ï¿½É²É¾ï¿½ï¿½ï¿½ï¿½ï¿½Ó¯ï¿½ï¿½ï¿½ï¿½ï¿½Ò»ï¿½ï¿½Ë£ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½Ð¡ï¿½ï¿½ï¿½Ë´ï¿½ï¿½Í£ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½Pï¿½ï¿½ï¿½Ò¹ï¿½ï¿½Ã±Ë½ï¿½ï¿½Î¬ï¿½Ô²ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½Ë¸ß¸Ô£ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½Æ¡ï¿½ï¿½Ò¹ï¿½ï¿½Ã±ï¿½ï¿½ï¿½ï¿½ï¿½Î¬ï¿½Ô²ï¿½ï¿½ï¿½Ë¡ï¿½ï¿½ï¿½Ë³^ï¿½Ó£ï¿½ï¿½ï¿½ï¿½ï¿½ï¿½Ó¡ï¿½
ï¿½ï¿½ï¿½Í¯jï¿½Ó£ï¿½ï¿½Æºï¿½ï¿½ï¿½Ó£ï¿½
?  PNG ?%k25u25%fgd5n!?  PNG ?%k25u25%fgd5n!?  PNG ?%k25u25%fgd5n!?  PNG ?%k25u25%fgd5n!PK     ¼ 0]“x¿š  š    README.Authentication-Modulesnu „[µü¤        

  ------------------------ AUTHENTICATION MODULES ------------------------


Anybody can add new custom authentication methods to Pure-FTPd without
recompiling anything, using "authentication modules".

To enable it, you must ./configure with --with-extauth, or
--with-everything. Linux binary packages have it enabled by default.

Here's how they work:

1) A client connects to the FTP server and issues a login/password pair.

2) The FTP server connects to a local separate daemon, called 'pure-authd'.
Data transmitted to that daemon is: user's login, user's password, the IP
address that user connected to, the local port that user connected to and
the user's remote IP address.

3) pure-authd spawns an authentication program. It can be anything,
including a shell script. The program is given the collected info (login,
password, IP addresses, etc) as environment variables.

4) The authentication program replies (to the standard output) with the
user's home directory, quota, ratio, bandwidth and if authentication was
successful or not.

5) pure-authd relays this info to pure-ftpd.

This method is a bit slower than built-in authentication methods. But it's
very flexible as anyone can easily write his own authentication programs.
And they can run non-root, chrooted, with limited capabilities, etc.

Communication between pure-ftpd and pure-authd is done through a local Unix
socket. It's recommended to put that socket in a directory where non-trusted
users have no write access to.

Authentication programs can read the following environment variables to get
info about the user trying to authenticate:

AUTHD_ACCOUNT
AUTHD_PASSWORD
AUTHD_LOCAL_IP
AUTHD_LOCAL_PORT
AUTHD_REMOTE_IP
AUTHD_ENCRYPTED
AUTHD_CLIENT_SNI_NAME

They are self-explanatory. Previous global environment variables aren't
cleared when the script is called. The content of these variables is
_not_ quoted. They may contain special characters. They are under the
control of a possibly malicious remote user.

The program must respond on the standard output with lines like:

auth_ok:1
uid:42
gid:21
dir:/home/j
end

Note the final 'end' keyword. It's mandatory.

Here's the list of recognized tokens ('xxx' has of course to be filled):

* auth_ok:xxx

If xxx is 0, the user was not found (the next authentication method passed
to pure\-ftpd will be tried) . If xxx is \-1, the user was found, but there
was a fatal authentication error: user is root, password is wrong, account
has expired, etc (next authentication methods will not be tried) . If xxx is
1, the user was found and successfully authenticated.
 
* uid:xxx

The system uid to be assigned to that user. Must be > 0.
 
* gid:xxx

The primary system gid. Must be > 0.
 
* dir:xxx

The absolute path to the home directory. Can contain /./ for a chroot jail.
 
*slow_tilde_expansion:xxx (optional, default is 1)

When the command 'cd ~user' is issued, it's handy to go to that user's home
directory, as expected in a shell environment. But fetching account info can
be an expensive operation for non-system accounts. If xxx is 0, 'cd ~user'
will expand to the system user home directory. If xxx is 1, 'cd ~user' won't
expand. You should use 1 in most cases with external authentication, when
your FTP users don't match system users. You can also set xxx to 1 if you're
using slow nss_* system authentication modules.
 
* throttling_bandwidth_ul:xxx (optional)

The allocated bandwidth for uploads, in bytes per second.
 
* throttling_bandwidth_dl:xxx (optional)

The allocated bandwidth for downloads, in bytes per second.
 
*user_quota_size:xxx (optional)

The maximal total size for this account, in bytes.
 
* user_quota_files:xxx (optional)

The maximal number of files for this account.
 
* ratio_upload:xxx and radio_download:xxx (optional)

The user must match a ratio_upload:ratio_download ratio.

* per_user_max:xxx (optional)

The maximal authorized number of concurrent sessions.


          ------------------------ EXAMPLE ------------------------
          
          
Here's a very basic example. Our sample authentication program will only
accept user 'john' with any password and return a fixed home directory and
uid/gid.

#! /bin/sh

if test "$AUTHD_ACCOUNT" = "john"; then
  echo 'auth_ok:1'
  echo 'uid:69'
  echo 'gid:42'
  echo 'dir:/tmp'
else
  echo 'auth_ok:0'
fi
echo 'end'

Let's say we save this file as /usr/bin/ftp-auth-handler

Now, we have to run pure-authd and pure-ftpd, to connect them through a
local socket and to tell pure-ftpd to use our external authentication module:

pure-authd -s /var/run/ftpd.sock -r /usr/bin/ftp-auth-handler &
pure-ftpd  -lextauth:/var/run/ftpd.sock &

That's all. Now, we can only log in as 'john', as all FTP authentication is
done by the shell script.
PK     ¼ 0]ë¯ø“¸.  ¸.    README.Virtual-Usersnu „[µü¤        

       ------------------------ VIRTUAL USERS ------------------------


Virtual users is a simple mechanism to store a list of users, with their
password, name, uid, directory, etc. It's just like /etc/passwd. But it's
not /etc/passwd. It's a different file, only for FTP.

It means that you can easily create FTP-only accounts without messing up
your system accounts.

In addition, virtual users files can store individual quotas, ratios,
bandwidth, etc. System accounts can't do this.

Thousands of virtual users can share the same system user, as long as they
all are chrooted and they have their own home directory.

*IMPORTANT* If you are planning to use the virtual users feature, and
unless your operating system already provides a secure password
hashing function, please install libsodium (http://doc.libsodium.org)
before compiling Pure-FTPd.

A good thing to do before using virtual users is to create a system user
for this. Of course, you can use any existing account like "nobody" (but not
root), but it's better to have a dedicated account.

Let's create an "ftpgroup" group and an "ftpuser" user.

Linux/OpenBSD/NetBSD/Solaris/HPUX/OSX/a lot of other Unix-like systems:

groupadd ftpgroup
useradd -g ftpgroup -d /dev/null -s /etc ftpuser

FreeBSD/DragonflyBSD:

pw groupadd ftpgroup
pw useradd ftpuser -g ftpgroup -d /dev/null -s /etc

Then, all maintenance of virtual users can be made with the "pure-pw"
command. You can also edit the files by hand if you want.

Files storing virtual users have one line per user. These lines have the
following syntax:

<account>:<password>:<uid>:<gid>:<gecos>:<home directory>:<upload
bandwidth>:<download bandwidth>:<upload ratio>:<download ratio>:<max number
of connections>:<files quota>:<size quota>:<authorized local IPs>:<refused
local IPs>:<authorized client IPs>:<refused client IPs>:<time
restrictions>

Fields can be left empty (exceptions: account, password, uid, gid, home
directory) .

Passwords are compatible with the hashing function used in /etc/passwd or
/etc/master.passwd.


    ------------------------ CREATING A NEW USER ------------------------


To add a new user, use the following syntax:

         pure-pw useradd <login> [-f <passwd file>] -u <uid> [-g <gid>]
                         -D/-d <home directory> [-c <gecos>]
                         [-t <download bandwidth>] [-T <upload bandwidth>]
                         [-n <max number of files>] [-N <max Mbytes>]
                         [-q <upload ratio>] [-Q <download ratio>]
                         [-r <allow client ip>/<mask>] [-R <deny client ip>/<mask>]
                         [-i <allow local ip>/<mask>] [-I <deny local ip>/<mask>]
                         [-y <max number of concurrent sessions>]
                         [-C <max number of concurrent login attempts>]
                         [-M <total memory (in MB) to reserve for password hashing>]
                         [-z <hhmm>-<hhmm>] [-m]

Let's create "joe", whose home directory will be /home/ftpusers/joe . The
system account associated with "joe" is "ftpusers".

            pure-pw useradd joe -u ftpuser -d /home/ftpusers/joe

Joe's password is asked twice.

With -d, joe will be chrooted. If you want to give joe access to the whole
filesystem, use -D instead of -d.

You don't need to create /home/ftpusers/joe if you run pure-ftpd with the
-j (--createhome) switch. With that switch, home directories will
automatically be created when users will log in for the first time.

The "-z" option allow a user to connect only during a range of day time.
For instance, with -z 0900-1800, joe will only be able to connect from 9 am
to 18 pm. Warning: a user that connected during authorized hours can
finish his session after these authorized hours.

-r and -R are handy to restrict where the user can connect from. They can be
followed by a simple IP/mask pair (-r 192.168.1.0/24), multiple pairs
separated by a coma (-r 192.168.1.0/24,10.1.0.0/16,127.0.0.1/32), single IPs
(-r 192.168.1.4,10.1.1.5), host names (-r bla.bla.net,yopcitron.com), or any
combination of those.

-y is to restrict the number of concurrent sessions a user can have
at the same time. '' or 0 mean unlimited. Avoid this feature on very loaded
servers. Use per-ip limits instead.

Ok, "joe" has been created. By default, the list of virtual users is stored
in the /etc/pureftpd.passwd file (you can of course change this with -f
<file>) .

Let's have a look at its content:

joe:$7$C6..../....swVShTUX9kLJepm0vvj7dUXPqtULzQ9G3GT/GAO3bd3$GMHJRyUdSRwNROunwtRbEDHlx5t3eNQew7bb1dz29K2:500:101::/home/ftpusers/joe/./:::::::::::::

Passwords are hashed with the most secure hash function your system supports.
Hashes are tried in this order: argon2, scrypt, bcrypt, SHA-512, MD5.

SHA-512 and MD5 should not be used any more. bcrypt requires crypt(3)
from the C library to support it, which is commonly the case on BSD
systems, but is only present on some Linux distributions.

Argon2 and scrypt are the recommended functions, and require pure-ftpd to be
compiled in presence of libsodium. Note that a login attempt will require up
to 64 Mb memory, and 100% of a CPU core. The number of simultaneously allowed
sessions should be tuned accordingly to avoid resources starvation.


       ------------------------ CHANGING INFO ------------------------


Once virtual users have been created, you can edit their info. For instance
you can add bandwidth throttling, change quotas, add their full name, update
ratio, etc.

The "pure-pw usermod" command works just like "pure-pw useradd" except that
it modifies an existing account instead of creating a new one.

For instance, we will add a quota to Joe. Joe should be limited to 1000
files and 10 Megabytes.

                      pure-pw usermod joe -n 1000 -N 10

Let's have a look at /etc/pureftpd.passwd:

joe:$7$C6..../....swVShTUX9kLJepm0vvj7dUXPqtULzQ9G3GT/GAO3bd3$GMHJRyUdSRwNROunwtRbEDHlx5t3eNQew7bb1dz29K2:500:101::/home/ftpusers/joe/./::::::1000:10485760::::::

As you can see, the size quota is stored in bytes in the file.


   ------------------------ RESETTING ATTRIBUTES ------------------------


To disable file quotas, use pure-pw usermod <user> -n ''
To disable size quotas, use pure-pw usermod <user> -N ''
To disable ratios, use pure-pw usermod <user> -q '' -Q ''
To disable download bandwidth throttling, use pure-pw usermod <user> -t ''
To disable upload bandwidth throttling, use pure-pw usermod <user> -T ''
To disable IP filtering, use pure-pw usermod <user> <-i,-I,-r or -R> ''
To disable time restrictions, use pure-pw usermod <user> -z ''
To disable the number of concurrent sessions, use pure-pw usermod <user> -y ''


      ------------------------ DELETING USERS ------------------------


We won't delete Joe at this time. Joe is a fine guy :) But FYI, deleting an
user is as simple as running "pure-pw userdel", whose syntax is:

         pure-pw userdel <login> [-f <passwd file>] [-m]
         
Deleting Joe would be:

                             pure-pw userdel joe
                             
The content of his home directory is kept. Delete it by hand if you want.


    ------------------------ CHANGING PASSWORDS ------------------------


To change the password of a user, use "pure-pw passwd":

         pure-pw passwd <login> [-f <passwd file>] [-m]


      ------------------------ DISPLAYING INFO ------------------------
      

To review info about one user, reading the /etc/pureftpd.passwd file is ok,
but it's not really human-friendly.

It's why you can use "pure-pw show", whose syntax is:

         pure-pw show    <login> [-f <passwd file>]
         
Let's try with joe:

                              pure-pw show joe
                              

Login              : joe
Password           : $7$C6..../....swVShTUX9kLJepm0vvj7dUXPqtULzQ9G3GT/GAO3bd3$GMHJRyUdSRwNROunwtRbEDHlx5t3eNQew7bb1dz29K2
UID                : 500 (ftpuser)
GID                : 101 (ftpgroup)
Directory          : /home/ftpusers/joe/./
Full name          : 
Download bandwidth : 0 Kb (unlimited)
Upload   bandwidth : 0 Kb (unlimited)
Max files          : 1000 (enabled)
Max size           : 10 Mb (enabled)
Ratio              : 0:0 (unlimited:unlimited)
Allowed local  IPs : 
Denied  local  IPs : 
Allowed client IPs : 192.168.0.0/16
Denied  client IPs : 192.168.1.1,blah.verybadhost.com
Time restrictions  : 0900-1800 (enabled)
Max sim sessions   : 0 (unlimited)


  "/./" at the end of a home directory means that this user will be chrooted.


