Securing the FTP Server

By default all users in the system can login authenticated by the system and placed automatically in their home directory. Each user can be jailed in its own home directory or a specified directory.
It is highly recommended to jail user accounts, especially when you are serving virtual hosting. The file responsible for the FTP server configuration is proftpd.conf and this is its content:

# This is a basic ProFTPD configuration file (rename it to 
# 'proftpd.conf' for actual use.  It establishes a single server
# and a single anonymous login.  It assumes that you have a user/group
# "nobody" and "ftp" for normal operation and anon.

ServerName			"ProFTPD Default Installation"
ServerType			standalone
DefaultServer			on

# Allow FTP resuming.
# Remember to set to off if you have an incoming ftp for upload.

AllowStoreRestart		on

# Port 21 is the standard FTP port.

Port				21

# Umask 022 is a good standard umask to prevent new dirs and files
# from being group and world writable.

Umask				022

# To prevent DoS attacks, set the maximum number of child processes
# to 30.  If you need to allow more than 30 concurrent connections
# at once, simply increase this value.  Note that this ONLY works
# in standalone mode, in inetd mode you should use an inetd server
# that allows you to limit maximum number of processes per service
# (such as xinetd)

MaxInstances			30

# Set the user and group that the server normally runs at.

User				nobody
Group				nogroup

# Normally, we want files to be overwriteable.

<Directory /*>
  AllowOverwrite		on
</Directory>

# Needed for NIS.

PersistentPasswd		off

# Default root can be used to put users in a chroot environment.
# As an example if you have a user foo and you want to put foo in #/home/foo chroot environment you would do this:
# 
# DefaultRoot /home/foo foo

DefaultRoot /home/agustin/Documents agustin

Note. In the last line of this file, I just jailed my user account in my Documents folder.

If I change the last line to point to my web server's home directory I would do this, (I would replace):

DefaultRoot /home/agustin/Documents agustin

With:

DefaultRoot /var/www/html/ agustin

(Note: The directory html belongs to the host netcontrol.org)

For practice purposes, I now need to jail another user into /var/www/html/onetraining; the user jailed in this directory will be the system administrator for onetraining.net domain.

I would edit /etc/proftpd.conf and add the following line at the end:

DefaultRoot /var/www/html/onetraining admin2

Now if user (admin2) ftp's to onetraining.net he/she will be placed and jailed in /onetraining directory and will not be able to browse to an upper level. Note. Make sure that each user has the appropriate rights to the virtual hosting directory, even if they become the administrator, they may not need more than read, write and execute.

Restricting users and hosts

There will be certain users or certain hosts that you may prohibit from connecting to this server. You can edit this proftpd.conf file to set a limit to hosts or domains.

Open and insert the following information at any part of the script:

<Limit LOGIN>
Order Allow,Deny
Allow 168.34.26.60, mydomain.com, anotherdomain.net, 
Deny from all
</Limit>

Another file that controls access at user level is /etc/ftpusers, this file contains all users that are not allowed to connect to this server.

    root
    bin
    daemon
    adm
    lp
    sync
    shutdown
    halt
    mail
    news
    uucp
    operator
    games
    guest
    anonymous
    nobody