ProFTPd
From DD-WRT Wiki
Revision as of 07:07, 4 May 2007 (edit) Mcpat (Talk | contribs) ← Previous diff |
Revision as of 07:07, 4 May 2007 (edit) (undo) Mcpat (Talk | contribs) Next diff → |
||
Line 320: | Line 320: | ||
Don't use both methods. Either you start proftpd as standalone server, or you start proftpd via xinetd | Don't use both methods. Either you start proftpd as standalone server, or you start proftpd via xinetd | ||
- | If you have xinetd installed for other apps, and would like to start proftpd standalone then set in | + | If you have xinetd installed for other apps, and would like to start proftpd standalone then set in '''/opt/etc/xinetd.d/proftpd''' |
<pre>disable = yes</pre> | <pre>disable = yes</pre> |
Revision as of 07:07, 4 May 2007
by mcpat
Contents |
Requirements
First be sure that you have enough memory free. Because of this I describe the installation on SD-cards (/mmc). Additionally this procedure will show how to install even the needed ipkg packages on the SD-card.
It is also possible to replace every occurances of (/mmc) with (/jffs) if you have it enabled.
Preparation
Install first optware!
Then install xinetd
Then install proftpd
Installing optware
Make folder 'opt' in mmc:
mkdir /mmc/opt
Mounten von '/mmc/opt' with '/opt':
mount -o bind /mmc/opt /opt
Save script 'optware-pre-install.sh' to /opt, change rights to 755
Starting Script:
/opt/optware-pre-install.sh
optware-pre-install.sh:
#!/bin/sh # Optware pre-installation script, Leon Kos 2006 REPOSITORY=http://ipkg.nslu2-linux.org/feeds/optware/ddwrt/cross/stable TMP=/tmp PATH=/bin:/sbin:/usr/bin:/usr/sbin:/opt/bin:/opt/sbin unset LD_PRELOAD unset LD_LIBRARY_PATH _check_config() { echo "Checking system config ..." GATEWAY=$(netstat -rn | sed -n 's/^0.0.0.0[ \t]\{1,\}\([0-9.]\{8,\}\).*/\1/p' ) if [ -n "${GATEWAY}" ]; then echo "Using ${GATEWAY} as default gateway." else echo "Error: No default gateway set!" exit 2 fi if [ -s /etc/resolv.conf ]; then echo "Using the following nameserver(s):" if grep nameserver /etc/resolv.conf ; then GATEWAY_SUBNET=$(echo "${GATEWAY}" | sed 's/\.[0-9]\{1,3\}\.[0-9]\{1,3\}$//') if [ "${GATEWAY_SUBNET}" = "192.168" ]; then if grep -q ${GATEWAY} /etc/resolv.conf ; then echo "Gateway ${GATEWAY} is also nameserver." else echo "Warning: local nameserver is different than gateway!" echo "Check config or enter:" if test -L /etc/resolv.conf ; then echo " sed -i s/192.168.*/${GATEWAY}/ /tmp/resolv.conf" else echo " sed -i s/192.168.*/${GATEWAY}/ /etc/resolv.conf" fi echo "to correct this." fi fi else echo "Error: No nameserver specified in /etc/resolv.conf" exit 5 fi else echo "Error: Empty or nonexistent /etc/resolv.conf" exit 3 fi if mount | grep -q /opt ; then [ -d /opt/etc ] && echo "Warning: /opt partition not empty!" else echo "Error: /opt partition not mounted." echo "Enter" echo " mkdir /mmc/opt" echo " mount -o bind /mmc/opt /opt" echo "to correct this." exit 4 fi } _install_package() { PACKAGE=$1 echo "Installing package ${PACKAGE} ..." wget -O ${TMP}/${PACKAGE} ${REPOSITORY}/${PACKAGE} cd ${TMP} tar xzf ${TMP}/${PACKAGE} tar xzf ${TMP}/control.tar.gz cd / if [ -f ${TMP}/preinst ] ; then sh ${TMP}/preinst rm -f ${TMP}/preints fi tar xzf ${TMP}/data.tar.gz if [ -f ${TMP}/postinst ] ; then sh ${TMP}/postinst rm -f ${TMP}/postinst fi rm -f ${TMP}/data.tar.gz rm -f ${TMP}/control.tar.gz rm -f ${TMP}/control rm -f ${TMP}/${PACKAGE} } _check_config _install_package uclibc-opt_0.9.28-12_mipsel.ipk _install_package ipkg-opt_0.99.163-9_mipsel.ipk /opt/sbin/ldconfig /opt/bin/ipkg update /opt/bin/ipkg install -force-reinstall uclibc-opt /opt/bin/ipkg install -force-reinstall ipkg-opt
Installing xinetd
Installation of xinetd:
/opt/bin/ipkg install xinetd
Installing proftpd
Installation of proftpd-Server:
/opt/bin/ipkg install proftpd
Config Files
Proftpd
Use vi /opt/etc/proftpd.conf to open file
If you would like to use root only use the following:
# This is a basic ProFTPD configuration file (rename it to # 'proftpd.conf' for actual use. It establishes a single server # and a single anonymous login. It assumes that you have a user/group # "nobody" and "ftp" for normal operation and anon. ServerName "ProFTPD Default Installation" # ServerType standalone ServerType inetd DefaultServer on WtmpLog off # Port 21 is the standard FTP port. Port 21 # Umask 022 is a good standard umask to prevent new dirs and files # from being group and world writable. Umask 022 # To prevent DoS attacks, set the maximum number of child processes # to 30. If you need to allow more than 30 concurrent connections # at once, simply increase this value. Note that this ONLY works # in standalone mode, in inetd mode you should use an inetd server # that allows you to limit maximum number of processes per service # (such as xinetd). MaxInstances 10 <Global> RootLogin On RequireValidShell off AuthUserFile /etc/passwd AllowOverwrite on AllowRetrieveRestart on AllowStoreRestart on # TransferRate RETR 25 # TransferRate APPE,STOR 100:2048 </Global> # Set the user and group under which the server will run. # User nobody User root Group root # Group nobody # To cause every FTP user to be "jailed" (chrooted) into their home # directory, uncomment this line. #DefaultRoot ~ DefaultRoot /mmc/opt # Normally, we want files to be overwriteable. AllowOverwrite on # Bar use of SITE CHMOD by default <Limit SITE_CHMOD> DenyAll </Limit>
For anon login add the following in your vsftpd.conf file. Before you use this realize you will be giving anon login FULL ACCESS (untested!)
# A basic anonymous configuration, no upload directories. If you do not # want anonymous users, simply delete this entire <Anonymous> section. <Anonymous ~ftp> User ftp Group ftp # We want clients to be able to login with "anonymous" as well as "ftp" UserAlias anonymous ftp # Limit the maximum number of anonymous logins MaxClients 5 # We want 'welcome.msg' displayed at login, and '.message' displayed # in each newly chdired directory. DisplayLogin welcome.msg DisplayFirstChdir .message # Limit WRITE everywhere in the anonymous chroot <Limit WRITE> DenyAll </Limit> </Anonymous>
xinetd
/opt/etc/xinetd.conf
defaults { only_from = 0.0.0.0/0 instances = 60 log_type = SYSLOG authpriv info log_on_success = HOST PID log_on_failure = HOST cps = 25 30 } includedir /opt/etc/xinetd.d
Start scripts
Start script for proftpd (standalone server)
Please set following in the proftpd.conf
ServerType standalone
The following script starts proftpd (/opt/etc/init.d/S58proftpd):
#!/bin/sh # # Startup script for proftpd as standalone server # if [ -n "`pidof proftpd`" ]; then /bin/killall proftpd 2>/dev/null fi /opt/sbin/proftpd --config /opt/etc/proftpd.conf
Don't forget to give the execute privilege (chmod x start).
Don't forget to add following lines to the startup (Web interface->Administration->Diagnostic)
mount -o bind /mmc/opt /opt unset LD_LIBRARY_PATH unset LD_PRELOAD /opt/etc/init.d/S58proftpd
Start script for proftpd (via xinetd)
Please set following in the proftpd.conf
ServerType inetd
The following script starts xinetd (/opt/etc/init.d/S10xinetd):
#!/bin/sh OPTWARE_TARGET=ddwrt # # Startup script for xinetd # # Stop myself if running killall xinetd 2>/dev/null # Stop other inetd processes if running if [ ${OPTWARE_TARGET} = "nslu2" ] ; then killall inetd 2>/dev/null fi /opt/sbin/xinetd
The following script starts proftpd via xinetd (/opt/etc/xinetd.d/proftpd):
service ftp { flags = REUSE socket_type = stream instances = 30 wait = no user = root server = /opt/sbin/proftpd server_args = --config /opt/etc/proftpd.conf log_on_success = HOST PID log_on_failure = HOST disable = no }
Don't forget to give 0644 privilege (chmod 644 proftpd).
Don't forget to add following lines to the startup (Web interface->Administration->Diagnostic)
mount -o bind /mmc/opt /opt unset LD_LIBRARY_PATH unset LD_PRELOAD /opt/etc/init.d/S10xinetd
Notes
Don't use both methods. Either you start proftpd as standalone server, or you start proftpd via xinetd
If you have xinetd installed for other apps, and would like to start proftpd standalone then set in /opt/etc/xinetd.d/proftpd
disable = yes
Firewall settings
To get the FTP-Server enabled from WAN side add the following line to the firewall section:
/usr/sbin/iptables -I INPUT 1 -p tcp --dport 21 -j logaccept