     ------------------------ COMMITTING CHANGES ------------------------
      

IMPORTANT:

You can add, modify and delete users with the previous commands, or by
editing /etc/pureftpd.passwd by hand. But the FTP server won't consider the
changes you make to that file, until you commit them.

Committing changes really means that a new file is created from
/etc/pureftpd.passwd (or whatever file name you choose) . That new file is a
PureDB file. It contains exactly the same info than the other file. But in
that file, accounts are sorted and indexed for faster access, even with
thousands of accounts. PureDB files are binary files, don't try to view them
or your terminal will beep like hell.

Let's create a PureDB file from /etc/pureftpd.passwd. The indexed file will
be called /etc/pureftpd.pdb (as always, choose whatever name you like):

                                pure-pw mkdb
                        
this reads /etc/pureftpd.passwd and creates /etc/pureftpd.pdb by default, but
to read another file, add the pdb file, optionally followed by -f <passwd file>

For instance:

  pure-pw mkdb /etc/accounts/myaccounts.pdb -f /etc/accounts/myaccounts.txt

All modifications you made to the virtual users database will be committed
automatically: all new accounts will be activated at the same time and all
deleted users won't be able to log in as soon as you'll have hit the Return
key.

There's no need to restart the pure-ftpd server to commit changes.

You can also change something to the text passwords file (add users, change
password, delete users, etc) and automatically run 
"pure-pw mkdb /etc/pureftpd.pdb" afterwards. To do so, just use the -m
switch:

pure-pw passwd joe -m

This command will change Joe's password in pureftpd.passwd *and* commit the
change to /etc/pureftpd.pwd .


  ------------------------ ENABLING VIRTUAL USERS ------------------------
  
  
Of course, to use virtual users, you have to enable their support in the FTP
server itself. At compile-time, this is done by giving --with-puredb to
./configure (--with-everything also enables it and binary packages have it
compiled in) .

Then, add this switch to your usual pure-ftpd switches:

-l puredb:/path/to/puredb_file

If long options are enabled, you can also use --login instead of -l .

Let's run the server with automatic creation of home directories and puredb
authentication:

/usr/local/sbin/pure-ftpd -j -lpuredb:/etc/pureftpd.pdb &

Try to 'ftp localhost' and log in as joe.


------------------------ CONVERTING SYSTEM ACCOUNTS ------------------------
  
  
You can convert all system (/etc/passwd) accounts to virtual FTP users, with
the "pure-pwconvert" tool.

Just run it:

                    pure-pwconvert >> /etc/pureftpd.passwd


If you do it as a non-privileged user, passwords won't be filled in. If you
do it as root, everything will be copied, even hashed passwords.

Copying system accounts to FTP accounts makes sense, because that way, users
can use different passwords for FTP and for Telnet access.


   ------------------------ ENVIRONMENT VARIABLES ------------------------
  
  
If defined, a PURE_PASSWDFILE environment variable can set the default path
to the pureftpd.passwd file. Without this variable, it defaults to
/etc/pureftpd.passwd .  
  
If defined, a PURE_DBFILE environment variable can set the default path
to the pureftpd.pdb file. Without this variable, it defaults to
/etc/pureftpd.pdb .  
  
PK     ¼ 0]%»òå      pureftpd-mysql.confnu „[µü¤        
##############################################
#                                            #
# Sample Pure-FTPd Mysql configuration file. #
# See README.MySQL for explanations.         #
#                                            #
##############################################


# Optional : MySQL server name or IP. Don't define this for unix sockets.

# MYSQLServer     127.0.0.1


# Optional : MySQL port. Don't define this if a local unix socket is used.

# MYSQLPort       3306


# Optional : define the location of mysql.sock if the server runs on this host.

MYSQLSocket     /var/run/mysqld/mysqld.sock


# Mandatory : user to bind the server as.

MYSQLUser       root


# Mandatory : user password. You must have a password.

MYSQLPassword   rootpw


# Mandatory : database to open.

MYSQLDatabase   pureftpd


# Mandatory : how passwords are stored
# Valid values are : "cleartext", "argon2", "scrypt", "crypt", and "any"

MYSQLCrypt      argon2


# In the following directives, parts of the strings are replaced at
# run-time before performing queries :
#
# \L is replaced by the login of the user trying to authenticate.
# \I is replaced by the IP address the user connected to.
# \P is replaced by the port number the user connected to.
# \R is replaced by the IP address the user connected from.
# \D is replaced by the remote IP address, as a long decimal number.
#
# Very complex queries can be performed using these substitution strings,
# especially for virtual hosting.

# Query to execute in order to fetch the password

MYSQLGetPW      SELECT Password FROM users WHERE User='\L'


# Query to execute in order to fetch the system user name or uid
MYSQLGetUID     SELECT Uid FROM users WHERE User='\L'


# Optional : default UID - if set this overrides MYSQLGetUID

#MYSQLDefaultUID 1000


# Query to execute in order to fetch the system user group or gid

MYSQLGetGID     SELECT Gid FROM users WHERE User='\L'


# Optional : default GID - if set this overrides MYSQLGetGID

#MYSQLDefaultGID 1000


# Query to execute in order to fetch the home directory

MYSQLGetDir     SELECT Dir FROM users WHERE User='\L'


# Optional : query to get the maximal number of files 
# Pure-FTPd must have been compiled with virtual quotas support.

# MySQLGetQTAFS  SELECT QuotaFiles FROM users WHERE User='\L'


# Optional : query to get the maximal disk usage (virtual quotas)
# The number should be in Megabytes.
# Pure-FTPd must have been compiled with virtual quotas support.

# MySQLGetQTASZ  SELECT QuotaSize FROM users WHERE User='\L'


# Optional : ratios. The server has to be compiled with ratio support.

# MySQLGetRatioUL SELECT ULRatio FROM users WHERE User='\L'
# MySQLGetRatioDL SELECT DLRatio FROM users WHERE User='\L'


# Optional : bandwidth throttling.
# The server has to be compiled with throttling support.
# Values are in KB/s .

# MySQLGetBandwidthUL SELECT ULBandwidth FROM users WHERE User='\L'
# MySQLGetBandwidthDL SELECT DLBandwidth FROM users WHERE User='\L'


# Enable ~ expansion. NEVER ENABLE THIS BLINDLY UNLESS :
# 1) You know what you are doing.
# 2) Real and virtual users match.

# MySQLForceTildeExpansion 1


# If you're using a transactionnal storage engine, you can enable SQL
# transactions to avoid races. Leave this commented if you are using the
# traditional MyIsam engine.

# MySQLTransactions On
PK     ¼ 0]Ý~Nd  d    README.Configuration-Filenu „[µü¤        Pure-FTPd strives to remain simple to operate, and keeps the number of
knobs down to a minimum.

Virtually everything can be set using command-line switches, so that a
configuration file is not required.

For example, the '-H' switch is recommended and avoids DNS lookups.

To enable this feature, just add it right after the executable name:

    /usr/local/sbin/pure-ftpd -H

Long options are also supported. This is equivalent to the previous
command:

    /usr/local/sbin/pure-ftpd --dontresolve

As an alternative to command-line switches, Pure-FTPd can use a
configuration file. The set of supported features is the same no
matter what way of configuring the server is being used.

A sample configuration file named pure-ftpd.conf should have been installed
in /etc/, /usr/local/etc/ or another standard location derived from
the package installation prefix.

Tweak it according to your needs, and start the server using that file:

    /usr/local/sbin/pure-ftpd /etc/pure-ftpd.conf

Note the absence of switches. In order to avoid confusion, either a
configuration file or a set of command-line switches can be used.
PK     ¼ 0]Šú	’  ’    pureftpd-pgsql.confnu „[µü¤        
###################################################
#                                                 #
# Sample Pure-FTPd PostgreSQL configuration file. #
# See README.PGSQL for explanations.              #
#                                                 #
###################################################


# If PostgreSQL listens to a TCP socket

PGSQLServer     localhost
PGSQLPort       5432 


# *or* if PostgreSQL can only be reached through a local Unix socket

# PGSQLServer     /tmp
# PGSQLPort       .s.PGSQL.5432


# Mandatory : user to bind the server as.

PGSQLUser       postgres


# Mandatory : user password. You *must* have a password.

PGSQLPassword   rootpw


# Mandatory : database to open.

PGSQLDatabase   pureftpd


# Mandatory : how passwords are stored
# Valid values are : "cleartext", "argon2", "scrypt", "crypt", and "any"

PGSQLCrypt      argon2


# In the following directives, parts of the strings are replaced at
# run-time before performing queries :
#
# \L is replaced by the login of the user trying to authenticate.
# \I is replaced by the IP address the user connected to.
# \P is replaced by the port number the user connected to.
# \R is replaced by the IP address the user connected from.
# \D is replaced by the remote IP address, as a long decimal number.
#
# Very complex queries can be performed using these substitution strings,
# especially for virtual hosting.


# Query to execute in order to fetch the password

PGSQLGetPW      SELECT "Password" FROM users WHERE "User"='\L'


# Query to execute in order to fetch the system user name or uid

PGSQLGetUID     SELECT "Uid" FROM users WHERE "User"='\L'


# Optional : default UID - if set this overrides PGSQLGetUID

#PGSQLDefaultUID 1000


# Query to execute in order to fetch the system user group or gid

PGSQLGetGID     SELECT "Gid" FROM users WHERE "User"='\L'


# Optional : default GID - if set this overrides PGSQLGetGID

#PGSQLDefaultGID 1000


# Query to execute in order to fetch the home directory

PGSQLGetDir     SELECT "Dir" FROM users WHERE "User"='\L'


# Optional : query to get the maximal number of files 
# Pure-FTPd must have been compiled with virtual quotas support.

# PGSQLGetQTAFS  SELECT "QuotaFiles" FROM users WHERE "User"='\L'


# Optional : query to get the maximal disk usage (virtual quotas)
# The number should be in Megabytes.
# Pure-FTPd must have been compiled with virtual quotas support.

# PGSQLGetQTASZ  SELECT "QuotaSize" FROM users WHERE "User"='\L'


# Optional : ratios. The server has to be compiled with ratio support.

# PGSQLGetRatioUL SELECT "ULRatio" FROM users WHERE "User"='\L'
# PGSQLGetRatioDL SELECT "DLRatio" FROM users WHERE "User"='\L'


# Optional : bandwidth throttling.
# The server has to be compiled with throttling support.
# Values are in KB/s .

# PGSQLGetBandwidthUL SELECT "ULBandwidth" FROM users WHERE "User"='\L'
# PGSQLGetBandwidthDL SELECT "DLBandwidth" FROM users WHERE "User"='\L'
PK     ¼ 0]\¿Æþ*  þ*  
  README.TLSnu „[µü¤        

         ------------------------ TLS SUPPORT ------------------------

Pure-FTPd supports encryption of the control and data channels using
TLS security mechanisms.

When this extra security layer is enabled, login and passwords are no more
sent as cleartext. Neither are other commands sent by your client nor replies
made by the server.


         ------------------------ COMPILATION ------------------------

To support TLS, the OpenSSL library must already be installed on your
system. This is a common requirement so your operating system probably
already ships with it.

Pure-FTPd also has to be configured with the --with-tls switch before
compilation :

  ./configure --with-tls ...
  make install-strip

If something goes wrong, try to bring your OpenSSL library up-to-date.


        ------------------------ CERTIFICATES ------------------------


TLS connections require certificates, as well as their key.

Both can be bundled into a single file. If you have both a `.pem` file
and a `.key` file, just concatenate the content of the `.key` file to
the `.pem` file.

By default, Pure-FTPd will look for a cert+key bundle in the
/etc/ssl/private/pure-ftpd.pem file.

The location can be changed at compile-time with the --with-certfile
and --with-keyfile options passed to ./configure.

It can also be changed at runtime, with the CertFile option in the
configuration file:

CertFile                     /etc/ssl/private/pure-ftpd.pem
or
CertFileAndKey               /etc/pure-ftpd.pem /etc/pure-ftpd.key

The former is for a bundle, the later loads two files.

If you already have a certificate for another service on the same host
(commonly for HTTPS), you can use it as well with Pure-FTPd and other
TLS-enabled services.

Both RSA and ECDSA signatures are supported, but not simultaneously.

For testing purposes, a self-signed certificate can be created as follows:

mkdir -p /etc/ssl/private

openssl req -x509 -nodes -newkey rsa:2048 -sha256 -keyout \
  /etc/ssl/private/pure-ftpd.pem \
  -out /etc/ssl/private/pure-ftpd.pem

chmod 600 /etc/ssl/private/*.pem

In this example, 2048 is the number of bits used for the RSA key.

