ProFTPd

From DD-WRT Wiki

(Difference between revisions)
Jump to: navigation, search
Revision as of 07:07, 4 May 2007 (edit)
Mcpat (Talk | contribs)

← Previous diff
Current revision (22:54, 26 July 2012) (edit) (undo)
Sash (Talk | contribs)
(FTP Option - allow WAN FTP access)
 
(23 intermediate revisions not shown.)
Line 1: Line 1:
-by [[User:mcpat | mcpat]]+by [[User:mcpat | mcpat]], adapted by [[User:MeisterEder | MeisterEder]] & [[User:Alvin | MrAlvin]]
 +== ProFTPd included in web-GUI ==
 +As of version v24TNG - Eko svn11218 - Dec 17, 2008 (recommended version is [http://www.dd-wrt.com/dd-wrtv2/down.php?path=downloads%2Fothers%2Feko%2FV24_TNG%2Fsvn11296/ svn11296]) Mega and Mini_usb_ftp versions have built-in FTP server option.
-=Requirements=+In latest firmwares with ProFTPd embedded, go to the WEB GUI, and under SERVICES>NAS, you can configure your ftp server this way:[[Image:Ftp_pass_189.jpg]]
-First be sure that you have enough memory free. Because of this I describe the installation on SD-cards (/mmc).+In the web-GUI select:
-Additionally this procedure will show how to install even the needed ipkg packages on the SD-card.+: tab: Services -> tab: NAS -> section: ProFTPD ->
 +* option: ProFTPD = enable
 +* option: Server Port - 21 - is recommended
 +* option: Files Directory - can be any rw-able drive space
 +* option: Allow Write - enable - is needed if you want to be able to FTP-''write'' to the drive
 +* option: User Password List -> any ''name'' [space] ''password'' can be entered
 +:* Name and password must be seperated by a space.
 +:* You should enter at least one ''user name'' and ''password'',
 +:: so you do not need to use the "root-user" to get FTP access.
 +: Click "Save" and "Apply Settings"
 +And you should now have FTP LAN access to your data drive
-It is also possible to replace every occurances of (/mmc) with (/jffs) if you have it enabled.+==== FTP Option - allow WAN FTP access (outdated since 19550) ====
 +To allow WAN access using FTP protocol run the following line in a terminal window:
 + /usr/sbin/iptables -I INPUT 1 -p tcp --dport 21 -j logaccept
 +Note: FTP is a clear text protocol, so your FTP username and password can be sniffed, so you should think twice before enabling WAN FTP access.
-=Preparation=+==== FTP Option - allow WAN FTP access including passive modes ====
 +Allowing WAN access was not so simple for me. Here is what I did to make the ftp work for the WAN. <br>
 +1 - First proftpd has to be configured properly for incoming connection for both Active and Passive modes. For that purpose a couple of lines need to be added to /tmp/proftpd/etc/proftpd.conf. <br>
 +Add this if using a domain name(needless to say replace the domain name or IP with your domain name or IP:
 +<pre>MasqueradeAddress xxx.mydomain.com # DNS name
 +#OR this if not using a domain name
 +MasqueradeAddress 123.45.67.89 # WAN IP </pre>
 +Other line to add is the Passive ports on which proftpd will be listening. I chose the port range 60000 to 61000 opening 1000 ports. Change this range to your requirement.<br>
 +<pre>PassivePorts 60000 61000</pre>
 +The problem is that /tmp/proftpd/etc/proftpd.conf gets overwritten every time router is restarted. So add these lines using a startup[Administration->commands->startup] script. Here is how I did it:
 +<pre>#-------- for proftpd passive WAN access -----
 +echo 'MasqueradeAddress xxxxx.dyndns.org'>> /tmp/proftpd/etc/proftpd.conf #Masquerade the responses
 +echo 'PassivePorts 60000 61000'>> /tmp/proftpd/etc/proftpd.conf #Set the passive ports range
 +killall -HUP proftpd #restart the ftp server</pre>
 +2 - Now forward these passive ports to the internal IP address of your router e.g. 192.168.1.1. I forwarded the ports using the UI. It can also be done using the iptables. However I feel comfortable with the UI
 +2.1 - The Iptables command to open the passive ports for the firewall are: <pre>/usr/sbin/iptables -I INPUT -p tcp -m tcp --dport 60000:61000 --syn -j logaccept </pre>
 +(If using this it is unnecessary to forward the range of ports in the GUI to the router, I could not use the GUI to get passive mode to work correctly but this did the trick).
