[Proftpd-user] Mod_ban.c : does it work with IfClass and with serveral VirtualHosts ?

"De Gaaij, Pieter" <[email protected]>
Newsgroups gmane.network.proftpd.user
Message-ID <[email protected]> 
Hello,

I have created a ProFTPD 1.3.7rc4 setup with 2 Virtual Hosts, listening 
on the same IP-address, but of course on different network ports: 22 and 21.

Further, I have configured IfModule mod_ban.c to ban hosts with these 
ban-rules:
BanOnEvent MaxLoginAttempts 2/00:05:00 01:00:00 "You are banned out for 
1 hour
BanOnEvent ClientConnectRate 10/00:01:00 02:00:00 "Stop connecting 
frequently"
BanOnEvent RootLogin 1/00:01:00 02:00:00 "Stop connecting with root"
BanOnEvent mod_auth.root-login 1/00:01:00 02:00:00 "Stop connecting with 
root"

And I have tried to implement the suggestion in the documentation 
"ProFTPD module mod_ban" to enable the ban-engine based on the "Class" 
of the host.
So I have created a Class "whitelist" based on the IP-address 
192.168.101.165.
So for all the hosts with source-IP 192.168.101.165 , the ban-engine is 
off and for all the other hosts, the ban-engine is on:

In the server config part:

<Class whitelist>
         From 192.168.101.165
</Class>

|<IfModule mod_ban.c>
         #BanEngine               on

         <IfClass whitelist>
               # Make sure the mod_ban module is on for clients that are 
not whitelisted
               BanEngine off
         </IfClass>

         <IfClass !whitelist>
               # Turn the mod_ban module off for whitelisted clients
               BanEngine on
         </IfClass>

         BanLog /export/org/proftpd/log/proftpd_ban.log
         BanTable /export/org/proftpd/etc/proftpd_ban.tab

         # Allow the FTP admin to manually add/remove bans
         BanControlsACLs         all allow user root,hpprgaaj,proftpd

         # If the same client reaches the MaxLoginAttempts limit 10 times
         # within 1 minutes, automatically add a ban for that client that
         # will expire after two hours.

         BanOnEvent MaxLoginAttempts 2/00:05:00 01:00:00 "You are banned 
out for 1 hour"
         BanOnEvent ClientConnectRate 10/00:01:00 02:00:00 "Stop 
connecting frequently"
         BanOnEvent RootLogin 1/00:01:00 02:00:00 "Stop connecting with 
root"
         BanOnEvent mod_auth.root-login 1/00:01:00 02:00:00 "Stop 
connecting with root"

         # Allow the FTP admin to manually add/remove bans
         BanControlsACLs         all allow user root,hpprgaaj,proftpd

|

|</IfModule>|

|The module mod_ifsession.c is loaded a DSO-module :
|

|LoadModule mod_sql.c
LoadModule                      mod_sql_sqlite.c
LoadModule                      mod_sftp.c
LoadModule                      mod_auth_otp.c
LoadModule                      mod_ctrls_admin.c
LoadModule                      mod_quotatab.c
LoadModule                      mod_quotatab_file.c
LoadModule                      mod_ban.c
LoadModule                      mod_ifsession.c
|

|But it turned that these Classes doesn't work out:|

|1) SFTP/SCP file transfers from 192.168.101.165 are still banned when 
executed more than 10 times a minute. So it seems that the BanEngine is 
always on.

2) Even SFTP/SCP sessions initiated on the dropserver itself 
(10.65.140.15: so not whitelisted) are banned when the frequency is 
higher than 10 times/min.|

|3) And it seems that the FTP-sessions are not banned at all: when the 
SFTP-connection from |||10.65.140.15 is banned, I am still able to 
connect to the FTP-virtual host.||

||Questions:||

||1) did I have mis-configured the BAN-module and the IfSession modules 
with the IfClass directives ?||

||2) Am I wrong asumming that the same BAN-module should function for 
the SFTP *and* FTP Virtual Hosts ?||

||See the attachment for the ProFTPD configure file and the proftpd -V 
output.||

||Thanks in advance,||

||With regards,||

||Pieter de Gaaij
||

|
|

_______________________________________________
ProFTPD Users List   <[email protected]>
Unsubscribe problems?
http://www.proftpd.org/list-unsub.html
proftpd_config.txt (text/plain, 26.1 KB) 
#========================================================================================
# ProFTPD Configuratiebestand
#
#=========================================================================================

