Re: [Proftpd-user] running proftp under non-privileged user

Of course I forgot:

- SFTPHostKey must be readable by unauthorized user as well.

So, it has to be owned by the running user, or at readable it we relax the 
permission check:

SFTPOptions InsecureHostKeyPerms
SFTPHostKey /etc/proftpd/ssh_host_rsa_key

It works although complains in log as well:

Mar 20 15:54:37 server proftpd[175306]: Checking syntax of configuration file
Mar 20 15:54:37 server proftpd[175306]: 2026-03-20 15:54:37,411 server proftpd[175306]: mod_sftp/1.1.1: unable to use '/etc/proftpd/ssh_host_rsa_key' as host key, as it is group- or world-accessible
Mar 20 15:54:37 server proftpd[175308]: 2026-03-20 15:54:37,433 server proftpd[175308]: mod_sftp/1.1.1: unable to use '/etc/proftpd/ssh_host_rsa_key' as host key, as it is group- or world-accessible
Mar 20 15:54:37 server systemd[1]: Started proftpd.service - ProFTPD FTP Server.

Perhaps we could have "RelaxedHostKeyPerms" option?


On 20.03.26 16:33, Matus UHLAR - fantomas wrote:
>It did help, I'd like to add a few points:
>
>- mod_vroot can be used to simulate chroot when not running proftpd as root
>  You can enable is using:
>
>  LoadModule mod_vroot.c
>  VRootEngine on
>  and by using DefaultRoot directive.
>
>Link: http://www.castaglia.org/proftpd/modules/mod_vroot.html
>(btw: why can't I find this module in proftpd.org?)
>
>
>- init/rc script or systemd unit can be modified to execute proftpd 
>under   given user instead of (or in affition to) using User and Group 
>directives
>  (works here)
>
>- having log directory (e.g. /var/log/proftpd) and run directory (e.g.    
>/run/proftpd) writable by proftpd makes it easier to fullfill writable   
>requirements for:
>
>  PidFile
>  ScoreboardFile
>  DelayTable   TransferLog   SystemLog
>  ServerLog
>  SFTPLog
>
>  and others.
>- logrotate script should be changed to create log file(s) as configured user
>  ...or not create the file and let proftpd do that
>
>- systemd unit must be configured to use pid file configured above
>
>- use:
>
>  AuthOrder       mod_auth_file.c*
>
>  to skip system authentication
>  (not sure if the * is required, but shouldn't hurt)
>
>
>- In case of using virtual hosts, many of directives should be either   
>repeated in <VirtualHost> or placed into <Global> secion, because
>  of how Proftpd's virtual hosts work.
>
>  This applies to directives mentioned above or in referenced document
>  http://www.proftpd.org/docs/howto/Nonroot.html
>
>  SystemLog
>  WtmpLog
>  TransferLog
>  AuthUserFile
>  AuthGroupFile
>  AuthPAM
>  AuthOrder
>  VRootEngine
>  DefaultRoot
>     ...and all other directives applicable in <VirtualHost> anf 
><Global>   context.

-- 
Matus UHLAR - fantomas, [email protected] ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
Atheism is a non-prophet organization.


_______________________________________________
ProFTPD Users List   <[email protected]>
Unsubscribe problems?
http://www.proftpd.org/list-unsub.html