Re: [Proftpd-user] Setting up restricted ftp/sftp site

>>>>> "Matus" == Matus UHLAR <- fantomas <[email protected]>> writes:

Matus> On 15.11.19 11:50, John Stoffel wrote:
>> Been plugging away at setting up a new ftp/sftp site and I have some
>> specific requirements which I need to meet.  I've been reading and
>> re-reading the site trying to get a working configuration for what I
>> need, but I'm missing some something subtle here.  Looking at the FAQ
>> and sample configurations doesn't help since I just want one site, but
>> with very locked down users, both internal and external.
>> 
>> So my requirements are:
>> 
>> - customers are restricted to their own home directories.  This is
>> solved using the mod_vroot stuff.  And DefaultRoot ~ as default.

Matus> you can do this without mod_vroot, if proftpd runs under root user.

I'm not using mod_vroot at all, but I am running as a nonroot user.  I
suspect that's the first thing I need to change.  My proftpd.conf
looks like this:

     DefaultServer                   off
     Port                            0
     UseIPv6                         off
     User                            dmzftp
     Group                           dmzftp

     <Global>
       RequireValidShell off
       Umask                         007     007
       AllowOverwrite                yes
       UseFtpUsers off
       FactsAdvertise off
       DefaultRoot ~
     </Global>

     <IfModule mod_sftp.c>
       <VirtualHost 192.168.123.202>
	 SFTPEngine ON
	 SFTPPAMEngine off
	 Port             22

	 SFTPHostKey      /ftp/ssh/ssh_host_rsa_key
	 SFTPLog          /var/log/proftpd/sftp.log
	 SFTPCompression delayed

	 # Where all the customer & TAEC user definitions are
	 Include /ftp/etc/ftpd.users
       </VirtualHost>
     </IfModule>

     <VirtualHost 192.168.123.202>
	 Port            21
	 Include /ftp/etc/ftpd.users
     </VirtualHost>

And the /ftp/setc/ftpd.users looks like what I posted before, but I
have the following at the top of the file:

     <Directory /path/to>
       <Limit ALL>
	 AllowGroup dmzftp
	 DenyAll
       </Limit>
       HideNoAccess on
     </Directory>

All my internal users have a default group of 'dmzftp' and my
customers all default to a group named after their username.  So the
system /etc/group looks like this:

     dmzftp:x:4999:
     cust1:x:5000:user1,user2
     cust2:x:5001:user2,user3
     cust3:x:5002:user2
     cust4:x:5003:user4

This way internal users can only access/see the directories of the
customers they need to interact with.  

>> - internal users can only see and access the directories of customers
>> if they are in that customer's group.  This is working.

I have it setup and working for the simple case where a user of
chroot'd into their own directory, and they can upload/download
files.  This is with the following entry:

    <Directory /path/to/cust2>
      <Limit ALL>
	 AllowGroup cust2
	 DenyAll
      </Limit>
      HideNoAccess on
      HideFiles "!(.*)$" group cust2
    </Directory>
			

This works great.  But since I want to be more restrictive at lower
levels... that's why I'm asking for help.


>> - Customers can only put files into the 'to_corp' directory, and only
>> read files in the 'from_corp' directory, but I can't seem to make
>> this work.

Matus> which one? 
Matus> what is the error message?

The error message I get, using openssh sftp client is as follows:

    sftp> put dead.letter
    Uploading dead.letter to /dead.letter
    Couldn't get handle: Permission denied


Matus> note that when reading or writing, proftpd permissions are not enough.
Matus> Logged users must have filesystem permissions to be allowed to access/write
Matus> files.

Yup, I figured as much.  In my further testing here, it seems like I
really need to re-think the 'dmzftp' as the owner of the directories,
and as whether to run proftpd as the root user.


>> All customers belong to a group called 'cust'.  Internal users are
>> members of the 'dmzftp' group, and then are added to /etc/groups as
>> members of those customer groups the need access to.  The idea is
>> that intneral users only see those customers they have access to,
>> nothing else.

>> <Directory /path/to/cust1>

Matus> what are those users home directories? 

All the internal users have a home directory of /path/to, so they get
chroot'd as well. 

>> HideNoAccess on
>> 
>> <Limit CWD PWD LIST MLST STAT READ>
>> AllowUser cust1
>> AllowGroup cust1
>> </Limit>
>> <Limit ALL>
>> DenyAll
>> </Limit>
>> </Directory>
>> 
>> <Directory /path/to_cust1/to_corp>
>> <Limit ALL>
>> DenyAll
>> </Limit>
>> <Limit CDUP CWD PWD XCWD XCUP DIRS>
>> AllowGroup cust1
>> </Limit>
>> <Limit STOR STOU>
>> AllowUser cust1
>> </Limit>
>> </Directory>
>> <Directory /path/to/cust1/from_corp>
>> <Limit CWD PWD DIRS READ>
>> AllowUser cust1
>> </Limit>
>> <Limit ALL>
>> DenyUser cust1
>> AllowGroup dmzftp
>> </Limit>
>> </Directory>


_______________________________________________
ProFTPD Users List   <[email protected]>
Unsubscribe problems?
http://www.proftpd.org/list-unsub.html