Here's what the /etc/ssl/private/pure-ftpd.pem should look like :

-----BEGIN PRIVATE KEY-----
MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDV8A/fexof9ttn
uqpwCxXN3C019v40ByGqlfmg8SbTnkjtyt5FLw3ICoxBbQtQ65aYSAv5KtiGQbuc
BZC+FGbR3rIokvHnbhsdLvIvWym+W+VR6U2P8VnbHWd3iSe0xMeTwGJgP9TC8r+c
KfLX9a8EkTKL2iAVRhXuu/it7/A3T2rEomBRWGpmbE+AT69vP2T5ruQ9D7w21GcG
S6ylqlfhRBy61ct3WI1jVR2W5BOXfE8LxgGuJYt0XY+dTrluqen9li8w5ju+3tlA
9PsIl4ckjmYBZm1E7LqoSYDbIh/8D4kUQFLFm6xf27cUOEg3uYAJo5x3SfYlKsSm
6PKzhzDIKcJ1896XG2AHOdIby9VoL8mZwjuMkmmrl1yro++g4XNnMIaTkajPgFzr
NxQ195lXAgMBAADCggEBAMoqmCVc5Dwuf/mO+T72Cr3FgefMJz4tOxBDt2jyWfmC
S3KC0fZY19IgvZeaHyZx6pavBrmIVqLQfSScUcJ97wgGRR94dSZ48yBp260KnfDo
UFVOfeA3d+1K5RqdvqrhhaPHGm/QAhPTZ2SgUl8fEPqr7eZU4HhAcyPaLCMKFsV/
lbfY2C4Kq54o2m1uHFTertx5niE4Yx6ALqBB66rR4It7lnr7kBhAnIsCYj7ENGrU
6C1PzjpvrqjWqnYjbmzUov7b4S308YGqWKrfkJxTrviVaITI1XznAHlTBDLkuU1l
eSyZ0YP3Gfd82j9fhdugH2nLxLCttcmGNOaA87VlXL/oZaYI5P5xqjyjkCgYEA6x
Fy30dcPM+VKDhnp2QBbHrJC0zr88Hn4qYxIfyoPtjrvTb+vSI703Cd0rc00alGK6
YZZKDV1NYKw8/r2uHRXgbpptYdRKz+GrsgNdORycKXkmWXw+ChIHsl/UghHG60jy
KNPSkOJgPXIseJDn2ZcqlFLkl6sCgYEA6Pr+L1otzG//ROJdBV58yHO0V2KF9VKM
amt5RUWkqRqfOiE0i5T3nmBPPflNB4bdj8qe+DwoPly2SJMihT7KQqvg54V/ZVb+
jXY0fNLEDhJ0PdboB2I/r6SuWBNJyXF8AAewzcDF3PlBr/JGOHF4XGmOLVmiNL/N
+6RPLW5i6QUCgYA0sRq2M9QsGCy61xkTDwf2xbbSQ/6bTCPpZbHIKn98wDzXkOwr
XMqneD7teYiBUi98jhMiMOMmaygEDsU8TpW2vSa0+CaL6zR17Itr/015Wj6SrkDw
G/TvckxGt5MzB7hYRYZYI0bdCOMPpkAxipluRG/SFh+FvuVZTpsKuDHpFQKBgFrA
ThXzmNlx069BYNj2NGL0AI8ueQlIca84tAlLMAMrPQw5gfgeVSBdzWuRV9SX1+1L
EZuT037XuLaIcMHbsT6N/0u69mwFqn6y6gSQUwbhAoGAYa6eN7KUA0Xri5zrABst
S2PP2rrmrnFLohNJ5CAWR7vvk6aKkMd+hEAJTk6s+vc7B3NHR/icIu1CnXWxKhB7
AI0SIL0losHuBfCst8CTpqZ//Jjvi0IbOm+SNI/aqYcrrHrzdkSWYLC6Ll16Ckrg
xeBXhXuiP9wEJSDmg7wb1t0=
-----END PRIVATE KEY-----
-----BEGIN CERTIFICATE-----
MIIDFDCCAfwCCQC/UlBaK8CNnDANBgkqhkiG9w0BAQUFADBMMQswCQYDVQQGEwJG
UjEOMAwGA1UEBwwFUGFyaXMxEjAQBgNVBAoMCVB1cmUtRlRQZDEZMBcGA1UEAwwQ
ZnRwLnB1cmVmdHBkLm9yZzAeFw0xNTAyMjExNDE1MTlaFw0xNTAMzjMxNDE1MTla
MEwxCzAJBgNVBAYTAkZSMQ4wDAYDVQQHDAVQYXJpczESMBAGA1UECgwJUHVyZS1G
VFBkMRkwFwYDVQQDDBBmdHAucHVyZWZ0cGQub3JnMIIBIjANBgkqhkiG9w0BAQEF
FEBSxZusX9u3FDhIN7mACaOcd0n2JSrEpujys4cwyCnCdfPelxtgBznSG8vVaC/J
IBCgKCAQEA1fAP33saH/bbZ7qqcAsVzdwtNfb+NAchqpX5oPEmqGSIb3DQEB055I
7creRS8NyAqMQW0LUOuWmEgL+SrYhkG7nAWQvhRm0d6yKJLx524bHS7yL1spvlvl
UelNj/FZ2x1nd4kntMTHk8BiYD/UwvK/nEuspapX4UQcutXLd1iNY1UdluQTl3xP
C8YBriWLdF2PnU65bqnp/ZYvMOY7vt7ZQPT7CJeHJI5mAWZtROy6qEmA2yIf/A+J
mcI7jJJpq5dc6qAAOCAQ8AMIPvoOF3ksmdGD9xn3fNozcUNfeZVwIDAQABMA0GCS
BqUAA4IBAQDT768mdG071/m6V1N4qeM5PVrpa5eB5mulE7JPBOPJADmw6YwYaSWJ
90wE+YuU6DiDbRxHtWiCMwHoCH42fxU7BDVNrc3L614v1kUQGTLlHPyAUs6KZvz0
Rko2y6Dzj+kVaJiWFKi+zWwWnf9P4wLYafv/n5EHKmEt1K83UE0h5r64fhwX9vH7
6NHCMbmSDXgHjnv3rZKOOKN85ZYr2vKX+rTvASh2nxp2bbNM1XpfyuH2vbWL3J+E
mFCaj3/lD880kHnTaTwo3Kg0SQy/Axe2LhX3zj+kSD2A9k6wtGcKttjrt4kNGaFc
BlhkOrwnAhqbm5N3VQCB63CRpuuCVmYz
-----END CERTIFICATE-----

If you need client certificate verification, prefix the list of
ciphers (-J/--tlsciphersuite) with -C:

pure-ftpd --tlsciphersuite=-C:HIGH -Y2 ...

If you want to do certificate-based client authentication, their
public key must be included in the pure-ftpd.pem file.

If multiple domains are used on the same server, each with its
own certificate, Pure-FTPd supports SNI and custom certificate
handlers (see down below).


   ------------------------ ACCEPTING TLS SESSIONS ------------------------

Once the certificate has been installed, you need to start a TLS-enabled
pure-ftpd daemon with the -Y (or --tls=) switch. Example :

/usr/local/sbin/pure-ftpd --tls=1 &

- With "--tls=0", support for TLS is disabled. This is the default.

- With "--tls=1", clients can connect either the traditional way or through an
TLS layer. This is probably the setting you need if you want to enable
TLS without having too many angry customers.

- With "--tls=2", cleartext sessions are refused and only TLS compatible
clients are accepted.

- With "--tls=3", cleartext sessions are refused and only TLS compatible
clients are accepted. Clear data connections are also refused, so private
data connections are enforced. This is an extreme setting.

When TLS has been successfully negotiated for a connection, you'll see
something similar to this in log files :

<<
TLS: Enabled TLSv1/SSLv3 with ECDHE-ECDSA-AES128-GCM-SHA256, 128 secret bits cipher
>>


 ------------------------ CUSTOM CERTIFICATE HANDLERS ------------------------

If multiple domains are used to access the server, each with their own
certificate, Pure-FTPd supports the SNI (Server Name Indication) extension, as
well as a flexible mechanism to map names to certificates.

The pure-certd daemon needs to be started along with the FTP server.

pure-certd listens to certificate requests, runs arbitrary commands written in
any programming language, provides them the client SNI name, and returns what
action has to be taken, and/or where the certificate to use is located.

pure-certd command-line options follow:

-B      --daemonize
-g      --gid   <opt>
-h      --help
-p      --pidfile       <opt>
-r      --run   <opt>
-s      --socket        <opt>
-u      --uid   <opt>

The mandatory ones are --run and --socket. The former indicates what command
to run in order to return actions and certificates, the later is a path to the
local UNIX socket that will be created in order to communicate with the FTP
server.

Example usage:

pure-certd --run /opt/pure-ftpd/bin/certificate-handler.sh \
           --socket /var/run/ftpd-certs.sock

The command can access the SNI name in an environment variable named
CERTD_SNI_NAME. If this is a shell script, make sure that the file is
executable.

The command should print the following lines to the standard output:

action:xxx
cert_file:yyy (optional)
key_file:zzz  (optional)
end

With xxx being one of:

- deny: access is denied
- default: the default certificate will be used
- strict: the certificate whose path is indicated in "cert_path" will be used.
If absent or invalid, access will be denied.
- fallback: the certificate whose path is indicated in "cert_path" will be used.
If absent or invalid, the default certificate will be used instead.

yyy is the absolute path on the filesystem where the certificate is located.
It can be a certificate+key bundle.

zzz is optional and is the path to the certificate secret key, if it is not
bundled into the PEM file.

If the action is "deny" or "default", "cert_file" and "key_file" do not have
to be provided.

Here is a trivial example script logging the SNI name, and returning a fixed
certificate path:

#! /bin/sh

echo 'action:strict'
echo 'key_file:/etc/pure-ftpd/special.pem'
echo 'done'

Once pure-certd is running, the FTP server must be configured to use it.

This is achieved by enabling the "ExtCert" feature in the configuration file:

ExtCert                      /var/run/ftpd-certs.sock

The path to the socket must match the one created by pure-certd.


      ------------------------ COMPATIBLE CLIENTS ------------------------

Pure-FTPd was reported to be fully compatible with the following clients with
the TLS encryption layer turned on :


* Transmit (OSX)
  URL: https://panic.com/transmit/

  TLS works out of the box, both in implicit and explicit modes.


* CoreFTP Lite (Windows)
  URL: http://www.coreftp.com/

  TLS perfectly works when "AUTH TLS" is enabled. CoreFTP Lite has some
neat features like IPv6 support, remote file searching, .htaccess editing,
queueing, bandwidth control, etc.

  CoreFTP Lite is free both for personal and business use.


* SmartFTP (Windows)
  URL: https://www.smartftp.com/

  An excellent client with IPv6 support, port range limitation and other
useful features (!= bloat) . And it's free for personal, educational and non-
commercial use. And it detects Pure-FTPd :)

  TLS perfectly works when the "FTP over SSL (explicit)" protocol is
selected and when the data connection mode (Tools->Settings->SSL) is set to
"clear data connection" while the AUTH mode (also in Tools->Settings->SSL) is
set to "TLS".


* FlashFXP (Windows)
  URL: https://www.flashfxp.com/

  TLS works. In the "Quick connect" dialog box, pick the "SSL" tab and :
 - enable Auth TLS
 - disable Secure File Listing
 - disable Secure File Transfers


* SDI FTP (Windows)
  URL: https://www.sdisw.com/

  TLS works. In the "Connection" tab, just pick "SSL Support: TLSv1".


* LFTP (Unix, MacOS X)
  URL: https://lftp.yar.ru/

  TLS is automatically detected and works out of the box.


* RBrowser (MacOS X)
  URL: http://www.rbrowser.com/

  A cute graphical client for MacOS that was reported to work by Jason Rust
and Robert Vasvari.


* Cyberduck (OSX)
  https://cyberduck.ch/

  TLS works out of the box.


* WinSCP (Windows)
  https://winscp.net/eng/index.php
  WinSCP should be configured with "File protocol" set to "FTP" with
"TLS Explicit encryption".
PK     ¼ 0]6’W÷"  ÷"    README.MySQLnu „[µü¤        

    ------------------------ MYSQL/MARIADB SUPPORT ------------------------


When MySQL is enabled, all account info is fetched from a central MySQL
or MariaDB database.

To compile the server with MySQL/MariaDB support, you first have to build and
install the MySQL client libraries. MariaDB is freely available from
https://mariadb.org/ and binary packages are included in many major
distributions. But if you choose a binary form, don't forget to also install
the development packages if they are available separately. For example, on
Debian/Ubuntu systems, the package to install is called
libmariadb-client-lgpl-dev.

Then, configure Pure-FTPd with --with-mysql and your favorite extra gadgets:


    ./configure --with-mysql --with-everything


If your MySQL libraries are installed in a special path, you can specify it
like this:


    ./configure --with-mysql=/opt/mysql


In this example, headers (like mysql.h) will be searched in
/opt/mysql/include and /opt/mysql/include/mysql, while related libraries
will be searched in /opt/mysql/lib and /opt/mysql/lib/mysql .

Then, install the server as usual:


                                 make install


 ------------------------ MYSQL CONFIGURATION FILE ------------------------
           

Before running the server, you have to create a configuration file. Why a
configuration file instead of simple command-line options? you may ask.
For security reasons, you may want to hide how to connect to your
MySQL server. And as command-line options can be discovered by local users
(with 'ps auxwww' for instance), it's more secure to use a configuration
file for sensitive data. Keep it readable only by root (chmod 600) .

Here's a sample configuration file:

#MYSQLServer     localhost
#MYSQLPort       3306
MYSQLSocket     /tmp/mysql.sock
MYSQLUser       root
MYSQLPassword   rootpw
MYSQLDatabase   pureftpd
MYSQLCrypt      cleartext
MYSQLGetPW      SELECT Password FROM users WHERE User="\L"
MYSQLGetUID     SELECT Uid FROM users WHERE User="\L"
MYSQLGetGID     SELECT Gid FROM users WHERE User="\L"
MYSQLGetDir     SELECT Dir FROM users WHERE User="\L"

Have a look at the sample pureftpd-mysql.conf configuration file for
explanations of every keyword.

Save the configuration file anywhere. Let's say /etc/pureftpd-mysql.conf .

Then, you have to run the pure-ftpd command with '-l mysql:' (it's an 'ell'
not a 'one') followed by the path of that configuration file.

Example:

pure-ftpd -l mysql:/etc/pureftpd-mysql.conf -B

You can mix different authentication methods. For instance, if you want to
use system (/etc/passwd) accounts when an account is not found in a MySQL
database, use -l mysql:/etc/pureftpd-mysql.conf -l unix


     ------------------------ TABLES STRUCTURES ------------------------
     
     
Pure-FTPd is very flexible and users can be stored in any way in SQL tables.
You just have to have fields with the following info:

- The user's login.

- The user's password, hashed using argon2 (argon2id or argon2i), scrypt or
crypt(3). Pure-FTPd also accepts the "any" value for the MySQLCrypt field.
With "any", all hash functions are sequentially tried.

* RECOMMENDATION: Do not use plaintext. Unless your system provides a decent
crypt() function, use a MySQL function to verify the hashed password or use
argon2/scrypt.

- The system uid to map the user to. This can be a numeric id or a user
name, looked up at run-time.

- The system gid (numeric or not) .

- The home directory.

Here's a dump of a simple table to handle this:

CREATE TABLE users (
  User VARCHAR(255) BINARY NOT NULL,
  Password VARCHAR(255) BINARY NOT NULL,
  Uid INT NOT NULL default '-1',
  Gid INT NOT NULL default '-1',
  Dir VARCHAR(255) BINARY NOT NULL,
  PRIMARY KEY (User)
);

Uid and Gid can be char() instead of int() if you want to use names instead
of values.

