Re: [Proftpd-user] running proftp under non-privileged user

>> Did anyone try to run ProFTPD completely under pon-privileged user?
>>
>> I guess It would need:
>>
>> - changing init script/systemd unit
>>    (directive User doesn't prevent from being able to setuid() etc)
>> - using mod_vroot
>>
>> - listen on port>1024
>> - non-system user database (I guess even for single anonymous user)
>> - setting paths/permissions for log, lock, pid files
>>
>> Does it need any changes more than that?
>> Does it work?

On 13.03.26 09:24, TJ Saunders wrote:
>It can be done, yes -- depending on the desired configuration, of course.  
> This might help:
>
>  http://www.proftpd.org/docs/howto/Nonroot.html

It did help, I'd like to add a few points:

- mod_vroot can be used to simulate chroot when not running proftpd as root
   You can enable is using:

   LoadModule mod_vroot.c
   VRootEngine on
   
   and by using DefaultRoot directive.

Link: http://www.castaglia.org/proftpd/modules/mod_vroot.html
(btw: why can't I find this module in proftpd.org?)


- init/rc script or systemd unit can be modified to execute proftpd under 
   given user instead of (or in affition to) using User and Group directives
   (works here)

- having log directory (e.g. /var/log/proftpd) and run directory (e.g.  
   /run/proftpd) writable by proftpd makes it easier to fullfill writable 
   requirements for:

   PidFile
   ScoreboardFile
   DelayTable 
   TransferLog 
   SystemLog
   ServerLog
   SFTPLog

   and others.
   
- logrotate script should be changed to create log file(s) as configured user
   ...or not create the file and let proftpd do that

- systemd unit must be configured to use pid file configured above

- use:

   AuthOrder       mod_auth_file.c*

   to skip system authentication
   (not sure if the * is required, but shouldn't hurt)


- In case of using virtual hosts, many of directives should be either 
   repeated in <VirtualHost> or placed into <Global> secion, because
   of how Proftpd's virtual hosts work.

   This applies to directives mentioned above or in referenced document
   http://www.proftpd.org/docs/howto/Nonroot.html

   SystemLog
   WtmpLog
   TransferLog
   AuthUserFile
   AuthGroupFile
   AuthPAM
   AuthOrder
   VRootEngine
   DefaultRoot
   
   ...and all other directives applicable in <VirtualHost> anf <Global> 
   context.

-- 
Matus UHLAR - fantomas, [email protected] ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
I drive way too fast to worry about cholesterol.


_______________________________________________
ProFTPD Users List   <[email protected]>
Unsubscribe problems?
http://www.proftpd.org/list-unsub.html