Re: [Proftpd-user] How to protect datafiles

Hi Rob,

Thank you for your reply, and your advices.
In fact, I inherit of the server and I have to deal with.
I will try to separate authorization by group instead of users.

regards
Fred 


Please Like, Share and Comment the Rain Cell Africa <https://www.facebook.com/pages/Rain-Cell-Africa/1421826451448567> page
---------------------------------------------------------------------       
                            Frédéric CAZENAVE          
         _ /\ _   /^=   Responsable Service Technique    
     \_/        \/ /       UGA / IGE - UMR 5001 
       |  _/--\  |         CS 40700      
       | |      | |          38058 Grenoble cedex 9
           
                 Tél : (33) 04 76 63 56 59
                 Fax: (33) 04 76 63 58 87   


 <https://www.facebook.com/pages/Rain-Cell-Africa/1421826451448567>
Rain Cell Africa  <https://www.facebook.com/pages/Rain-Cell-Africa/1421826451448567>   http:// <http://raincell01.sciencesconf.org/>www.raincellafrica.net <http://raincell01.sciencesconf.org/>/
---------------------------------------------------------------------




> Le 21 mars 2020 à 14:03, Rob Coops <[email protected]> a écrit :
> 
> I'd suggest a few things to improve this situation.
> First of all an automated user should be unique and should not be able to be used by humans this way you can much easier control what users can do vs. what your automated system can do.
> Als all users should have their own login, this way (no shared passwords) is someone makes a mistake or purposefully causes a problem you can identify the user that did this without having to jump trough hoops trying to identify who it was as there are an X number of people that can login with that same account.
> 
> Having done that, you can simply create a a imit much like you are doing in your example above, look at this page for the details how to set them up: http://www.proftpd.org/docs/howto/Limit.html <http://www.proftpd.org/docs/howto/Limit.html>
> 
> I would suggest creating user groups, that way rather than allowing individual users access or denying it, you change the group and all users in that group automatically have the same restrictions without you having to update the configuration each time. Configuring users in a separate location from the server accounts is always a good idea so virtual users is the way to go: http://www.proftpd.org/docs/howto/VirtualUsers.html <http://www.proftpd.org/docs/howto/VirtualUsers.html> the reason being that the server itself remains the domain of those that need to be on that host where users that just need to mess with the files on the FTP server can do that without any possibility of connecting to the machine hosting the FTP server.
> 
> In summary you can specify each possible FTP command in the limits configuration and provide only access to what people need for their job.
> Be wise and group users together setting limits on the groups rather than individual users. This will make your life a lot easier in the long run.
> 
> Regards,
> 
> Rob
> 
> On Fri, Mar 20, 2020 at 6:46 PM Frederic Cazenave <[email protected] <mailto:[email protected]>> wrote:
> Hi,
> 
> I use proftpd to receive data from automatic dataloggers. 
> Every day many dataloggers around the world put data on my server.
> They use to append files.
> 
> Some users have the same login as a datalogger to get access to the data.
> So I would like to limit the kind of operations that can be done, to protect data.
> 
> So for a specific user, I would like to be able to limit  operation to : CREAT a file, APPEND a file, READ a file, LIST DIR  and CHANGE DIR.
> 
> Only ftpadm can delete a file.
> 
> My configuration is : 
> 
> <Directory ~>
>   <Limit DELE>
>      AllowUser ftpadm
>      DenyAll
>   </Limit>
>   <Limit LOGIN WRITE STOR LIST NLST STAT>
>      AllowUser TOTO TATA TITI
>      DenyAll
>   </Limit>
> </Directory>
> 
> In fact, any user can modify a file, move it to an other directory, but can’t delete it.
> 
> How to specify only CREAT a life, APPEND a file, READ a file, LIST and CHANGEDIR can be done.
> 
> Thank you very much,
> 
> regards
> 
> Fred
> 
> 
> Please Like, Share and Comment the Rain Cell Africa <https://www.facebook.com/pages/Rain-Cell-Africa/1421826451448567> page
> ---------------------------------------------------------------------       
>                             Frédéric CAZENAVE          
>          _ /\ _   /^=   Responsable Service Technique    
>      \_/        \/ /       UGA / IGE - UMR 5001 
>        |  _/--\  |         CS 40700      
>        | |      | |          38058 Grenoble cedex 9
>            
>                  Tél : (33) 04 76 63 56 59
>                  Fax: (33) 04 76 63 58 87   
> 
> 
>  <https://www.facebook.com/pages/Rain-Cell-Africa/1421826451448567>
> Rain Cell Africa  <https://www.facebook.com/pages/Rain-Cell-Africa/1421826451448567>   http:// <http://raincell01.sciencesconf.org/>www.raincellafrica.net <http://raincell01.sciencesconf.org/>/
> ---------------------------------------------------------------------
> 
> 
> 
> 
> _______________________________________________
> ProFTPD Users List   <[email protected] <mailto:[email protected]>>
> Unsubscribe problems?
> http://www.proftpd.org/list-unsub.html <http://www.proftpd.org/list-unsub.html>_______________________________________________
> ProFTPD Users List   <[email protected]>
> Unsubscribe problems?
> http://www.proftpd.org/list-unsub.html

_______________________________________________
ProFTPD Users List   <[email protected]>
Unsubscribe problems?
http://www.proftpd.org/list-unsub.html