ServerName                      "Test FTP en SFTP server"
ServerType                      standalone
DefaultServer                   off
ServerIdent                     on "Test FTP en SFTP server"
#Listen only on needed interfaces
SocketBindTight                 on
#DefaultAddress                 xx.xx.xx.xx
Port                            0

MaxInstances                    30
UseIPv6                         off
IdentLookups                    on
UseReverseDNS                   off
UseSendfile                     off
#SetEnv TZ UTC-2

MaxLoginAttempts                1

LoadModule                      mod_sql.c
LoadModule                      mod_sql_sqlite.c
LoadModule                      mod_sftp.c
LoadModule                      mod_auth_otp.c
LoadModule                      mod_ctrls_admin.c
LoadModule                      mod_quotatab.c
LoadModule                      mod_quotatab_file.c
LoadModule                      mod_ban.c
LoadModule                      mod_ifsession.c


<IfModule mod_ctrls.c>
        ControlsEngine        on
        ControlsACLs          all allow user root
        ControlsMaxClients    2
        ControlsLog           <base-dir>/proftpd/log/proftpd_controls.log
        ControlsInterval      5
        ControlsSocket        <base-dir>/proftpd/var/ctrls.sock
        ControlsSocketOwner   root root
        ControlsSocketACL     allow user root,proftpd

        <IfModule mod_ctrls_admin.c>
                AdminControlsACLs all allow user root,proftpd
        </IfModule>
</IfModule>

<IfModule mod_delay.c>
        DelayEngine             on
        DelayTable              <base-dir>/proftpd/etc/delay_table.dat
</IfModule>

<IfModule mod_lang.c>
        # Set the default to be English
        LangEngine      off
        LangDefault     en_US
        LangPath        /usr/local/share/locale/
</IfModule>

<Class whitelist>
        From 192.168.101.165
</Class>

<IfModule mod_ban.c>
        #BanEngine               on

        <IfClass whitelist>
              # Make sure the mod_ban module is on for clients that are not whitelisted
              BanEngine off
        </IfClass>

        <IfClass !whitelist>
              # Turn the mod_ban module off for whitelisted clients
              BanEngine on
        </IfClass>

        BanLog                  <base-dir>/proftpd/log/proftpd_ban.log
        BanTable                <base-dir>/proftpd/etc/proftpd_ban.tab

        # Allow the FTP admin to manually add/remove bans
        BanControlsACLs         all allow user root,proftpd

        # If the same client reaches the MaxLoginAttempts limit 10 times
        # within 1 minutes, automatically add a ban for that client that
        # will expire after two hours.

        BanOnEvent MaxLoginAttempts 2/00:05:00 01:00:00 "You are banned out for 1 hour"
        BanOnEvent ClientConnectRate 10/00:01:00 02:00:00 "Stop connecting frequently"
        BanOnEvent RootLogin 1/00:01:00 02:00:00 "Stop connecting with root"
        BanOnEvent mod_auth.root-login 1/00:01:00 02:00:00 "Stop connecting with root"

        # Allow the FTP admin to manually add/remove bans
        BanControlsACLs         all allow user root,proftpd

</IfModule>

<Global>
        DeferWelcome            on

        AllowOverwrite          on

        Umask                   0002
        User                    proftpd
        Group                   proftpd
        TimeoutLogin            180
        TimeoutIdle             300
        TimeoutNoTransfer       300
        TimeoutStalled          300
        UseSendfile             off
        TimesGMT                off
#       DisplayConnect          /etc/issue
#       DisplayLogin            <base-dir>/proftpd/var/display_login

        UseLastLog                      on

        <IfModule mod_quotatab.c>
                QuotaEngine             on
                QuotaLog                <base-dir>/proftpd/log/proftpd_quota.log