-Install first optware!+==== FTP Option - allow anonymous FTP access to all or part of the data drive====
 +You can allow anyone on your LAN to ''read'' all or a specific folder-tree on your data drive. If you enable WAN access, the anonymous settings will also apply to all WAN users ( = all of the internet users )
 +*option: Anonymous Login (Read-only)
 +::Can be enabled if you want anyone to be able to ''read'' files on your data drive.
 +* option: Anonymous Home Sub-directory
 +:: Can be set to a sub-folder where you keep your public files and folders, like: /mnt/public - so your private and public files and folders can be kept seperate.
 +:'''Anonymous example'''
 +: You must create the public folder in a terminal or using the normal FTP user.
 + cd /mnt
 + mkdir public
 +: In Anonymous Home Sub-directory text field write: '''/public'''
 +: Click "Save" and "Apply Settings"
-Then install xinetd 
-Then install proftpd+== Optware ProFTPd versions ==
 +====Preface====
 +To run a ftp-server you need appropriate free space on your device. So its best you have sd-card-modded your device (or you can connect an HD).
 +This tutorial points on an installed sd-card mounted to "/mmc". It is also possible to replace every occurances of (/mmc) with (/jffs) if you have it enabled.
-=Installing optware=+====First: install optware====
 +If you dont have installed this wonderful system, so do it now!
 +It easy and descriped in [[Optware]] (up to 2.2).
-Make folder 'opt' in mmc:+====Install xinetd====
 +Xinetd is a so called super-server. It receives requests on configurable ports and then starts an appropriate serverprocess.
 +In our case xinetd should manage the ftp-requests and start proftpd. So install xinetd:
 + /opt/bin/ipkg update xinetd
 + /opt/bin/ipkg install xinetd
-<pre>mkdir /mmc/opt</pre>+====Install proftpd====
 +Also install the proftpd-server:
 + /opt/bin/ipkg install proftpd
-Mounten von '/mmc/opt' with '/opt':+Because of the good work of the optware-people there is only a little bit configuration to do:
 +====Configure xinetd====
 +In default-configuration xinet only listens to requests from network 192.168.1.0/24
 +If your network does not meet this netmask you have to change the value:
-<pre>mount -o bind /mmc/opt /opt</pre>+Open the file /opt/etc/xinetd.conf with you favorite editor (maybe "nano")
 + nano opt/etc/xinetd.conf
-Save script 'optware-pre-install.sh' to /opt, change rights to 755+Change the value for "only_from" to your netmask (something like 192.168.4.0/24?)
 +To allow request from everywhere you can comment this line out (note "#" at beginning of the line)
-Starting Script:+====Configure proftpd====
 +Open the file /opt/etc/proftpd.conf with you favorite editor (maybe "nano")
 + nano opt/etc/proftpd.conf
 +We have to change some values for meeting the standards of dd-wrt:
 +Replace the lines:
 + User nobody
 + Group nobody
 +with
 + User root
 + Group root
-<pre>/opt/optware-pre-install.sh</pre>+Also you can change the "DefaultRoot" to "/mmc" if you want.
-optware-pre-install.sh:+If you dont want to allow anonymous access delete the entire "<Anonymous>" section!