Then, in the pureftpd-mysql.conf configuration file, you have to provide SQL
templates to fetch the needed info.

Let's take the previous example:

MYSQLGetPW      SELECT Password FROM users WHERE User="\L"
MYSQLGetUID     SELECT Uid FROM users WHERE User="\L"
MYSQLGetGID     SELECT Gid FROM users WHERE User="\L"
MYSQLGetDir     SELECT Dir FROM users WHERE User="\L"

For each query:

\L is replaced by the login of a user trying to authenticate.
\I is replaced by the IP address the client connected to.
\P is replaced by the port number the client connected to.
\R is replaced by the remote IP address the client connected from.
\D is replaced by the remote IPv4 address, as a long decimal number.

You can mix all of these to store info in various tables. For instance, with
\I, you can have a different table for every domain, so that joe@domain1
won't be the same account as joe@domain2 . And with \R, you can restrict
one account to one specific address.

Multiple statements can be used using a semicolon (";") as a delimiter.

Please note that a login can only contain common characters: A...Z, a...z,
0...9, -, ., _, space, :, @ and ' . For security purposes, other characters
are forbidden.

You can also remove uid and gid fields in your tables and use default
values instead (thus saving useless lookups) . Two directives are
useful to serve that purpose: MYSQLDefaultUID and MYSQLDefaultGID.

Obvious example:

MYSQLDefaultUID 1000
MYSQLDefaultGID 1000

Using these directives overrides MYSQLGetUID and MYSQLGetGID.


           ------------------------ ARGON2 ------------------------


Password hashed with argon2i and argon2id can be used, provided that pure-ftpd
was linked to libsodium.

They are expected to be provided as a string, as returned by the
crypto_pwhash_str() function or by its bindings.


           ------------------------ SCRYPT ------------------------


Password hashed with scrypt can be used, provided that pure-ftpd was linked to
libsodium.

They are expected to be provided in escrypt format, as returned by the
crypto_pwhash_scryptsalsa208sha256_str() function or by its bindings.

For example, the string $7$C6..../....YzvCLmJDYJpH76BxlZB9fCpCEj2AbGQHoLiG9I/VRO1$/enQ.o1BNtmxjxNc/8hbZq8W0JAqR5YpufJXGAdzmf3
would verify the password "test".


     ------------------------ PER-USER SETTINGS ------------------------


Individual settings can be set for every user, using optional queries.

- MySQLGetQTAFS is the maximal number of files a user can store in his home
directory.

Example:
MySQLGetQTAFS  SELECT QuotaFiles FROM users WHERE User="\L"

- MySQLGetQTASZ is the maximal disk usage, in Megabytes.

Example:
MySQLGetQTASZ  SELECT QuotaSize FROM users WHERE User="\L"

- MySQLGetRatioUL and MySQLGetRatioDL are optional ratios.

Example:
MySQLGetRatioUL SELECT ULRatio FROM users WHERE User="\L"
MySQLGetRatioDL SELECT DLRatio FROM users WHERE User="\L"

- MySQLGetBandwidthUL and MySQLGetBandwidthDL are optional upload and
download bandwidth restrictions. Returned values should be in KB/s.

Example:
MySQLGetBandwidthUL SELECT ULBandwidth FROM users WHERE User="\L"
MySQLGetBandwidthDL SELECT DLBandwidth FROM users WHERE User="\L"

- MySQLForceTildeExpansion is yet another optional feature, to enable "~"
expansion in paths. 0 disables it (default), 1 enables it. Only enable this
if real (system) users and virtual (MySQL) users match. In all other cases,
don't enable it blindly.


       ------------------------ TRANSACTIONS ------------------------


If you upgraded your tables to transaction-enabled tables, you can configure
Pure-FTPd to take advantage of transactions. That way, you can be sure that
all info parsed by the server is complete even if you're updating it at the
same time.

To enable transactions, add this line:

MySQLTransactions On

Don't enable transactions on tables that still are in MyISAM format.
Transactions are only working with backends such as InnoDB.


     ------------------------ STORED PROCEDURES ------------------------


Mike Goins says:

To get pure-ftp to use a MySQL stored procedure, use statements like:

MYSQLGetDir   CALL get_path_from_name("\L")
instead of
MYSQLGetDir   SELECT user_dir FROM user WHERE user_name="\L"

Note that this requires the type of Stored Procedure that returns a result set
in a single call as opposed to the two call method:
CALL sp('value', @a); SELECT @a


      ------------------------ ANONYMOUS USERS ------------------------


If you want to accept anonymous users on your FTP server, you don't need to
have any 'ftp' user in the MySQL directory. But you need to have a system
'ftp' account on the FTP server.


        ------------------------ ROOT USERS ------------------------


If a MySQL user entry has a root (0) uid and/or gid, Pure-FTPd will refuse
to log them in.

Without this preventive restriction, if your MySQL server ever gets
compromised, the attacker could also easily compromise the FTP server.

Security barriers are also implemented to avoid bad implications if wrong
data types (eg. binary blobs instead of plain text) are fetched with SQL
queries.
PK     ¼ 0]Ô’@›R-  R-    pure-ftpd.confnu „[µü¤        
############################################################
#                                                          #
#             Configuration file for pure-ftpd             #
#                                                          #
############################################################

# If you want to run Pure-FTPd with this configuration
# instead of command-line options, please run the
# following command :
#
# ${exec_prefix}/sbin/sbin/pure-ftpd /etc/pure-ftpd.conf
#
# Online documentation:
# https://www.pureftpd.org/project/pure-ftpd/doc


# Restrict users to their home directory

ChrootEveryone               yes


# If the previous option is set to "no", members of the following group
# won't be restricted. Others will be. If you don't want chroot()ing anyone,
# just comment out ChrootEveryone and TrustedGID.

# TrustedGID                   100


# Turn on compatibility hacks for broken clients

BrokenClientsCompatibility   no


# Maximum number of simultaneous users

MaxClientsNumber             50


# Run as a background process

Daemonize                    yes


# Maximum number of simultaneous clients with the same IP address

MaxClientsPerIP              8


# If you want to log all client commands, set this to "yes".
# This directive can be specified twice to also log server responses.

VerboseLog                   no


# List dot-files even when the client doesn't send "-a".

DisplayDotFiles              yes


# Disallow authenticated users - Act only as a public FTP server.

AnonymousOnly                no


# Disallow anonymous connections. Only accept authenticated users.

NoAnonymous                  yes


# Syslog facility (auth, authpriv, daemon, ftp, security, user, local*)
# The default facility is "ftp". "none" disables logging.

SyslogFacility               ftp


# Display fortune cookies

# FortunesFile                 /usr/share/fortune/zippy


# Don't resolve host names in log files. Recommended unless you trust
# reverse host names, and don't care about DNS resolution being possibly slow.

DontResolve                  yes


# Maximum idle time in minutes (default = 15 minutes)

MaxIdleTime                  15


# LDAP configuration file (see README.LDAP)

# LDAPConfigFile               /etc/pureftpd-ldap.conf


# MySQL configuration file (see README.MySQL)

# MySQLConfigFile              /etc/pureftpd-mysql.conf


# PostgreSQL configuration file (see README.PGSQL)

# PGSQLConfigFile              /etc/pureftpd-pgsql.conf


# PureDB user database (see README.Virtual-Users)

# PureDB                       /etc/pureftpd.pdb


# Path to pure-authd socket (see README.Authentication-Modules)

ExtAuth                      /var/run/ftpd.sock


# If you want to enable PAM authentication, uncomment the following line

# PAMAuthentication            yes


# If you want simple Unix (/etc/passwd) authentication, uncomment this

# UnixAuthentication           yes


# Please note that LDAPConfigFile, MySQLConfigFile, PAMAuthentication and
# UnixAuthentication can be used specified once, but can be combined
# together. For instance, if you use MySQLConfigFile, then UnixAuthentication,
# the SQL server will be used first. If the SQL authentication fails because the
# user wasn't found, a new attempt will be done using system authentication.
# If the SQL authentication fails because the password didn't match, the
# authentication chain stops here. Authentication methods are chained in
# the order they are given.


# 'ls' recursion limits. The first argument is the maximum number of
# files to be displayed. The second one is the max subdirectories depth.

LimitRecursion               10000 8


# Are anonymous users allowed to create new directories?

AnonymousCanCreateDirs       no


# If the system load is greater than the given value, anonymous users
# aren't allowed to download.

MaxLoad                      4


# Port range for passive connections - keep it as broad as possible.

# PassivePortRange             30000 50000


# Force an IP address in PASV/EPSV replies. - for NAT.
# Symbolic host names are also accepted for gateways with dynamic IP
# addresses.

# ForcePassiveIP               192.168.0.1


# Upload/download ratio for anonymous users.

# AnonymousRatio               1 10


# Upload/download ratio for all users.
# This directive supersedes the previous one.

# UserRatio                    1 10


# Disallow downloads of files owned by the "ftp" system user;
# files that were uploaded but not validated by a local admin.

AntiWarez                    yes


# IP address/port to listen to (default=all IP addresses, port 21).

# Bind                         127.0.0.1,21


# Maximum bandwidth for anonymous users in KB/s

# AnonymousBandwidth           8


# Maximum bandwidth for *all* users (including anonymous) in KB/s
# Use AnonymousBandwidth *or* UserBandwidth, not both.

# UserBandwidth                8


# File creation mask. <umask for files>:<umask for dirs> .
# 177:077 if you feel paranoid.

Umask                        133:022


# Minimum UID for an authenticated user to log in.
# For example, a value of 100 prevents all users whose user id is below
# 100 from logging in. If you want "root" to be able to log in, use 0.

MinUID                       100


# Allow FXP transfers for authenticated users.

AllowUserFXP                 no


# Allow anonymous FXP for anonymous and non-anonymous users.

AllowAnonymousFXP            no


# Users can't delete/write files starting with a dot ('.')
# even if they own them. But if TrustedGID is enabled, that group
# will exceptionally have access to dot-files.

ProhibitDotFilesWrite        no


# Prohibit *reading* of files starting with a dot (.history, .ssh...)

ProhibitDotFilesRead         no


# Don't overwrite files. When a file whose name already exist is uploaded,
# it gets automatically renamed to file.1, file.2, file.3, ...

AutoRename                   no


# Prevent anonymous users from uploading new files (no = upload is allowed)

AnonymousCantUpload          yes


# Only connections to this specific IP address are allowed to be
# non-anonymous. You can use this directive to open several public IPs for
# anonymous FTP, and keep a private firewalled IP for remote administration.
# You can also only allow a non-routable local IP (such as 10.x.x.x) for
# authenticated users, and run a public anon-only FTP server on another IP.

# TrustedIP                    10.1.1.1


# To add the PID to log entries, uncomment the following line.

# LogPID                       yes


# Create an additional log file with transfers logged in a Apache-like format :
# fw.c9x.org - jedi [13/Apr/2017:19:36:39] "GET /ftp/linux.tar.bz2" 200 21809338
# This log file can then be processed by common HTTP traffic analyzers.

# AltLog                       clf:/var/log/pureftpd.log


# Create an additional log file with transfers logged in a format optimized
# for statistic reports.

# AltLog                       stats:/var/log/pureftpd.log


# Create an additional log file with transfers logged in the standard W3C
# format (compatible with many HTTP log analyzers)

# AltLog                       w3c:/var/log/pureftpd.log


# Disallow the CHMOD command. Users cannot change perms of their own files.

# NoChmod                      yes


# Allow users to resume/upload files, but *NOT* to delete them.

# KeepAllFiles                 yes


# Automatically create home directories if they are missing

# CreateHomeDir                yes


# Enable virtual quotas. The first value is the max number of files.
# The second value is the maximum size, in megabytes.
# So 1000:10 limits every user to 1000 files and 10 MB.

# Quota                        1000:10


# If your pure-ftpd has been compiled with standalone support, you can change
# the location of the pid file. The default is /var/run/pure-ftpd.pid

# PIDFile                      /var/run/pure-ftpd.pid


# If your pure-ftpd has been compiled with pure-uploadscript support,
# this will make pure-ftpd write info about new uploads to
# /var/run/pure-ftpd.upload.pipe so pure-uploadscript can read it and
# spawn a script to handle the upload.
# Don't enable this option if you don't actually use pure-uploadscript.

# CallUploadScript             yes


# This option is useful on servers where anonymous upload is
# allowed. When the partition is more that percententage full,
# new uploads are disallowed.

MaxDiskUsage                   99


# Set to 'yes' to prevent users from renaming files.

# NoRename                     yes


# Be 'customer proof': forbids common customer mistakes such as
# 'chmod 0 public_html', that are valid, but can cause customers to
# unintentionally shoot themselves in the foot.

CustomerProof                yes


# Per-user concurrency limits. Will only work if the FTP server has
# been compiled with --with-peruserlimits.
# Format is: <max sessions per user>:<max anonymous sessions>
# For example, 3:20 means that an authenticated user can have up to 3 active
# sessions, and that up to 20 anonymous sessions are allowed.

# PerUserLimits                3:20


# When a file is uploaded and there was already a previous version of the file
# with the same name, the old file will neither get removed nor truncated.
# The file will be stored under a temporary name and once the upload is
# complete, it will be atomically renamed. For example, when a large PHP
# script is being uploaded, the web server will keep serving the old version and
# later switch to the new one as soon as the full file will have been
# transferred. This option is incompatible with virtual quotas.

# NoTruncate                   yes


# This option accepts three values:
# 0: disable SSL/TLS encryption layer (default).
# 1: accept both cleartext and encrypted sessions.
# 2: refuse connections that don't use the TLS security mechanism,
#    including anonymous sessions.
# Do _not_ uncomment this blindly. Double check that:
# 1) The server has been compiled with TLS support (--with-tls),
# 2) A valid certificate is in place,
# 3) Only compatible clients will log in.

TLS                          1


# Cipher suite for TLS sessions.
# The default suite is secure and setting this property is usually
# only required to *lower* the security to cope with legacy clients.
# Prefix with -C: in order to require valid client certificates.
# If -C: is used, make sure that clients' public keys are present on
# the server.

TLSCipherSuite               HIGH


# Certificate file, for TLS
# The certificate itself and the keys can be bundled into the same
# file or split into two files.
# CertFile is for a cert+key bundle, CertFileAndKey for separate files.
# Use only one of these.

