  <Directory /path/to_cust1/to_corp>
>    <Limit ALL>
>      DenyAll
>    </Limit>
>    <Limit CDUP CWD PWD XCWD XCUP DIRS>
>      AllowGroup cust1
>    </Limit>
>    <Limit STOR STOU>
>      AllowUser cust1
>    </Limit>
>  </Directory>
>  <Directory /path/to/cust1/from_corp>
>    <Limit CWD PWD DIRS READ>
>      AllowUser cust1
>    </Limit>
>    <Limit ALL>
>      DenyUser cust1
>      AllowGroup dmzftp
>    </Limit>
>  </Directory>

-- 
Matus UHLAR - fantomas, [email protected] ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
I wonder how much deeper the ocean would be without sponges.


_______________________________________________
ProFTPD Users List   <[email protected]>
Unsubscribe problems?
http://www.proftpd.org/list-unsub.html