Re: [Proftpd-user] How to protect datafiles

I'd suggest a few things to improve this situation.
First of all an automated user should be unique and should not be able to
be used by humans this way you can much easier control what users can do
vs. what your automated system can do.
Als all users should have their own login, this way (no shared passwords)
is someone makes a mistake or purposefully causes a problem you can
identify the user that did this without having to jump trough hoops trying
to identify who it was as there are an X number of people that can login
with that same account.

Having done that, you can simply create a a imit much like you are doing in
your example above, look at this page for the details how to set them up:
http://www.proftpd.org/docs/howto/Limit.html

I would suggest creating user groups, that way rather than allowing
individual users access or denying it, you change the group and all users
in that group automatically have the same restrictions without you having
to update the configuration each time. Configuring users in a separate
location from the server accounts is always a good idea so virtual users is
the way to go: http://www.proftpd.org/docs/howto/VirtualUsers.html the
reason being that the server itself remains the domain of those that need
to be on that host where users that just need to mess with the files on the
FTP server can do that without any possibility of connecting to the machine
hosting the FTP server.

In summary you can specify each possible FTP command in the limits
configuration and provide only access to what people need for their job.
Be wise and group users together setting limits on the groups rather than
individual users. This will make your life a lot easier in the long run.

Regards,

Rob

On Fri, Mar 20, 2020 at 6:46 PM Frederic Cazenave <[email protected]>
wrote:

> Hi,
>
> I use proftpd to receive data from automatic dataloggers.
> Every day many dataloggers around the world put data on my server.
> They use to append files.
>
> Some users have the same login as a datalogger to get access to the data.
> So I would like to limit the kind of operations that can be done, to
> protect data.
>
> So for a specific user, I would like to be able to limit  operation to :
> CREAT a file, APPEND a file, READ a file, LIST DIR  and CHANGE DIR.
>
> Only ftpadm can delete a file.
>
> My configuration is :
>
> <Directory ~>
>   <Limit DELE>
>      AllowUser ftpadm
>      DenyAll
>   </Limit>
>   <Limit LOGIN WRITE STOR LIST NLST STAT>
>      AllowUser TOTO TATA TITI
>      DenyAll
>   </Limit>
> </Directory>
>
> In fact, any user can modify a file, move it to an other directory, but
> can’t delete it.
>
> How to specify only CREAT a life, APPEND a file, READ a file, LIST and
> CHANGEDIR can be done.
>
> Thank you very much,
>
> regards
>
> Fred
>
>
> Please Like, Share and Comment the Rain Cell Africa
> <https://www.facebook.com/pages/Rain-Cell-Africa/1421826451448567> page
> ---------------------------------------------------------------------
>
>                             *Frédéric CAZENAVE          *
>          _ /\ _   /^=   Responsable Service Technique
>      \_/        \/ /       UGA / IGE - UMR 5001
>        |  _/--\  |         CS 40700
>        | |      | |          38058 Grenoble cedex 9
>
>                  Tél : (33) 04 76 63 56 59
>                  Fax: (33) 04 76 63 58 87
>
>
> <https://www.facebook.com/pages/Rain-Cell-Africa/1421826451448567>
>
> Rain Cell Africa
> <https://www.facebook.com/pages/Rain-Cell-Africa/1421826451448567>
> http:// <http://raincell01.sciencesconf.org/>www.raincellafrica.net
> <http://raincell01.sciencesconf.org/>/
> ---------------------------------------------------------------------
>
>
>
>
> _______________________________________________
> ProFTPD Users List   <[email protected]>
> Unsubscribe problems?
> http://www.proftpd.org/list-unsub.html

_______________________________________________
ProFTPD Users List   <[email protected]>
Unsubscribe problems?
http://www.proftpd.org/list-unsub.html