# CertFile                     /etc/ssl/private/pure-ftpd.pem
# CertFileAndKey               "/etc/pure-ftpd.pem" "/etc/pure-ftpd.key"


# Unix socket of the external certificate handler, for TLS

# ExtCert                      /var/run/ftpd-certs.sock


# Listen only to IPv4 addresses in standalone mode (ie. disable IPv6)
# By default, both IPv4 and IPv6 are enabled.

# IPV4Only                     yes


# Listen only to IPv6 addresses in standalone mode (i.e. disable IPv4)
# By default, both IPv4 and IPv6 are enabled.

# IPV6Only                     yes


# Append the content of another file, if the file exists.
# If the file doesn't exist, the directive is ignored.
# More files can be recursively included.

# Include                      additional_configuration.conf
PK     ¼ 0]X§þ¥Æ'  Æ'    README.LDAPnu „[µü¤        
If you never heard about LDAP before, *DON'T* enable LDAP support in
Pure-FTPd. LDAP is useless if you don't have to manage many shared accounts.
But well... if you want to learn about LDAP anyway, here's a good starting
point: http://www.openldap.org/


       ------------------------ LDAP SUPPORT ------------------------


Pure-FTPd has a built-in support for LDAP directories. When LDAP is
enabled, all account info is fetched from a central LDAP directory.

To compile the server with LDAP support, you first have to build and install
OpenLDAP. OpenLDAP is freely available from http://www.openldap.org/ and
binary packages are included in many major distributions. But if you choose
a binary form, don't forget to also install the development packages if they
are available separately.

Then, configure Pure-FTPd with --with-ldap and your favorite extra gadgets:


    ./configure --with-ldap --with-everything


If your LDAP libraries are installed in a special path, you can specify it
like this:


    ./configure --with-ldap=/usr/local/openldap


In this example, headers (ldap.h and lber.h files) will be searched in
/usr/local/openldap/include, while related libraries will be searched in
/usr/local/openldap/lib .

Then, install the server as usual:


                                 make install


  ------------------------ LDAP CONFIGURATION FILE ------------------------
  
  
Before running the server, you have to create a configuration file. Why a
configuration file instead of simple command-line options? you may ask.
Because for security reasons, you may want to hide how to connect to your
LDAP server. And as command-line options can be discovered by local users
(with 'ps auxwww' for instance), it's more secure to use a configuration
file for sensitive data. Keep the file only readable by root (chmod 600) .

Here's a sample configuration file:


LDAPServer ldap.c9x.org
LDAPPort   389
LDAPBaseDN cn=Users,dc=c9x,dc=org
LDAPBindDN cn=Manager,dc=c9x,dc=org
LDAPBindPW r00tPaSsw0rD
LDAPDefaultUID 500
LDAPForceDefaultUID False
LDAPDefaultGID 100
LDAPForceDefaultGID False

Well... the keywords should be self-explanatory, but here we go for some
details anyway:

- LDAPScheme is the scheme (aka protocol) to connect with to the LDAP server.
It defaults to 'ldap'. To connect to a server listening on TLS port, set it
to 'ldaps' (and change the port below).

- LDAPServer is the LDAP server name (hey!) . It defaults to 'localhost'.

- LDAPPort is the connection port. It defaults to 389, the standard port.
Port value should be changed for 'ldaps' connection (the TLS port for an
LDAP server is usually 636).

- LDAPBaseDN is the search starting point for users accounts. Your tree must
have posixAccount objects under that node.

- LDAPBindDN is the DN we should bind the server for simple authentication.
If you don't need authentication (ie. anonymous users can browse that part
of the LDAP directory), just remove that line.

- LDAPBindPW is the plaintext password to bind the previous DN. The
configuration file should be only readable by root if you are using
LDAPBindDN/LDAPBindPW.

- LDAPDefaultUID and LDAPDefaultGID are default values for objects without
any entry for them.

- LDAPForceDefaultUID and LDAPForceDefaultGID - These options both default to
`False`. Any value other than `True` (case insensitive) is also treated as
`False`.  When set these options cause the respective uid or gid value returned
by the LDAP server for a username to be ignored and instead use the value set
by `LDAPDefaultUID` or `LDAPDefaultGID`.  If the appropriate `LDAPDefaultXID`
option is not set, these options have no effect.

This is useful for allowing users to authenticate against LDAP but access or
create content with common a set of ownership/permissions.  It also provides a
measure of security in that it prevents pure-ftpd processes from being created
with arbitrary uid/gids that may conflict with local accounts.

- LDAPFilter is the filter to use in order to find the object to authenticate
against. The special sequence \L is replaced with the login of the user. The
default filter is (&(objectClass=posixAccount)(uid=\L)) .

- LDAPHomeDir is the attribute to get the home directory ('homeDirectory' by
default) .

- LDAPVersion is the protocol version to use. Version 3 is recommended and
needed with OpenLDAP servers. It is the default.

- LDAPUseTLS can be True or False. True means that the server should use TLS
to connect to the LDAP server over ldap protocol. This property has no effect
when ldaps protocol is used, as the connection is inherently secured with TLS.
This was introduced in pure-ftpd 1.0.37.

- LDAPAuthMethod can be BIND (experimental, but default if there is no
LDAPBindDN) or PASSWORD (default if a LDAPBindDN is set). The former tries
to authenticate users by binding, thus allowing to use an unprivileged LDAP
account. The later requires a privileged LDAP accounts and the FTP server
itself checks against the userPassword attribute.

In fact, the only mandatory keyword is LDAPBaseDN. Other keywords are
optional and defaults are ok for local testing.

Save the configuration file anywhere. Let's say /etc/pureftpd-ldap.conf .

Then, you have to run the pure-ftpd command with '-l ldap:' (it's an 'ell'
not a 'one') followed by the path of that configuration file. Here's an
example:


pure-ftpd -l ldap:/etc/pureftpd-ldap.conf -B

You can mix different authentication methods. For instance, if you want to
use system (/etc/passwd) accounts when an account is not found in a LDAP
directory, use -l ldap:/etc/pureftpd-ldap.conf -l unix


      ------------------------ THE LDAP SCHEMA ------------------------


Pure-FTPd uses the standard 'posixAccount' class to locate accounts. With
OpenLDAP, that class is defined in the 'nis' schema.

FTP login names should match 'uid' attributes of 'posixAccount' instances.
When a user logs in as 'joe', the following filter is used to locate Joe's
account:


                   (&(objectClass=posixAccount)(uid=joe))


Here's a sample entry in LDIF format:


dn: cn=Joe,dc=rtchat,dc=com
objectClass: posixAccount
cn: Joe
uid: joe
uidNumber: 500
gidNumber: 100
homeDirectory: /home/joe
userPassword: {scrypt}$7$C6..../....YzvCLmJDYJpH76BxlZB9fCpCEj2AbGQHoLiG9I/VRO1$/enQ.o1BNtmxjxNc/8hbZq8W0JAqR5YpufJXGAdzmf3


'userPassword' is the password hashed with the system 'crypt' function,
SCRYPT or ARGON2.

Please note that a login can only contains common characters: A...Z, a...z,
0...9, -, ., _, space, :, @ and ' . For paranoia purposes, other characters
are forbidden.

If you don't want to use posixAccount objects, you can edit src/log_ldap.h
to customize attribute names.


  ----------- EXTENDED LDAP SCHEMA (QUOTAS, THROTTLING, RATIOS) ----------


To enable quotas, download/upload rate throttling and/or download/upload
ratios, an extended LDAP schema is needed.  This modified schema also allows
you to completely enable and disable users' FTP access by simply changing
the "FTPStatus" field in their LDAP entry.

Simply copy the included pureftpd.schema file to your OpenLDAP schema
directory (/usr/local/etc/openldap/schema in this example) and add the
appropriate line to your slapd.conf, like so:


include         /usr/local/etc/openldap/pureftpd.schema


This schema defines a new objectClass, PureFTPdUser, which contains the
*OPTIONAL* status, quota, throttling and ratio fields as in the example
below:


dn: uid=Ichiro,dc=gmo,dc=jp
objectClass: PureFTPdUser
objectClass: posixAccount
cn: Ichiro
uid: Ichiro
uidNumber: 888
gidNumber: 888
homeDirectory: /home/ichiro
userPassword: {crypt}$1$w58NLo5z$NHhr6GzSPw0qxaxs3PAaK/
FTPStatus: enabled
FTPQuotaFiles: 50
FTPQuotaMBytes: 10
FTPDownloadBandwidth: 50
FTPUploadBandwidth: 50
FTPDownloadRatio: 5
FTPUploadRatio: 1

The example is mostly self-explanatory. FTPQuotaMBytes is the quota size in
megabytes. FTPDownloadBandwidth and FTPUploadBandwidth are in KB/sec.

FTPStatus should be either "enabled" or "disabled". If the FTPStatus field
exists and is set to anything except "enabled", the user will not be
permitted to log in. If the FTPStatus field does not exist, the user *WILL*
be allowed to log in as normal, to allow LDAP users without the PureFTPdUser
objectClass.

There are also optional FTPuid and FTPgid attributes. If present, they will
override uidNumber and gidNumber values, so that you can have different
uid/gid mapping for FTP and for other services.

Please note that all of the FTP* LDAP fields are optional for the
PureFTPdUser objectClass. You can have a user with just FTPQuotaFiles and
FTPQuotaMBytes set, for example, if you only wish to enforce a quota, but
not throttle the user's bandwidth or enforce ratios.

Of course, you must make sure to enable the features you wish to use at
compile time (--with-quotas, --with-throttling, --with-ratios) .


      ------------------------ ANONYMOUS USERS ------------------------


If you want to accept anonymous users on your FTP server, you don't need to
have any 'ftp' user in the LDAP directory. But you need to have a system
'ftp' account on the FTP server.


        ------------------------ ROOT USERS ------------------------


If an LDAP user entry has a root (0) uidNumber and/or gidNumber, Pure-FTPd
will refuse to log them in.

Without this preventive restriction, if your LDAP server ever gets
compromised, the attacker could also easily compromise the FTP server.


           ------------------------ ARGON2 ------------------------


Password hashed with argon2i and argon2id can be used, provided that pure-ftpd
was linked to libsodium.

They are expected to be provided as a string, as returned by the
crypto_pwhash_str() function or by its bindings.


           ------------------------ SCRYPT ------------------------


Password hashed with scrypt can be used, provided that pure-ftpd was linked to
libsodium.

They are expected to be provided in escrypt format, as returned by the
crypto_pwhash_scryptsalsa208sha256_str() function or by its bindings.

For example, the string $7$C6..../....YzvCLmJDYJpH76BxlZB9fCpCEj2AbGQHoLiG9I/VRO1$/enQ.o1BNtmxjxNc/8hbZq8W0JAqR5YpufJXGAdzmf3
would verify the password "test".
PK     ¼ 0]Rc*ô	  ô	    pureftpd.schemanu „[µü¤        #
# pureftpd.schema
#
# Pure-FTPd User LDAP Schema
# See README.LDAP in the Pure-FTPd documentation for more information.
#
# Written by Ben Gertzfield <che =AT= debian -DOT- org>
#

## Pure-FTPd-related LDAP attributes

attributetype ( 1.3.6.1.4.1.6981.11.3.1 NAME 'FTPQuotaFiles'
        DESC 'Quota (in number of files) for an FTP user'
        EQUALITY integerMatch
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )

attributetype ( 1.3.6.1.4.1.6981.11.3.2 NAME 'FTPQuotaMBytes'
        DESC 'Quota (in megabytes) for an FTP user'
        EQUALITY integerMatch        
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )

attributetype ( 1.3.6.1.4.1.6981.11.3.3 NAME 'FTPUploadRatio'
        DESC 'Ratio (compared with FTPRatioDown) for uploaded files'
        EQUALITY integerMatch        
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )

attributetype ( 1.3.6.1.4.1.6981.11.3.4 NAME 'FTPDownloadRatio'
        DESC 'Ratio (compared with FTPRatioUp) for downloaded files'
        EQUALITY integerMatch        
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )

attributetype ( 1.3.6.1.4.1.6981.11.3.5 NAME 'FTPUploadBandwidth'
        DESC 'Bandwidth (in KB/s) to limit upload speeds to'
        EQUALITY integerMatch        
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )

attributetype ( 1.3.6.1.4.1.6981.11.3.6 NAME 'FTPDownloadBandwidth'
        DESC 'Bandwidth (in KB/s) to limit download speeds to'
        EQUALITY integerMatch        
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )

attributetype ( 1.3.6.1.4.1.6981.11.3.7 NAME 'FTPStatus'
        DESC 'Account status: enabled or disabled'
        EQUALITY caseIgnoreIA5Match
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )

attributetype ( 1.3.6.1.4.1.6981.11.3.8 NAME 'FTPuid'
        DESC 'System uid (overrides uidNumber if present)'
        EQUALITY integerMatch
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )

attributetype ( 1.3.6.1.4.1.6981.11.3.9 NAME 'FTPgid'
        DESC 'System uid (overrides gidNumber if present)'
        EQUALITY integerMatch
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )

## New Pure-FTPd object type

objectclass ( 1.3.6.1.4.1.6981.11.2.3 NAME 'PureFTPdUser'
        DESC 'PureFTPd user with optional quota, throttling and ratio'
        SUP top AUXILIARY
        MAY ( FTPStatus $ FTPQuotaFiles $ FTPQuotaMBytes $ FTPUploadRatio $ 
              FTPDownloadRatio $ FTPUploadBandwidth $ FTPDownloadBandwidth $
              FTPuid $ FTPgid ) )
PK     ¼ 0]å_©íÙ  Ù    pureftpd-ldap.confnu „[µü¤        
#############################################
#                                           #
# Sample Pure-FTPd LDAP configuration file. #
# See README.LDAP for explanations.         #
#                                           #
#############################################


# Optional: scheme to connect with to LDAP server. Default: ldap
# Other possible values: ldaps, ldapi, etc.
# Remember to set LDAPPort accordingly.

