rminsk
commented
9 years ago # Trace logging, disabled by default for performance reasons
#TraceLog /var/log/proftpd/trace.log
#Trace DEFAULT:0
SetEnv SERVER_STORAGE /mnt/dropbox01
ServerName "XXXXXX Dropbox"
ServerIdent on "XXXXXX Dropbox Server ready."
ServerAdmin "XXXXXXXXXXXXXX@XXXXXXXXXXXXXXXXX"
ServerType standalone
DefaultServer on
# Set the user and group under which the server will run
User nobody
Group nobody
# Don't use IPv6 support by default.
UseIPv6 off
# Umask 022 is a good standard umask to prevent new dirs and files
# from being group and world writable.
Umask 022
# Don't do reverse DNS lookups (hangs on DNS problems)
UseReverseDNS off
# To prevent DoS attacks, set the maximum number of child processes
# to 20. If you need to allow more than 20 concurrent connections
# at once, simply increase this value. Note that this ONLY works
# in standalone mode; in inetd mode you should use an inetd server
# that allows you to limit maximum number of processes per service
# (such as xinetd)
MaxInstances 20
# Disable sendfile by default since it breaks displaying the download speeds in
# ftptop and ftpwho
UseSendfile off
# Define the log formats
LogFormat default "%h %l %u %t \"%r\" %s %b"
LogFormat auth "%v [%P] %h %t \"%r\" %s"
# Display the README file when changing to a directory
DisplayChdir README
# Display logout message
DisplayQuit %{env:SERVER_STORAGE}/logout.msg
# Display login message after user has successfully logged in.
DisplayLogin %{env:SERVER_STORAGE}/login.msg
<Directory /*>
UserOwner nobody
GroupOwner nobody
</Directory>
<IfModule mod_dso.c>
# Allow only user root to load and unload modules, but allow everyone
# to see which modules have been loaded
ModuleControlsACLs insmod,rmmod allow user root
ModuleControlsACLs lsmod allow user *
<IfModule !mod_ifsession.c>
LoadModule mod_ifsession.c
</IfModule>
<IfModule !mod_facts.c>
LoadModule mod_facts.c
</IfModule>
<IfModule !mod_ldap.c>
LoadModule mod_ldap.c
</IfModule>
<IfModule !mod_ls.c>
LoadModule mod_ls.c
</IfModule>
<IfModule !mod_site_misc.c>
LoadModule mod_site_misc.c
</IfModule>
<IfModule !mod_clamav.c>
LoadModule mod_clamav.c
</IfModule>
<IfModule !mod_vroot.c>
LoadModule mod_vroot.c
</IfModule>
<IfModule !mod_facts.c>
LoadModule mod_facts.c
</IfModule>
<IfModule !mod_copy.c>
LoadModule mod_copy.c
</IfModule>
<IfModule !mod_site_misc.c>
LoadModule mod_site_misc.c
</IfModule>
<IfModule !mod_ctrls.c>
LoadModule mod_ctrls.c
</IfModule>
<IfModule !mod_ctrls_admin.c>
LoadModule mod_ctrls_admin.c
</IfModule>
</IfModule>
LDAPProtocolVersion 3
LDAPUsers ou=People,ou=admin,o=XXXX,ou=XXXXXXX,dc=XXXXXXXXXXXXX,dc=net
LDAPGroups ou=Group,ou=admin,o=XXXX,ou=XXXXXXX,dc=XXXXXXXXXXXXX,dc=net
LDAPSearchScope subtree
LDAPServer ldap01-la01.XXXXXXXXXXXXX.XXX:389 ldap02-la01.XXXXXXXXXXXXX.XXX:389
LDAPAuthBinds on
LDAPForceDefaultUID on
LDAPDefaultUID 99
LDAPForceDefaultGID on
LDAPDefaultGID 99
CreateHome on 755
LDAPGenerateHomedir on
LDAPForceGeneratedHomedir on
LDAPGenerateHomedirPrefix %{env:SERVER_STORAGE}/users
PersistentPasswd off
<IfModule mod_site_misc.c>
SiteMiscEngine on
</IfModule>
<IfModule mod_ident.c>
IdentLookups off
</IfModule>
DirFakeUser on ~
DirFakeGroup on ~
ShowSymlinks on
UseGlobbing on
<IfModule mod_vroot.c>
VRootEngine on
VRootAlias %{env:SERVER_STORAGE}/users/shared ~/shared
</IfModule>
<IfModule mod_clamav.c>
ClamAV on
ClamLocalSocket /var/run/clamd.dropbox/clamd.sock
</IfModule>
<IfModule mod_facts.c>
FactsAdvertise on
FactsOptions UseSlink
</IfModule>
<IfModule mod_site_misc.c>
SiteMiscEngine on
</IfModule>
<IfModule mod_ctrls.c>
ControlsEngine on
ControlsACLs all allow user root
ControlsSocketACL allow user *
ControlsLog /var/log/proftpd/controls.log
</IfModule>
<IfModule mod_ctrls_admin.c>
AdminControlsEngine on
AdminControlsACLs all allow user root
</IfModule>
AuthOrder mod_auth_file.c mod_ldap.c*
AuthGroupFile /etc/proftpd.group
RequireValidShell on
# Data I/O sees all of the dropbox structure
DefaultRoot %{env:SERVER_STORAGE} dataio
DefaultChdir %{env:SERVER_STORAGE}/users dataio
# Cause every FTP user except data I/O to be chrooted into their home directory.
DefaultRoot ~ !dataio
I am having using clamav with a chrooted setup. From the log after uploading the file walk.py.
The user in question is not in the dataio group. Server config in next comment.