                # For more information on using files for storing the limit and tally
                # table quota data, please see the mod_quotatab_file documentation:
                #
                #   http://www.castaglia.org/proftpd/modules/mod_quotatab_file.html
                #
                <IfModule mod_quotatab_file.c>
                        QuotaLimitTable file:<base-dir>/proftpd/etc/ftpquota.limittab
                        QuotaTallyTable file:<base-dir>/proftpd/etc/ftpquota.tallytab
                </IfModule>

                #QuotaDefault           user false hard 2126512128 0 0 2 0 0
                QuotaDirectoryTally     off
                QuotaDisplayUnits       "Kb"
                QuotaExcludeFilter      ~/log/xfer.log
                QuotaLock               <base-dir>/proftpd/var/ftpquota.lock
                QuotaOptions            ScanOnLogin
                QuotaShowQuotas         on

        </IfModule>

        # Disable statcaching, for now
        #FSCachePolicy off

</Global>

TransferRate                    APPE,RETR,STOR,STOU 1048576:205824

LogFormat                       default "%h %U %u %t \"%r\" %s %m"
LogFormat                       auth "%h [%P:%p] %u [%{%a %b %d %T %Y}t] \"%r\" %s"
LogFormat                       all "%h [%P:%p] %u [%{%a %b %d %T %Y}t] \"%r\" %s %S %T"
LogFormat                       SFTP "%h [%P:%p] %u [%{%a %b %d %T %Y}t] \"%r\" %s %S %T"
LogFormat                       xfer "%{%d-%h-%Y %H:%M}t %u %h %F \"%r\" %T %b \"%s\" %{protocol}"
LogFormat                       trans "%{%a %b %d %H:%M:%S %Y}t %T %h [%P:%p] %b %f b _ %m r %u %{protocol} 0 * %S"
LogFormat                       eos "%a [%P:%p] %u [%{%a %b %d %T %Y}t] \"%r\" \"%S\" %s disconnect_reason=\"%E\""
LogFormat                       xfer2 "%{%a %h %d %H:%M:%S %Y}t %T %h %I \"%f\" r _ %m r %u %{protocol} 0 * \"%S\""

ExtendedLog                     <base-dir>/proftpd/log/proftpd_auth_gnl.log AUTH auth
ExtendedLog                     <base-dir>/proftpd/log/proftpd_all_gnl.log ALL all
ExtendedLog                     <base-dir>/proftpd/log/proftpd_exit_gnl.log EXIT eos

TransferLog                     <base-dir>/proftpd/log/proftpd_xfer_gnl.log
SystemLog                       <base-dir>/proftpd/log/proftpd_server_gnl.log
SyslogLevel                     info

ScoreboardFile                  <base-dir>/proftpd/var/proftpd_gnl.scoreboard

TraceLog                        <base-dir>/proftpd/log/proftpd_trace.log
#Trace                           DEFAULT:10 ssh2:20 sftp:20 scp:20

<Limit LOGIN>
        # Default: nobody may login
        DenyAll
</Limit>

#=========================================================================================

<VirtualHost xx.xx.xx.xx>

        # The Virtual Server for only FTP connections
        # -------------------------------------------

        # Port 21 is the standard FTP port.
        Port                            21

        ServerIdent                     on "ProFTPD Test Dropserver-FTP"
        ServerName                      "ProFTPD Test Dropserver-FTP"
        ServerAdmin                     [email protected]
        DeferWelcome                    off
        # When using a more than 1 line output from this file, a bug is come into effect:
        # the "dir" command output get corruped.
        #DisplayLogin                    proftpd_login_ftp.msg

        UseSendfile                     off
        #SetEnv TZ UTC-2

        MaxClients                      20

        # Umask 022 is a good standard umask to prevent new dirs and files
        # from being group and world writable.
        Umask                           0002

        TimeoutSession                  3600
        TimeoutLogin                    120
        TimeoutIdle                     300
        TimeoutNoTransfer               300
        TimeoutStalled                  300
        TimeoutLinger                   30