LDAPScheme ldap


# Optional: name of the LDAP server. Default: localhost

LDAPServer ldap.example.com


# Optional: server port. Default: 389

LDAPPort   389


# Mandatory: the base DN to search accounts from. No default.

LDAPBaseDN cn=Users,dc=c9x,dc=org


# Optional: who we should bind the server as.
# Default: binds anonymously or binds as 'ftp' user

LDAPBindDN cn=Manager,dc=c9x,dc=org


# Password if we don't bind anonymously
# This configuration file should be only readable by root

LDAPBindPW r00tPaSsw0rD


# Optional: default UID, when there's no entry in a user object

# LDAPDefaultUID 500


# Optional: default GID, when there's no entry in a user object

# LDAPDefaultGID 100


# Filter to use to find the object that contains user info
# \L is replaced by the login the user is trying to log in as
# The default filter is (&(objectClass=posixAccount)(uid=\L))

# LDAPFilter (&(objectClass=posixAccount)(uid=\L))


# Attribute to get the home directory
# Default is homeDirectory (the standard attribute from posixAccount)

# LDAPHomeDir homeDirectory


# LDAP protocol version to use
# Version 3 (default) is mandatory with recent releases of OpenLDAP.

# LDAPVersion 3


# Optional: use TLS to connect to the LDAP server
# Note: if ldaps scheme is used, this property has no effect
# LDAPUseTLS  True


# Can be PASSWORD or BIND.
# PASSWORD retrieves objects and checks against the userPassword attribute
# BIND tries to bind

LDAPAuthMethod PASSWORD


# Optional: default home directory if there's LDAPHomeDir entry

# LDAPDefaultHomeDirectory /var/shared

PK     ¼ 0]þl˜Èì  ì    README.MacOS-Xnu „[µü¤        

     ------------------------ OSX SPECIFIC NOTES ------------------------

The easiest way to install Pure-FTPd is to use Homebrew:

$ brew install pure-ftpd

Available options are:

--with-mysql
	Build with mysql support
--with-postgresql
	Build with postgresql support
--with-virtualchroot
	Follow symbolic links even for chrooted accounts


To get Pure-FTPd authenticate against system users on OSX, you have to
use PAM.
       
$ ./configure --with-pam <your other favorite options like --with-everything>
$ make install-strip

  Create a /etc/pam.d/pure-ftpd file:
 
# pure-ftpd: auth account password session
auth       required       pam_opendirectory.so
account    required       pam_permit.so
password   required       pam_deny.so
session    required       pam_permit.so

  Start the FTP server:

$ /usr/local/sbin/pure-ftpd -lpam -B
 

To take advantage of Bonjour, please add --with-bonjour to ./configure
switches and give the server a Bonjour service name with the -v (--bonjour=)
switch.
PK     ¼ 0]ô|yk   k     README.PGSQLnu „[µü¤        
       ----------------------- PostgreSQL SUPPORT ------------------------


When PostgreSQL is enabled, all account info are fetched from a central
Postgres database.

To compile the server with PostgreSQL support, you first have to build and
install the PostgreSQL client libraries. PostgreSQL is freely available from
http://www.postgresql.org/ and binary packages are included in many major
distributions. But if you choose a binary form, don't forget to also install
the development packages if they are available separately.

Then, configure Pure-FTPd with --with-pgsql and your favorite extra gadgets:


    ./configure --with-pgsql --with-everything


If your PostgreSQL libraries are installed in a special path, you can specify
it like this:


    ./configure --with-pgsql=/opt/pgsql


In this example, headers (like pgsql.h) will be searched in
/opt/pgsql/include and /opt/pgsql/include/pgsql, while related libraries
will be searched in /opt/pgsql/lib and /opt/pgsql/lib/pgsql .

Then, install the server as usual:


                                 make install


 ------------------------ PGSQL CONFIGURATION FILE ------------------------
           

Before running the server, you have to create a configuration file. Why a
configuration file instead of simple command-line options? you may ask.
Because for security reasons, you may want to hide how to connect to your
PostgreSQL server. And as command-line options can be discovered by local users
(with 'ps auxwww' for instance), it's more secure to use a configuration
file for sensitive data. Keep it readable only by root (chmod 600) .

Here's a sample configuration file:

PGSQLServer     localhost
PGSQLPort       5432
PGSQLUser       root
PGSQLPassword   rootpw
PGSQLDatabase   pureftpd
PGSQLCrypt      cleartext
PGSQLGetPW      SELECT "Password" FROM "users" WHERE "User"='\L'
PGSQLGetUID     SELECT "Uid" FROM "users" WHERE "User"='\L'
PGSQLGetGID     SELECT "Gid" FROM "users" WHERE "User"='\L'
PGSQLGetDir     SELECT "Dir" FROM "users" WHERE "User"='\L'

Have a look at the sample pureftpd-pgsql.conf configuration file for
explanations of every keyword.

Save the configuration file anywhere. Let's say /etc/pureftpd-pgsql.conf .

Then, you have to run the pure-ftpd command with '-l pgsql:' (it's an 'ell'
not a 'one') followed by the path of that configuration file. Here's an
example:

pure-ftpd -l pgsql:/etc/pureftpd-pgsql.conf -B


You can mix different authentication methods. For instance, if you want to
use system (/etc/passwd) accounts when an account is not found in a PostgreSQL
database, use -l pgsql:/etc/pureftpd-pgsql.conf -l unix


     ------------------------ TABLES STRUCTURES ------------------------
     
     
Pure-FTPd is very flexible and users can be stored in any way in SQL tables.
You just have to have fields with the following info:

- The user's login.

- The user's password, hashed using argon2, scrypt or crypt(3).
Pure-FTPd also accepts the "any" value for the PGSQLCrypt field.
With "any", all hash functions are sequentially tried.

* RECOMMENDATION: Do not use plaintext. Unless your system provides a
decent crypt() function, use a PostgreSQL function to verify the hashed
password or use argon2/scrypt.

- The system uid to map the user to. This can be a numeric id or a user
name, looked up at run-time.

- The system gid (numeric or not) .

- The home directory.

Here's a dump of a simple table to handle this:

CREATE TABLE "users" (
  "User" TEXT NOT NULL,
  "Password" TEXT NOT NULL,
  "Uid" INTEGER NOT NULL default '-1',
  "Gid" INTEGER NOT NULL default '-1',
  "Dir" TEXT NOT NULL,
  PRIMARY KEY ("User")
) WITHOUT OIDS;

Uid and Gid can be VARCHAR instead of INTEGER if you want to use names instead
of values.

Then, in the pureftpd-pgsql.conf configuration file, you have to provide SQL
templates to fetch the needed info.

Let's take the previous example:

PGSQLGetPW      SELECT "Password" FROM "users" WHERE "User"='\L'
PGSQLGetUID     SELECT "Uid" FROM "users" WHERE "User"='\L'
PGSQLGetGID     SELECT "Gid" FROM "users" WHERE "User"='\L'
PGSQLGetDir     SELECT "Dir" FROM "users" WHERE "User"='\L'

For each query:

\L is replaced by the login of a user trying to authenticate.
\I is replaced by the IP address the client connected to.
\P is replaced by the port number the client connected to.
\R is replaced by the remote IP address the client connected from.
\D is replaced by the remote IPv4 address, as a long decimal number.

You can mix all of these to store info in various tables. For instance, with
\I, you can have a different table for every domain, so that joe@domain1
won't be the same account than joe@domain2 . And with \R, you can restrict
one account to one specific address.

Please note that a login can only contains common characters: A...Z, a...z,
0...9, -, ., _, space, :, @ and ' . For security purposes, other characters
are forbidden.

You can also remove uid and gid fields in your tables and use default
values instead (thus saving useless lookups) . Two directives are
useful to serve that purpose: PGSQLDefaultUID and PGSQLDefaultGID.

Obvious example:

PGSQLDefaultUID 1000
PGSQLDefaultGID 1000

Using these directives overrides PGSQLGetUID and PGSQLGetGID.


           ------------------------ ARGON2 ------------------------


Password hashed with argon2i and argon2id can be used, provided that pure-ftpd
was linked to libsodium.

They are expected to be provided as a string, as returned by the
crypto_pwhash_str() function or by its bindings.


           ------------------------ SCRYPT ------------------------


Password hashed with scrypt can be used, provided that pure-ftpd was linked to
libsodium.

They are expected to be provided in escrypt format, as returned by the
crypto_pwhash_scryptsalsa208sha256_str() function or by its bindings.

For example, the string $7$C6..../....YzvCLmJDYJpH76BxlZB9fCpCEj2AbGQHoLiG9I/VRO1$/enQ.o1BNtmxjxNc/8hbZq8W0JAqR5YpufJXGAdzmf3
would verify the password "test".


     ------------------------ PER-USER SETTINGS ------------------------


Individual settings can be set for every user, using optional queries.

- PGSQLGetQTAFS is the maximal number of files a user can store in his home
directory.

Example:
PGSQLGetQTAFS SELECT "QuotaFiles" FROM "users" WHERE "User"='\L'

- PGSQLGetQTASZ is the maximal disk usage, in Megabytes.

Example:
PGSQLGetQTASZ SELECT "QuotaSize" FROM "users" WHERE "User"='\L'

- PGSQLGetRatioUL and PGSQLGetRatioDL are optional ratios.

Example:
PGSQLGetRatioUL SELECT "ULRatio" FROM "users" WHERE "User"='\L'
PGSQLGetRatioDL SELECT "DLRatio" FROM "users" WHERE "User"='\L'

- PGSQLGetBandwidthUL and PGSQLGetBandwidthDL are optional upload and
download bandwidth restrictions. Returned values should be in KB/s.

Example:
PGSQLGetBandwidthUL SELECT "ULBandwidth" FROM "users" WHERE "User"='\L'
PGSQLGetBandwidthDL SELECT "DLBandwidth" FROM "users" WHERE "User"='\L'


      ------------------------ ANONYMOUS USERS ------------------------


If you want to accept anonymous users on your FTP server, you don't need to
have any 'ftp' user in the PGSQL directory. But you need to have a system
'ftp' account on the FTP server.


        ------------------------ ROOT USERS ------------------------


If a PGSQL user entry has a root (0) uid and/or gid, Pure-FTPd will refuse
to log them in.

Without this preventive restriction, if your PGSQL server ever gets
compromised, the attacker could also easily compromise the FTP server.

Security barriers are also implemented to avoid bad implications if wrong
data types (eg. binary blobs instead of plain text) are fetched with SQL
queries.


Hint:

PostgreSQL supports views and it's common practice to define a new DB
user, e.g., ftpd and a view of the 'real' user database with just the
bits that the server needs. E.g., if you have virtual domains you
could use:

create view vftpd as select u.vuser, u.domain, u.passwd, d.uid, d.gid,
'/virtual/' || u.domain || '/' || u.vuser || '/./' as homedir
from vusers as u, vdomains as d where u.domain = v.domain;

grant select on vftpd to ftpd;

The definition of homedir shows how views can be used to enforce a
canonical form for home directories - nothing short of defining this
view will allow a user to drop the chroot from their home directory.
PK     ¼ 0]dýR‘'  '    FAQnu „[µü¤        
                         FREQUENTLY ASKED QUESTIONS
                         
             --------------------------------------------------


* Users can delete root-owned files?

-> I have a directory owned by 'john', but I've put some files owned by
'root' (or another user) in it. However, I noticed that John can delete
these files!

Yes, this is the standard Unix behavior: the owner of a directory can do
whatever he likes to do in his directory, regardless of who owns the file in
it. If you want to have immutable files, check for such a feature in your
operating system.

For instance, on Linux filesystems, "chattr +i <file>" does the trick.
On BSD systems, try "chflags schg <file>" .


* Directories shared by multiple users.

-> I have a "public" directory. All users can download and upload files
from/to this directory. Permissions are 777 on it. But user 'john' can
delete files owned by user 'joe'. How to prevent this?

Put the sticky bit on that directory: chmod 1777 public. That way, the
directory remains public (read/write), but people can only delete files they
own.


* Restricting directory visibility.

-> I want that people only see their home directory and their own files. I
don't want them to look at my systems files.

This feature is called "chroot". You can enable this by running pure-ftpd
with the "-A" switch to do this with ALL your users (but root) .

You can alternatively use "-a <gid>" to have a "trusted group". Everyone
will be caged, EXCEPT members of that group.

Don't use -a <gid> and -A together.

Another way is to selectively choose what users you want to chroot. This can
be done with the /./ trick (see the README file about this) or with virtual
users.


* Shared directories and chroot.

-> I have a directory, say /var/incoming, that I want to be shared by every
user. But I want my users to be chrooted. So /var/incoming should be visible
in 'joe' and 'john' accounts, but those are chrooted. So, how to have the
content of /var/incoming visible in these accounts?

Making a symbolic link won't work, because when you are chrooted, it means
that everything outside a base directory (your user's home directory) won't
be reachable, even though a symbolic link.

But all modern operating systems can mount local directories to several
locations. To have an exact duplicate of your /var/incoming directory
available in /home/john/incoming and /home/joe/incoming, use one of these
commands:

* Linux   : mount --bind /var/incoming /home/john/incoming
            mount --bind /var/incoming /home/joe/incoming

* Solaris : mount -F lofs /var/incoming /home/john/incoming
            mount -F lofs /var/incoming /home/joe/incoming

* FreeBSD : mount_null /var/incoming /home/john/incoming
            mount_null /var/incoming /home/joe/incoming

Another alternative is to compile Pure-FTPd with --with-virtualchroot as a
./configure option. With virtual chroot, symbolic links pointing outside a
chroot jail *are* followed.

Binary packages are compiled with this feature turned on.


* Tar and/or gzip on the fly

-> Is it possible to use a command like "get directory.tar" as with Wu-FTPd
? (Sven Goldt)

Unfortunately, no. Server-side gzip/tar creation is not a present nor a
planned feature. It has been responsible of severe security flaws in Wu-ftpd
and BSD ftpd, it can take a lot of server resource (denial-of-service) and
it's a pain to set up (chrooted environment => need to add /etc /lib /bin
directories, /dev on some platforms, etc) .


* How to restrict access to dot files ?

-> Is there an option to prevent people from accessing "." files/dirs (such
as .bash_history, .profile, .ssh ...) EVEN if they are owned by the user ?
(William Kern)

Yes. '-x' (--prohibitdotfileswrite) denies write/delete/chmod/rename of
dot-files, even if they are owned by the user. They can be listed, though,
because security through obscurity is dumb and software shouldn't lie to
you. But users can't change the content of these files.

