Proftpd - Limit FTP Access To Home Directory

**Pleiades** · 06-22-2006, 05:29 AM

I have set up Proftpd using a fairly basic proftpd.conf file, on a Slackware 10 box (not sure of full details, I didn't build it). I have a user that will ftp in either over teh net or from the LAN, and I want to limit that user to their home directory and sub-directories of their home directory (ie - they can't "cd ../" up the directory tree, etc). The user will need to write to their home directory, as well as pull stuff out of it when offsite.

Is there a way to get Proftpd to do this, or is there some sort of permissions deal I need to set up with this user?

Here is /etc/proftpd.conf. I am going to kill the anonymous section, just in case you were wondering.

# This is a basic ProFTPD configuration file.
# It establishes a single server and a single anonymous login.
# It assumes that you have a user/group "nobody" and "ftp"
# for normal/anonymous operation.

ServerName "ProFTPD Default Installation"
#ServerType standalone
ServerType inetd
DefaultServer on

# Port 21 is the standard FTP port.
Port 21
# Umask 022 is a good standard umask to prevent new dirs and files
# from being group and world writable.
Umask 022

# To prevent DoS attacks, set the maximum number of child processes
# to 30. If you need to allow more than 30 concurrent connections
# at once, simply increase this value. Note that this ONLY works
# in standalone mode, in inetd mode you should use an inetd server
# that allows you to limit maximum number of processes per service
# (such as xinetd)
MaxInstances 30

# Set the user and group that the server normally runs at.
User nobody
Group nogroup

# This next option is required for NIS or NIS+ to work properly:
#PersistentPasswd off

SystemLog /var/log/proftpd.log
TransferLog /var/log/xferlog

# Normally, we want files to be overwriteable.
<Directory /*>
AllowOverwrite on
</Directory>

# A basic anonymous FTP server configuration.
# To enable this, remove the user ftp from /etc/ftpusers.
<Anonymous ~ftp>
RequireValidShell off
User ftp
Group ftp
# We want clients to be able to login with "anonymous" as well as "ftp"
UserAlias anonymous ftp

# Limit the maximum number of anonymous logins
MaxClients 50

# We want 'welcome.msg' displayed at login, and '.message' displayed
# in each newly chdired directory.
DisplayLogin welcome.msg
DisplayFirstChdir .message

# Limit WRITE everywhere in the anonymous chroot
<Limit WRITE>
DenyAll
</Limit>

**Compunuts** · 06-22-2006, 08:24 AM

This ProFTP guide is for Debian but it should be similar to every distro as long as you follow some basic steps. This should show you how to configure your ProFTP to have users only being able to see its home dirs.

HTH ...