        MaxLoginAttempts                3
        RequireValidShell               on
        DefaultRoot                     ~
        AllowOverwrite                  on
        AllowOverride                   off  # Disables lookup/processing of .ftpaccess

        ExtendedLog                     <base-dir>/proftpd/log/proftpd_auth_ftp.log AUTH auth
        ExtendedLog                     <base-dir>/proftpd/log/proftpd_all_ftp.log ALL all
        ExtendedLog                     <base-dir>/proftpd/var/proftpd_all2_ftp.fifo ALL SFTP   # FIFO File for disk-quota messages
        ExtendedLog                     <base-dir>/proftpd/log/proftpd_exit_ftp.log EXIT eos
        ExtendedLog                     <base-dir>/proftpd/log/proftpd_xfer2_ftp.log READ,WRITE trans
        TransferLog                     <base-dir>/proftpd/var/proftpd_xfer_ftp.fifo    # FIFO File for private xfer.log messages
        ServerLog                       <base-dir>/proftpd/log/proftpd_server_ftp.log
        SyslogLevel                     info
        UseLastLog                      on

        DirFakeUser                     on ~
        DirFakeGroup                    on ~

        <IfModule mod_auth_otp.c>
                AuthOTPEngine           off     # Put OTP offline

                # Use time-based codes (TOTP)
                AuthOTPAlgorithm        totp
                AuthOTPLog              <base-dir>/proftpd/log/proftpd_auth_otp.log
                AuthOTPOptions          DisplayVerificationCode
                AuthOTPTable            sql:/get-user-totp/update-user-totp
                AuthOTPTableLock        <base-dir>/proftpd/var/auth_opt.lck
        </IfModule>

        <IfModule mod_sql.c>
                SQLEngine               off
                SQLBackEnd              SQLite3
                SQLConnectInfo          <base-dir>/proftpd/db/users.db
                SQLLogFile              <base-dir>/proftpd/log/proftpd_sql.log

                # Notice that for time-based counters, we do not need to retrieve
                # the auth_otp.counter column; the counter value is determined from the
                # system clock.
                SQLNamedQuery get-user-totp SELECT "secret FROM auth_otp WHERE user = \'%{0}\'"
                SQLNamedQuery update-user-totp UPDATE "counter = %{1} WHERE user = \'%{0}\'" auth_otp
        </IfModule>

        #AuthOrder                       mod_auth_otp.c mod_auth_file.c
        AuthOrder                       mod_auth_file.c

        AuthUserFile                    <base-dir>/proftpd/etc/passwd
        AuthGroupFile                   <base-dir>/proftpd/etc/group

        #-------------------------------------------------------------------
        # Special transfer type of logging setup for user "hdp_vlimpers". So that
        # this user can check his own transfer log in his "log" sub-directory.
        #-------------------------------------------------------------------

        <IfGroup owndel>
                # Sets the file permissions to rw-r--r--
                Umask                   022 007
        </IfGroup>
        <IfGroup !owndel>
                # Sets the file permissions to rw-rw-r--
                Umask                   002
        </IfGroup>

        # Security definitions for all ProFTP-users
        <Directory ~/>
                # This is valid for the dir itself and all its contents recursively.
                HideNoAccess            on

                # Hide directories that the user can NOT access due to permissions.
                HideFiles               "^(usr|dev|lib|etc|bin|passwd|group)$"


                # DIRS --> Iedereen kan wel in zijn dirs komen, maar niet schrijven.
                <Limit CDUP CWD LIST MDTM MLSD MLST NLST PWD RNFR STAT XCUP XCWD XPWD>
                                        AllowAll
                </Limit>

                # READ --> Alleen ownwrt and readgrp mogen downloaden & size opvragen.
                <Limit RETR SIZE>
                        DenyAll
                        AllowGroup      OR ownwrt,readgrp
                </Limit>