Alternatively, you can use '-X' (--prohibitdotfilesread) to also prevent
users from READING these files and going into directories that begin with
"." .


* Log files

-> Where does logging info go ? How to redirect it to a specific file ? How
to suppress logging ?

Log messages are sent to the syslog daemon. The syslog daemon is often
called syslogd or syslog-ng. He's in charge of dispatching logging events
from various programs to log files, according to a "facility" (category) and
a "priority" (urgency: debug, info, warning, error, critical...) .

Pure-FTPd logging messages are send with the "ftp" facility by default (or
"local2" on some older systems without the "ftp" facility) . Unless you told
the syslogd to redirect messages with the "ftp" facility to a specific file,
the messages will be merged into /var/adm/messages, /var/log/messages,
/var/adm/syslog or /var/log/syslog.

Check /etc/syslogd.conf. You should have a line like:

*.*;mail.none;news.none -/var/log/messages

just add ftp.none:

*.*;ftp.none;mail.none;news.none -/var/log/messages

And if you want FTP info go in a specific file, just add:

ftp.* /var/log/ftp

and all FTP messages will go in /var/log/ftp . And only there.

The facility can be changed if you add the -f <facility> option to pure-ftpd
(or --facility=<facility>) .
To completely disable logging, use -f none (or --facility=none) . If you
don't read your log files, it's recommended: it will improve performance
and reduce disk I/O.


* How to prevent your partitions to be filled

-> Is it possible to forbid new uploads when the disk is almost full ?
(Cyberic)

Use the "-k" (--maxdiskusagepct) flag. If you add -k 95 , no new upload can
occur if your partition if more than 95% full.


* Firewalling

-> My FTP server is behind a firewall. What ports should I open?

First, you have to open port 21 TO the FTP server. You also have to allow
connections FROM (not to) ports <= 20 (of the FTP server) to everywhere.
That's enough to handle the "active" mode. But that's not enough to handle all
types of clients. Most clients will use another mode to transmit data called
'passive' mode. It's a bit more secure than 'active' mode, but you need to
open more ports on your firewall to have it work.

So, open some ports TO the FTP server. These ports should be > 1023. It's
recommended to use at least twice the max number of clients you are
expecting. So, if you accept 200 concurrent sessions, opening ports 50000 to
50400 is ok.

Then, run pure-ftpd with the '-p' switch followed by the range configured in
your firewall. Example: /usr/local/sbin/pure-ftpd -p 50000:50400 &

Unlike some popular belief, the MORE opened ports you have for passive FTP,
the MORE your FTP server will be secure, because the LESS you are vulnerable
to data hijacking.

If your firewall also does network translation (NAT), you have to enable
port forwarding for all passive ports.

On the client side, if a client if behind a firewall, that firewall must
understand the FTP protocol. On Linux firewalls (iptables), just load
the ip_conntrack_ftp and ip_nat_ftp modules. On OpenBSD, ISOS and
FreeBSD 5 firewalls (PF), redirect all traffic to port 21, to ftp-proxy.


* Unable to log in (unix authentication)

-> I'm using simple Unix authentication. No PAM, no puredb, no MySQL, no
LDAP. Anonymous FTP works, but I can't log in as any other user. It keeps
saying "authentication failed".

To log in, the shell assigned to your users must be listed in the
/etc/shells file. The exact path should be there, even for fake shells like
/etc or /bin/true.

Also double check that you have a carriage return after the last line in
/etc/shells.


* Network filesystems.

-> I have a strange problem on Linux or FreeBSD. Uploading a file works
fine, but downloading a file only create 0-byte files. On the server, these
files are on NFS/Novell shares/Appletalk shares/Coda/Intermezzo/SMB volumes.

By default, pure-ftpd uses zero-copy networking in order to increase
throughput and reduce the CPU load. But zero-copy doesn't work with all
filesystems, especially network filesystems.

You have to disable zero-copy if you want to serve files from a network FS
or from a TMPFS virtual disk.

To disable zero-copy, recompile pure-ftpd with ./configure --without-sendfile


* Solaris and chroot.

-> When I ftp to my Solaris server, I get this as an answer to 'ls':
"425 Can't create the data socket: Bad file number."

On Solaris, to get chroot to work with pure-ftpd you need a dev directory
in your new rootdir with these:

crw-rw-rw-   1 root     other     11, 42 Dec 10 15:02 tcp
crw-rw-rw-   1 root     other    105,  1 Dec 10 15:02 ticotsord
crw-rw-rw-   1 root     other     11, 41 Dec 10 15:03 udp
crw-rw-rw-   1 root     other     13, 12 Dec 10 15:03 zero

(Reported by Kenneth Stailey)


* Upgrading.

-> Can anyone explain how to update Pureftpd (from source), without having
to change all my settings etc. (Simon H)

1) get the source code and unpack it. 
2) ./configure it with your favorite options 
3) make 
4) rm -f /usr/local/sbin/pure-ftpd 
5) make install-strip 
6) if you run pure-ftpd from inetd,tcpserver,xinetd, etc: nothing left to do. You have it upgraded. 
7) if you run it standalone, stop the server: 
                     kill $(cat /var/run/pure-ftpd.pid)
then launch it again: 
                         /usr/local/sbin/pure-ftpd &
                         

* FTP over SSH.

-> How to run Pure-FTPd over SSH? I want to encrypt all connection data
(including passwords) .

FTP-over-SSH is a nice alternative over FTP-over-TLS (impossible to securely
firewall) and SFTP (which is slower, but only uses one port) .

Customers using Windows can use FTP-over-SSH with the excellent Van Dyke's
SecureFX client (http://www.vandyke.com) . It doesn't require any special
knowledge: just tell your customer to check "FTP-over-SSH2" in the
"Protocol" listbox when creating an account for your FTP server.

On the server side, here's how to manage FTP-over-SSH accounts:

1) Add /usr/bin/false to your /etc/shells file (on some systems, it's
/bin/false) .

2) To create a FTP-over-SSH account, create a system account with /dev/null
as a home directory and /usr/bin/false as a shell. You don't need a
dedicated uid: the same uid can be reused for every FTP-over-SSH account.

3) Create a virtual user account for that user (either with PureDB, SQL or
LDAP) . Give that virtual user a real home directory and only allow
connections coming from 127.0.0.1 (all FTP-over-SSH sessions will come from
localhost, due to SSH tunneling) .

People with no home directory (/dev/null) and no valid shell
(/usr/bin/false) won't be able to get a shell nor to run any command on your
server. But they will be granted FTP-over-SSH sessions.

Here are examples (Linux/OpenBSD/ISOS commands, translate them if necessary) .

1) Creating a regular FTP account:

pure-pw useradd customer1 -m -d /home/customer1 -u ftpuser

2) Creating a FTP-over-SSH account (non-encrypted sessions are denied):

useradd -u ftpuser -g ftpgroup -d /dev/null -s /usr/bin/false customer2
pure-pw useradd customer2 -m -d /home/customer2 -u ftpuser -r 127.0.0.1/32

3) Creating an account who can use regular (unencrypted) FTP from the
internal network (192.168.1.x), but who must use FTP-over-SSH when coming
from an external network (internet):

useradd -u ftpuser -g ftpgroup -d /dev/null -s /usr/bin/false customer3
pure-pw useradd customer3 -m -d /home/customer3 -u ftpuser \
        -r 127.0.0.1/32,192.168.1.0/24


* Virtual users: /etc/pureftpd.pdb .

-> I made changes to /etc/pureftpd.passwd but the server doesn't understand
them: I can't access any account I just created.

The server never reads /etc/pureftpd.passwd directly. Instead, it reads
/etc/pureftpd.pdb (or whatever file name you gave after -lpuredb:...) .

This file is a copy of /etc/pureftpd.passwd, but in a binary format,
optimized for fast lookups.

After having made a manual change to /etc/pureftpd.passwd, you must rebuild
/etc/pureftpd.pdb with the following commands:

pure-pw mkdb

If you add/delete/modify user accounts with pure-pw useradd/usermod/userdel/
passwd, don't forget the '-m' option to automatically rebuild
/etc/pureftpd.pdb and not only update /etc/pureftpd.passwd .


* Giving access to dot-files.

-> I don't want my users to read files beginning with a dot. Except one file
I'd like to give 'John' read (and maybe write) access to.

Create a symbolic link in John's account, pointing to the dot-file. Example:

ln -s .bashrc bashrc

John will be able to access ".bashrc" through the symbolic link, "bashrc".


* Initial banner.

-> How do I display a customized message before the login prompt?

Compile with --with-cookie and run the server with -F <file name> . In that
file, put a nice customized banner message.


* Internet Explorer.

-> Internet Explorer doesn't show any login box.

IE does a very strange trick to detect whether an FTP server does accept
anonymous connections or not. Basically, it connects to the server and logs
in as 'anonymous'. But if you say 'no' at this point, it drops the
connections with an error. You have to say 'ok, anonymous users are
allowed' and then, when a dummy password ('IE@') is sent, you say 'ah
ehm... finally... no... anonymous users aren't allowed' . Silly. To play
that game, you must run pure-ftpd with the -E (non-anonymous server) and -b
(compatibility with broken clients) flags. Then, the magic popup will show
up. But please note that IE (and browsers at large) are usually bad FTP
clients.

-> Internet Explorer doesn't want to log in. (Matthew Enger)

Check that the max number of connections (either per user or per IP) is at
least 2. IE needs two connections to connect to an FTP server.


* Passwords and pure-pw scripting.

-> I would like to create virtual users with a shell-script.  if i us
pure-pw useradd ..... it always asks for the new password. is there any
command-line option which tells pure-pw the password (like useradd ftp-user
ftp-password -m) ? (at1ce) .

Giving cleartext (and badly one-way hashed) passwords through command-line
switches is a bad idea. Because users could issue a simple 'ps' command and
discover these passwords.

One way to enter a password (not from the keyboard) is to put the password
twice in a temporary file, then redirect that file to stdin. Example:

pure-pw useradd john -d /tmp/john -u ftpuser -m < ~/tmp/passfile

And in ~/tmp/passfile, have something like:

john's password
john's password

If you really need to avoid a temporary file and if nobody but you can log
on the machine, you can always do this:

(echo blahblah; echo blahblah) | pure-pw useradd john -d /tmp/john -u ftpuser


* Altlog and pure-uploadscript don't work.

-> pure-uploadscript doesn't run anything. Alternative logging methods (CLF,
stats, W3C...) create a logfile, but it always stays empty.

Maybe your operating system has a buggy realpath() implementation. Some
old Solaris and Linux versions are known to have such a bug.
Try to recompile pure-ftpd, but run ./configure with the --with-brokenrealpath
switch first.


* The server starts, but doesn't listen to any port?

-> The server is properly running, I see it in the process list, but any try
to connect to the configured port (or port 21 by default) fails. The socket
isn't even open.

Check two things :

- If you are running a BSD system and you want to listen to IPv4 addresses,
check that the "-4" switch ("IPV4Only" in config file) is enabled.

- If you upload script are enabled ("-o", or "CallUploadScript"), make sure
that the pure-uploadscript is started. Or the FTP server will actually wait
until pure-uploadscript is actually ready to process new uploads. If you don't
need the uploadscript facility, remove "-o".


* Double slash.

-> Why do I see double slashes in log files? For instance, the path of a
downloaded file looks like /home/john//pictures/zok.jpg .

'//' is a symbol for the limit of the chroot jail. In that example, it means
that John is caged in /home/john/ .


* ftpwho as a non-root user.

-> How do I give access to the 'pure-ftpwho' command to non-root users?

The 'pure-ftpwho' command is restricted to root by default, because users
probably shouldn't be given the ability to spy what other users are doing on
the same host. However, it's safe to put the setuid bit on that command, in
order to have it work as any user:

                   chmod 4711 /usr/local/sbin/pure-ftpwho


* Changing bandwidth throttling on-the-fly.

-> Is it possible to change the bandwidth allocated to a user during a
transfer, so that the change takes place immediately?

Unfortunately, no. Or at least not at pure-ftpd level. Doing so would need
to re-read user's parameters all the time and it would be horribly slow.
Other mechanisms would work, like signals to interrupt transfers, re-read
parameters, then resume. But it would introduce a lot of complexity to the
code.

If you're using a modern operating system like OpenBSD, ISOS or Linux,
your kernel already includes a fair TCP/IP traffic shaper. And because it
works at kernel-level, you can easily change the bandwidth allowed to IPs or
services on-the-fly. Have a look at pf.conf(5) OpenBSD, ISOS and FreeBSD 5,
and at tc (or read the Linux networking HOWTO) on Linux.
Also see the 'Global bandwidth limitation' section later in this document.


* KERBEROS_V4 rejected as an authentication type.

-> It works and I can log in, but I receive these strange error messages at
log in, even in a non-chrooted environment: 

220 FTP server ready. 
502 Security extensions not implemented 
502 Security extensions not implemented 
KERBEROS_V4 rejected as an authentication type 

Why and what do they mean?

This is a Linux-specific instllation issue. It means that your command-line
FTP client isn't a normal one, but a Kerberos FTP client. You probably
installed RPMs for Kerberos, although you don't use it.  These messages are
harmless as Kerberos clients will fallback to normal FTP (after these
errors), but you just have to deinstall Kerberos on your client host to have
'ftp' work without these messages.


* Wrong group ownership.

-> I have a user called 'john' whose group is 'johngroup'. When John
uploads a file, that one belongs to 'john', but to another group like
'wheel' (whose John isn't a member of). What's wrong?

This is a BSD standard behavior (verified on OpenBSD, ISOS, DragonflyBSD and
FreeBSD): when a new file is created, the group is inherited from the parent
directory. On other systems (like GNU/Linux), files are owned by the primary
group of the user, unless the directory has the setgid bit set.

If you want new files uploaded in John's directory to belong to group
'johngroup', have that directory (and probably also subdirectories) belong
to 'johngroup':

chgrp -R johngroup /home/john


* Compilation with MySQL.

-> I can't compile with MySQL. ./configure says that MySQL libraries aren't
properly installed.