                # WRITE --> Alleen ownwrt and writegrp mogen uploaden & directories aanmaken.
                <Limit APPE DELE MKD RMD RNTO STOR STOU XMKD XRMD>
                        # Allow users belonging to group "ownwrt" to put files in their home directory.
                        # This is a secondary group for the user.
                        DenyAll
                        AllowGroup      ownwrt
                        IgnoreHidden    on
                </Limit>

                #Opladen van files en creatie sub-dirs --> voorbehouden aan ownwrt en writegrp
                <Limit STOR SITE_CHMOD MKD XMKD>
                        AllowUser       ddcinp
                        AllowGroup      OR writegrp,ownwrt
                        DenyGroup       readgrp
                </Limit>

                # Deleten van files --> voorbehouden aan ownwrt en delgrp
                <Limit DELE RMD XRMD>
                        AllowUser       ddcout
                        DenyUser        ddcinp
                        AllowGroup      OR ownwrt,delgrp
                        DenyGroup       OR readgrp,nodelgrp
                </Limit>

                # Renamen van files - voorbehouden aan ownwrt en writegrp
                <Limit RNFR RNTO>
                        DenyGroup       OR readgrp,nodelgrp
                        AllowGroup      OR ownwrt,writegrp
                </Limit>

        </Directory>

        #-------------------------------------------------------------------


</VirtualHost>

#=========================================================================================


<IfModule mod_sftp.c>
        <VirtualHost xx.xx.xx.xx>

                # The Virtual Server for only SFTP and SCP connections
                # ----------------------------------------------------

                # Configure the server to listen on the normal SSH2 port, port 22
                Port                            22
                SFTPEngine                      on

                ServerIdent                     on "ProFTPD RHEL Test Dropserver-SFTP"
                ServerName                      "ProFTPD RHEL Test Dropserver-SFTP"
                ServerAdmin                     <email-address>
                DeferWelcome                    on
                UseSendfile                     off
                AllowOverride                   off  # Disables lookup/processing of .ftpaccess

                <IfModule mod_auth_pam.c>
                        AuthPAM                 off
                </IfModule>

                #SFTPDisplayBanner              <base-dir>/proftpd/etc/ProFTP_banner

                #SetEnv TZ UTC-2

                Umask                           002

                #SFTPDisplayBanner              <base-dir>/proftpd/etc/ProFTP_banner

                TimeoutSession                  3600
                TimeoutLogin                    120
                TimeoutIdle                     300
                TimeoutNoTransfer               300
                TimeoutStalled                  300
                TimeoutLinger                   30

                # Default Values
                # channelPacketSize 32KB channelWindowSize 4GB sftpProtocolVersion 1-6
                #SFTPClientMatch WinSCP|ClientSftp sftpProtocolVersion 1-3

                SFTPClientMatch ".*ClientSftp" sftpProtocolVersion 3  #CuteFTPPro8
                SFTPClientMatch ".*WinSCP.*" sftpProtocolVersion 3    #upload/download fix for WinSCP

                # General fixes from the mod_sftp forum
                SFTPClientMatch ".*WS_FTP.*" channelWindowSize 1GB    #WS_FTP initial window size

                # SecureBlackbox (SSH-2.0-SecureBlackbox.7)
                # http://www.eldos.com/sbb/download-release.php
                SFTPClientMatch ".*SecureBlackbox.*" sftpProtocolVersion 3

                # JaSFtp (SSH-2.0-J2SSH_Maverick_1.2.10_Sterling Commerce)
                # http://www.hiteksoftware.com/jasf/
                SFTPClientMatch ".*J2SSH_Maverick.*" channelWindowSize 1GB

                # Robo-FTP (SSH-2.0-WeOnlyDo)
                # http://www.robo-ftp.com/
                SFTPClientMatch ".*WeOnlyDo.*" sftpProtocolVersion 3 channelWindowSize 1GB
                # Network Automation (SSH-2.0-EldoS.SSHBlackbox.3)
                # http://www.networkautomation.com/
                SFTPClientMatch ".*EldoS.SSHBlackbox.3.*" sftpProtocolVersion 3 channelWindowSize 1GB

                # Software BizTalk SFTP Receive (SSH-2.0-IP*Works! SSH Client v8.0)
                # http://www.nsoftware.com/products/biztalk/adapters/sftp.aspx
                SFTPClientMatch ".*IP.Works.*" channelWindowSize 1GB

                # JSch - Java Secure Channel (SSH-2.0-JSCH-0.1.39)
                # http://www.jcraft.com/jsch/
                SFTPClientMatch "JSCH.*" channelWindowSize 1GB

                # SecureFX - SSH2 client 'SecureFX_2_2_5_225 SecureFX'
                # http://www.vandyke.com/products/securefx/
                SFTPClientMatch "SecureFX.*" sftpProtocolVersion 3

                # GlobalScape FTP application (SSH2 client 'GSSFTP1.0') - (needs v2)
                # http://www.globalscape.com/downloads/

                # GoAnywhere (SSH-2.0-1.0)
                # http://www.goanywheremft.com/products/
                SFTPClientMatch "1.0" sftpProtocolVersion 2 channelWindowSize 1GB

                # CoreFTP LE (free version 2.2)  can not support normal channel 4GB.
                SFTPClientMatch CoreFTP channelWindowSize 1GB

                # SSH-2.0-Sun_SSH_1.0.1
                SFTPClientMatch ".*Sun_SSH.*" channelWindowSize 1GB

                # SSH-2.0-SharpSSH-1.1.1.13-JSCH-0.1.28
                SFTPClientMatch ".*SharpSSH.*" channelWindowSize 256MB

                # SSH-2.0-1.30
                SFTPClientMatch "1.30" channelWindowSize 256MB channelPacketSize 16KB

                # Software Axway Suite Receive (SSH2 client 'XFB.Gateway Windows') Version 6.13
                # Vo-Client Customer: AGINSURANCE
                SFTPClientMatch ".*XFB.*" channelWindowSize 10MB

                <IfModule mod_auth_pam.c>
                        AuthPAM                 off
                </IfModule>

                # Configure both the RSA and DSA host keys, using the same host key
                # files that OpenSSH uses.
                SFTPHostKey                     <base-dir>/proftpd/etc/ssh_host_dsa_key
                SFTPHostKey                     <base-dir>/proftpd/etc/ssh_host_rsa_key

                # Configure the file used for comparing authorized public keys of users.
                SFTPAuthMethods                 password publickey
                SFTPAuthorizedUserKeys          file:<base-dir>/proftpd/authorized_keys/%u

                # Enable compression
                SFTPCompression                 delayed
                SFTPOptions                     NoExtensionNegotiation IgnoreSFTPUploadPerms IgnoreSCPUploadPerms IgnoreSFTPSetOwners IgnoreSFTPSetPerms #AllowWeakDH
                FSOptions                       IgnoreExtendedAttributes
                SFTPKeyLimits                   MinimumECSize 0 MinimumDSASize 0 MinimumRSASize 0
                SFTPKeyBlacklist                <base-dir>/proftpd/etc/blacklist.dat
                SFTPDHParamFile                 <base-dir>/proftpd/etc/dhparams.pem

                # Allow the same number of authentication attempts as OpenSSH.
                # It is recommended that you explicitly configure MaxLoginAttempts
                # for your SSH2/SFTP instance to be higher than the normal
                # MaxLoginAttempts value for FTP, as there are more ways to authenticate
                # using SSH2.

                MaxLoginAttempts                4
                RequireValidShell               on
                AllowOverwrite                  on

                DefaultRoot                     ~

                SFTPLog                         <base-dir>/proftpd/log/proftpd_sftp.log
                ExtendedLog                     <base-dir>/proftpd/log/proftpd_auth_sftp.log AUTH auth
                ExtendedLog                     <base-dir>/proftpd/log/proftpd_all_sftp.log ALL all
                ExtendedLog                     <base-dir>/proftpd/var/proftpd_all2_sftp.fifo ALL SFTP          # FIFO file for dik-quota messages
                ExtendedLog                     <base-dir>/proftpd/log/proftpd_exit_sftp.log EXIT eos
                ExtendedLog                     <base-dir>/proftpd/log/proftpd_xfer2_sftp.log READ,WRITE trans
                ExtendedLog                     <base-dir>/proftpd/var/ddcphp_extralog.fifo READ,WRITE xfer2    # FIFO file for specific DDC/DWH unzipping uploaded files.
                TransferLog                     <base-dir>/proftpd/var/proftpd_xfer_sftp.fifo                   # FIFO file for private xfer.log messages