The libmysqlclient.so file should be in a path known by your dynamic linker.
For instance, on a GNU/Linux system, add the path to libmysqlclient.so file
(only the path, not the file itself) to /etc/ld.so.conf . Then, run
'ldconfig' .


* "Sorry, I can't trust you".

-> When a user tries to log in, he gets "Sorry, I can't trust you". But his
login/password pair is right. What wrong?

That message can means two things:

- The user has a shell that isn't listed in /etc/shells. You must add it,
even if it's a fake shell like /bin/false . Also make sure that you have a
carriage return after the last entry in /etc/shells.

- You are using the -u <uid> option to deny access to users whose uid is
below <uid> . But the user you are trying to log in as, has an uid in the
forbidden range.


* Customer-friendly configuration.

-> What switches do you recommend to start the server, for an hosting service?

Here's a good start:

--chrooteveryone \
--maxclientsperip=5 \
--displaydotfiles \
--noanonymous \
--minuid=100 \
--umask=022:022 \
--limitrecursion=10000:3 \
--customerproof


* Anonymous FTP with virtual users.

-> I successfully created a virtual user called 'ftp' or 'anonymous', but
anonymous FTP doesn't work.

Pure-FTPd never fetch any info from the virtual users backends (puredb,
MySQL, LDAP, etc) for anonymous sessions. There are three reasons not to do
so: - Speed: do we need to query a database just to get the anonymous
user's home directory? We don't need to retrieve any password for anonymous
sessions.
     - Consistency: with the virtual hosting mechanism.

To run an anonymous FTP server you must have a *system* account called
'ftp'. Don't give it any valid shell, just a home directory. That home
directory is the anonymous area.


* A basic setup.

-> I'm trying to set up a ftp server just for me and my family so we can get
and upload files when on the road. How can I make two users, say Jane and
Joe, who share the directory /home/ftp and /home/ftp/incoming. In /home/ftp
they only have read privs. and in /home/ftp/incoming they have read and
write privs.

Add a group for all FTP users (not mandatory, but more secure):

groupadd ftpgroup

Add an uid for all FTP users (idem, not mandatory, but better):

useradd -g ftpgroup -d /dev/null -s /etc ftpuser

Now, let's create /home/ftp and /home/ftp/incoming:

mkdir -p /home/ftp/incoming
chown -R root:ftpgroup /home/ftp/incoming
chmod -R 755 /home/ftp
chmod -R 1775 /home/ftp/incoming

Let's add Jane:

pure-pw useradd jane -m -u ftpuser -d /home/ftp

Let's add Joe:

pure-pw useradd joe -m -u ftpuser -d /home/ftp

Let's start the FTP server:

/usr/local/sbin/pure-ftpd -lpuredb:/etc/pureftpd.pdb -H -B

Everything should be ok now.

For more info about how to create new users, change passwords, etc.:
http://www.pureftpd.org/README.Virtual-Users


* Slow pure-ftpwho or slow login.

-> Sometimes, pure-ftpwho is slow to show the result. And sometimes, when an
user logs in, the session stucks a bit before he can get a directory listing.

This is probably caused by a slow DNS resolver. In order to display full
host names, pure-ftpd has indeed to make DNS queries that can be slow if you
link is slow, or if the client link is slow.

You can speed up pure-ftpwho and pure-ftpd with the -H switch. Names won't
be resolved, you will see IP addresses instead.


* Chrooted users can follow symlinks outside the chroot jail?

-> People can create symbolic links to '/' and escape their home directory!

There are two chroot implementations in pure-ftpd:

  - The traditional one, based upon your kernel chroot() system call. This
is the default. With that one, symbolic links can only point inside the
chroot jail, or they won't be followed.

  - The 'virtual chroot' implementation. With that feature, users *can*
follow all symbolic links, even when they don't point inside the jail. This
is very handy to set up directories shared by multiple users. Binary
packages are compiled with virtual chroot by default.

To enable the virtual chroot feature when you are compiling the server, use
the --with-virtualchroot with ./configure . If you want a restricted chroot,
don't include --with-virtualchroot.

Please note that the FTP server will never let people create new symbolic
links. Symbolic links have to be already there to be followed. Or if your
users can create symbolic links through Perl or PHP scripts, your hosting
platform is really badly configured. People can install any web file
browser, they don't need FTP to look at your system files. Recompile PHP
without POSIX functions and run all Perl scripts chrooted.


* How to start Pure-FTPd in background.

-> I start 'pure-ftpd' from an X terminal and the server properly
answers. However, as soon as I close the terminal, the server stops.

This is a shell dependent issue. Your shell is configured to close all
background jobs when leaving. You can change your shell options
(probably with a 'set' directive) or detach background jobs with the
'disown' keyword. Alternatively, you can just start pure-ftpd with the
-B switch in order to have it detach at startup time:

/usr/local/sbin/pure-ftpd -B


* Windows command-line FTP client and 'ls'.

-> With the command-line Windows FTP client, 'ls -la' doesn't return
any file.

The 'ls' command of an FTP client has nothing to do with the 'ls' command
started from an Unix shell.

With the command-line Windows client, typing 'ls' really sends the FTP
command 'NLST'. So when you type 'ls -la', it doesn't mean 'verbosely
list all files'. According to RFCs, it means 'list the file called -la' .
So you get what you asked for. If no file is called '-la', you get nothing.

If you want to play with regular expressions and switches, you should
type 'dir' (which is translated to 'LIST') instead. 'dir -la' is ok.

This is a bit illogical and that brain damage is specific to
Microsoft's command-line FTP client.

If you really want 'ls' to parse options, you can start pure-ftpd with
the -b (broken) switch.


* Global bandwidth limitation.

-> How do I limit the *total* bandwidth for FTP?

Pure-FTPd can limit bandwidth usage of every session. But limiting the total
bandwidth is intentionally not implemented, because most operating systems
already have very efficient algorithms to handle bandwidth throttling.

Here's an example with Linux.

1) Have a look at /proc/sys/net/ipv4/ip_local_port_range. You will see two
numbers: this is the interval of local ports your Linux kernel will use for
regular outgoing connections. The FTP ports you have to reserve for passive
FTP must *not* be in this range. So if:
"cat /proc/sys/net/ipv4/ip_local_port_range" returns "32768-61000", you can
reserve ports 10000 to 20000 for your FTP server, but not 30000 to 40000.
(alternatively, you can change the local port range) .

2) Change the first lines and save the following script:

  ---------------------------- Cut here ----------------------------
  
#! /bin/sh
# Simple bandwidth limiter - <j at pureftpd.org>

# Change this to your link bandwidth
# (for cable modem, DSL links, etc. put the maximal bandwidth you can
# get, not the speed of a local Ethernet link)
REAL_BW='10Mbit'

# Change this to the bandwidth you want to allocate to FTP.
# We're talking about megabits, not megabytes, so 80Kbit is
# 10 Kilobytes/s
FTP_BW='80Kbit'

# Change this to your physical network device (or 'ppp0')
NIC='eth0'

# Change this to the ports you assigned for passive FTP
FTP_PORT_LOW="10000"
FTP_PORT_HIGH="20000"

tc qdisc add dev "$NIC" root handle 1: cbq \
bandwidth "$REAL_BW" avpkt 1000

tc class add dev "$NIC" parent 1: classid 1:1 cbq bandwidth "$REAL_BW" \
rate "$REAL_BW" maxburst 5 avpkt 1000

tc class add dev "$NIC" parent 1:1 classid 1:10 cbq \
bandwidth "$REAL_BW" rate "$FTP_BW" maxburst 5 avpkt 1000 bounded

tc qdisc add dev "$NIC" parent 1:10 sfq quantum 1514b

tc filter add dev "$NIC" parent 1: protocol ip handle 1 fw flowid 1:10

iptables -t mangle -A OUTPUT -p tcp --sport 20:21 -j MARK --set-mark 1

iptables -t mangle -A OUTPUT -p tcp \
--sport "$FTP_PORT_LOW":"$FTP_PORT_HIGH" -j MARK --set-mark 1

  ---------------------------- Cut here ----------------------------
  
3) Make sure that you have the 'tc' command installed. If your Linux distro
doesn't ship 'ip' and 'tc' commands, it really sucks and you must install a
package called 'iproute2' to get them.

4) Start Pure-FTPd with the passive port range you assigned:

/usr/local/sbin/pure-ftpd -p 10000:20000 -HBA

5) Run the script you created in step 2. It it doesn't work, check that QOS
support was compiled in your Linux kernel.

6) Enjoy :)

Also have a look at :
http://www.docum.org
http://www.shorewall.net/traffic_shaping.htm and
http://talk.trekweb.com/~jasonb/articles/linux_tc_minihowto.shtml


* Linux, NTFS and Pure-FTPd.

-> On Linux, I can't transfer files from an NTFS partition.

Keep in mind that the NTFS filesystem is still an experimental beast in
Linux. Some basic operations are not implemented yet. Fortunately, a big
effort is being made and Linux 2.5 has a new NTFS implementation that fully
works with Pure-FTPd (try ./configure --without-sendfile, though) . And it
is more reliable and really faster than the old one. And even more
fortunately, the new NTFS implementation has been backported to recent 2.4.x
kernels. Have a look at http://linux-ntfs.sf.net/ .


* Slowdowns and lags.

-> Some users complains that transferring large files doesn't work. Transfers
are starting as expected, with a decent rate. But then, the speed dramatically
decreases, there are some serious lags and they often must disconnect (or the
client force them to do it, after a timeout) . The server is behind a firewall
that filters incoming ICMP, but let FTP ports in.

Don't, don't, don't filter ICMP. At least not blindly without understanding
what you are filtering. ICMP is part of the TCP/IP specifications. Filtering
it can have nasty side effects with no real win. If you even filter ICMP types
3 and 4, your firewall is definitely broken and this is probably why you have
such troubles with transfers of large files.

Please read these documents about ICMP filtering :
http://www.phildev.net/mss/index.html
http://alive.znep.com/~marcs/mtu/
http://www.freelabs.com/~whitis/isp_mistakes.html

Also some hardware routers don't properly handle window scaling. Try
to turn it off, for instance on Linux:
sysctl -w net.ipv4.tcp_window_scaling=0
sysctl -w net.ipv4.tcp_bic=0


* Firewalls and TLS.

-> My client is behind a stateful firewall doing applicative filtering (like
IPTables with ip_conntrack_ftp or ip_nat_ftp) . Connections to an TLS
enabled server doesn't work. Authentication works, but I'm unable to download
files nor list directories.

First, try to force your client to use the passive mode. In active mode, the
server has to connect to the client (or the NAT gateway) on a dynamic port
that is negotiated on the connection socket. But when TLS is used, that
connection socket is encrypted, therefore no man-in-the middle can see what
ports will be used to transfer data, including the firewall. There are some
proposals to work around this problem, but neither popular clients nor common
firewalls are aware of these tricks. Therefore, use the passive mode or switch
to SSH.


* TLS and error 00000000.

-> My TLS-enabled client doesn't work. It outputs something like :
"SSL connect: error:00000000:lib(0):func(0):reason(0)". What does it mean?

This error is not very explicit. You get it from some Unix clients like LFTP.
It actually means that there is a firewall or a NAT box between a TLS-enabled
server and a TLS-enabled client, but that firewall is unable to handle
encrypted FTP sessions. Unfortunately, there's no simple workaround against
this. Try to switch your client to active mode and use 1:1 NAT, but TLS,
firewalls and FTP don't mix very well.


* Slow TLS operations.

-> When clients connect with TLS encryption, listing directories and
downloading files are slow operations. Nothing happens after a command is
sent, things only start moving after a 5 secondes delay.

Check the host name of your certificate. It should be a fully-qualified host
name and if possible, it shouldn't be a CNAME entry.

Also check your DNS cache servers.


* Files getting renamed automatically
(submitted by C. Jon Larsen)

-> Sometimes when files get uploaded they are getting renamed to something
like "pureftpd.3f3300d2.33.0001". What is causing this ?

The ftp client that is being used to upload the files is using the STOU (Store
Unique) FTP command instead of the STOR FTP command. If you check the ftp
logfile you should see something like this in the logs:

(user@a.b.c.d) [DEBUG] Command [stou] [file_name_from_the_client.ext]
/var/ftp/ftpcustomer/pureftpd.3f3300d2.33.0001 uploaded (218168 bytes,
127.79KB/sec)

The STOU command tells the ftp client to begin the transmission of the file to
the remote site; the remote filename picked by the ftp server will be unique
within in the current directory that the ftp client is using. The response
from the server will include the filename.

The ftp client has an option like "create unique files" or "upload file with a
temporary name" enabled. You should have the ftp user uncheck this option.

Trying to disable the STOU command on the server side is not a good idea or
solution as some ftp clients will use STOU to upload a file with the
temporary, unique name, and then rename the file once the upload is complete.
This helps prevent failed uploads from leaving partial files around.
PK       ¼ 0]“x¿š  š                  README.Authentication-Modulesnu „[µü¤        PK       ¼ 0]ë¯ø“¸.  ¸.              ç  README.Virtual-Usersnu „[µü¤        PK       ¼ 0]%»òå                ãA  pureftpd-mysql.confnu „[µü¤        PK       ¼ 0]Ý~Nd  d              AO  README.Configuration-Filenu „[µü¤        PK       ¼ 0]Šú	’  ’              îS  pureftpd-pgsql.confnu „[µü¤        PK       ¼ 0]\¿Æþ*  þ*  
            Ã_  README.TLSnu „[µü¤        PK       ¼ 0]6’W÷"  ÷"              ûŠ  README.MySQLnu „[µü¤        PK       ¼ 0]Ô’@›R-  R-              .®  pure-ftpd.confnu „[µü¤        PK       ¼ 0]X§þ¥Æ'  Æ'              ¾Û  README.LDAPnu „[µü¤        PK       ¼ 0]Rc*ô	  ô	              ¿ pureftpd.schemanu „[µü¤        PK       ¼ 0]å_©íÙ  Ù              ò pureftpd-ldap.confnu „[µü¤        PK       ¼ 0]þl˜Èì  ì               README.MacOS-Xnu „[µü¤        PK       ¼ 0]ô|yk   k               7 README.PGSQLnu „[µü¤        PK       ¼ 0]dýR‘'  '              Þ: FAQnu „[µü¤        PK      ]  8º   