                ServerLog                       <base-dir>/proftpd/log/proftpd_server_sftp.log
                SyslogLevel                     info

                UseLastLog                      on

                AuthUserFile                    <base-dir>/proftpd/etc/passwd
                AuthGroupFile                   <base-dir>/proftpd/etc/group

                <IfModule mod_auth_otp.c>
                        AuthOTPEngine           off     # OTP is put offline

                        # Use time-based codes (TOTP)
                        AuthOTPAlgorithm        totp
                        AuthOTPLog              <base-dir>/proftpd/log/proftpd_auth_otp.log
                        AuthOTPOptions          DisplayVerificationCode
                        AuthOTPTable            sql:/get-user-totp/update-user-totp
                        AuthOTPTableLock        <base-dir>/proftpd/var/auth_opt.lck

                        AuthOrder               mod_auth_file.c mod_auth_otp.c
                </IfModule>

                <IfModule mod_sql.c>
                        SQLEngine               off     # SQLengine is put offline
                        SQLBackEnd              SQLite3
                        SQLConnectInfo          <base-dir>/proftpd/db/users.db
                        SQLLogFile              <base-dir>/proftpd/log/proftpd_sql.log

                        # Notice that for time-based counters, we do not need to retrieve
                        # the auth_otp.counter column; the counter value is determined from the
                        # system clock.
                        SQLNamedQuery get-user-totp SELECT "secret FROM auth_otp WHERE user = \'%{0}\'"
                        SQLNamedQuery update-user-totp UPDATE "counter = %{1} WHERE user = \'%{0}\'" auth_otp
                </IfModule>

                <IfGroup owndel>
                        # Sets the file permissions to rw-r--r--
                        Umask                   022 007
                </IfGroup>
                <IfGroup !owndel>
                        # Sets the file permissions to rw-rw-r--
                        Umask                   002
                </IfGroup>

                #---------------------------------------------------------------

                # Security definitions for all ProFTP-users

                <Directory ~/>
                        # This is valid for the dir itself and all its contents recursively.
                        HideNoAccess            on

                        # Hide directories that the user can NOT access due to permissions.
                        HideFiles               "^(usr|dev|lib|etc|bin|passwd|group)$"


                        # DIRS --> Iedereen kan wel in zijn dirs komen, maar niet schrijven.
                        <Limit CDUP CWD LIST MDTM MLSD MLST NLST PWD RNFR STAT XCUP XCWD XPWD>
                                                AllowAll
                        </Limit>

                        # READ --> Alleen ownwrt and readgrp mogen downloaden & size opvragen.
                        <Limit RETR SIZE>
                                DenyAll
                                AllowGroup      OR ownwrt,readgrp
                        </Limit>

                        # WRITE --> Alleen ownwrt and writegrp mogen uploaden & directories aanmaken.
                        <Limit APPE DELE MKD RMD RNTO STOR STOU XMKD XRMD>
                                # Allow users belonging to group "ownwrt" to put files in their home directory.
                                # This is a secondary group for the user.
                                DenyAll
                                AllowGroup      ownwrt
                                IgnoreHidden    on
                        </Limit>

                        #Opladen van files en creatie sub-dirs --> voorbehouden aan ownwrt en writegrp
                        <Limit STOR SITE_CHMOD MKD XMKD>
                                AllowUser       ddcinp
                                AllowGroup      OR writegrp,ownwrt
                                DenyGroup       readgrp
                        </Limit>

                        # Deleten van files --> voorbehouden aan ownwrt en delgrp
                        <Limit DELE RMD XRMD>
                                AllowUser       ddcout
                                DenyUser        ddcinp
                                AllowGroup      OR ownwrt,delgrp
                                DenyGroup       OR readgrp,nodelgrp
                        </Limit>

                        # Renamen van files - voorbehouden aan ownwrt en writegrp
                        <Limit RNFR RNTO>
                                DenyGroup       OR readgrp,nodelgrp
                                AllowGroup      OR ownwrt,writegrp
                        </Limit>

                </Directory>

                #-------------------------------------------------------------------

        </VirtualHost>

</IfModule>
proftpd-v137rc4-V.txt (text/plain, 2.4 KB) 
proftpd -V
Compile-time Settings:
  Version: 1.3.7rc4 (git)
  Platform: LINUX [Linux 3.10.0-862.11.6.el7.x86_64 x86_64]
  Built: Tue Apr 21 2020 23:12:50 CEST
  Built With:
    configure  '--disable-sendfile' '--localstatedir=/var/run' '--enable-ctrls' '--enable-openssl' '--enable-quotatab' '--enable-nls' '--enable-dso' '--with-lastlog=/export/org/proftpd/var/lastlog' '--with-modules=mod_readme:mod_ident' '--with-shared=mod_sql:mod_sql_sqlite:mod_sftp:mod_tls:mod_auth_otp:mod_ctrls_admin:mod_quotatab:mod_quotatab_file:mod_ban:mod_ifsession' '--prefix=/usr/local'

  CFLAGS: -g2 -O2 -Wall -fno-omit-frame-pointer -Werror=implicit-function-declaration
  LDFLAGS: -L$(top_srcdir)/lib -L$(top_builddir)/lib  -rdynamic
  LIBS:  -lssl -lcrypto -lsupp -lnsl -lresolv -lresolv -lcrypt -ldl

  Files:
    Configuration File:
      /usr/local/etc/proftpd.conf
    Pid File:
      /var/run/proftpd.pid
    Scoreboard File:
      /var/run/proftpd.scoreboard
    Header Directory:
      /usr/local/include/proftpd
    Shared Module Directory:
      /usr/local/libexec

  Info:
    + Max supported UID: 4294967295
    + Max supported GID: 4294967295

  Features:
    - Autoshadow support
    + Controls support
    + curses support
    - Developer support
    + DSO support
    + IPv6 support
    + Largefile support
    + Lastlog support
    - Memcache support
    + ncursesw support
    + NLS support
    + OpenSSL support (OpenSSL 1.0.2k  26 Jan 2017, FIPS enabled)
    - PCRE support
    - POSIX ACL support
    - Redis support
    + Shadow file support
    - Sendfile support
    - Sodium support
    + Trace support
    + xattr support

  Tunable Options:
    PR_TUNABLE_BUFFER_SIZE = 1024
    PR_TUNABLE_DEFAULT_RCVBUFSZ = 8192
    PR_TUNABLE_DEFAULT_SNDBUFSZ = 8192
    PR_TUNABLE_ENV_MAX = 2048
    PR_TUNABLE_GLOBBING_MAX_MATCHES = 100000
    PR_TUNABLE_GLOBBING_MAX_RECURSION = 8
    PR_TUNABLE_HASH_TABLE_SIZE = 40
    PR_TUNABLE_LOGIN_MAX = 256
    PR_TUNABLE_NEW_POOL_SIZE = 512
    PR_TUNABLE_PATH_MAX = 4096
    PR_TUNABLE_SCOREBOARD_BUFFER_SIZE = 80
    PR_TUNABLE_SCOREBOARD_SCRUB_TIMER = 30
    PR_TUNABLE_SELECT_TIMEOUT = 30
    PR_TUNABLE_TIMEOUTIDENT = 10
    PR_TUNABLE_TIMEOUTIDLE = 600
    PR_TUNABLE_TIMEOUTLINGER = 10
    PR_TUNABLE_TIMEOUTLOGIN = 300
    PR_TUNABLE_TIMEOUTNOXFER = 300
    PR_TUNABLE_TIMEOUTSTALLED = 3600
    PR_TUNABLE_XFER_SCOREBOARD_UPDATES = 10
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.