-<pre>#!/bin/sh+
-# Optware pre-installation script, Leon Kos 2006+
- +
-REPOSITORY=http://ipkg.nslu2-linux.org/feeds/optware/ddwrt/cross/stable+
-TMP=/tmp+
- +
-PATH=/bin:/sbin:/usr/bin:/usr/sbin:/opt/bin:/opt/sbin+
-unset LD_PRELOAD+
-unset LD_LIBRARY_PATH+
- +
-_check_config()+
-{+
- echo "Checking system config ..."+
- GATEWAY=$(netstat -rn |+
- sed -n 's/^0.0.0.0[ \t]\{1,\}\([0-9.]\{8,\}\).*/\1/p' )+
- if [ -n "${GATEWAY}" ]; then+
- echo "Using ${GATEWAY} as default gateway."+
- else+
- echo "Error: No default gateway set!"+
- exit 2+
- fi+
- if [ -s /etc/resolv.conf ]; then+
- echo "Using the following nameserver(s):"+
- if grep nameserver /etc/resolv.conf ; then+
- GATEWAY_SUBNET=$(echo "${GATEWAY}" |+
- sed 's/\.[0-9]\{1,3\}\.[0-9]\{1,3\}$//')+
- if [ "${GATEWAY_SUBNET}" = "192.168" ]; then+
- if grep -q ${GATEWAY} /etc/resolv.conf ; then+
- echo "Gateway ${GATEWAY} is also nameserver."+
- else+
- echo "Warning: local nameserver is different than gateway!"+
- echo "Check config or enter:"+
- if test -L /etc/resolv.conf ; then +
- echo " sed -i s/192.168.*/${GATEWAY}/ /tmp/resolv.conf"+
- else+
- echo " sed -i s/192.168.*/${GATEWAY}/ /etc/resolv.conf"+
- fi+
- echo "to correct this."+
- fi+
- fi+
- else+
- echo "Error: No nameserver specified in /etc/resolv.conf"+
- exit 5+
- fi+
- else+
- echo "Error: Empty or nonexistent /etc/resolv.conf"+
- exit 3+
- fi+
- +
- if mount | grep -q /opt ; then+
- [ -d /opt/etc ] && echo "Warning: /opt partition not empty!"+
- else+
- echo "Error: /opt partition not mounted."+
- echo "Enter"+
- echo " mkdir /mmc/opt"+
- echo " mount -o bind /mmc/opt /opt"+
- echo "to correct this."+
- exit 4+
- fi+
-}+
- +
- +
-_install_package()+
-{+
- PACKAGE=$1+
- echo "Installing package ${PACKAGE} ..."+
- wget -O ${TMP}/${PACKAGE} ${REPOSITORY}/${PACKAGE}+
- cd ${TMP} +
- tar xzf ${TMP}/${PACKAGE} +
- tar xzf ${TMP}/control.tar.gz+
- cd /+
- if [ -f ${TMP}/preinst ] ; then+
- sh ${TMP}/preinst+
- rm -f ${TMP}/preints+
- fi+
- tar xzf ${TMP}/data.tar.gz+
- if [ -f ${TMP}/postinst ] ; then+
- sh ${TMP}/postinst+
- rm -f ${TMP}/postinst+
- fi+
- rm -f ${TMP}/data.tar.gz+
- rm -f ${TMP}/control.tar.gz+
- rm -f ${TMP}/control+
- rm -f ${TMP}/${PACKAGE}+
-}+
- +
-_check_config+
-_install_package uclibc-opt_0.9.28-12_mipsel.ipk+
-_install_package ipkg-opt_0.99.163-9_mipsel.ipk+
-/opt/sbin/ldconfig+
-/opt/bin/ipkg update+
-/opt/bin/ipkg install -force-reinstall uclibc-opt+
-/opt/bin/ipkg install -force-reinstall ipkg-opt +
-</pre>+
-=Installing xinetd=+If proftpd doesn't start when you connect to it, try deleting/commenting "Anonymous" section.
-Installation of xinetd:+====Setting up users====
 +In orthodox, proftpd uses system passwd file to define users access. That means ftp users are system users.
 +Buuump! It's not possible to define more than one user in dd-wrt.
 +However, there is a way out.
- /opt/bin/ipkg install xinetd+Find this option:
-=Installing proftpd= 
- 
-Installation of proftpd-Server: 
- 
- /opt/bin/ipkg install proftpd 
- 
- 
-=Config Files= 
-==Proftpd== 
- 
-Use '''vi /opt/etc/proftpd.conf''' to open file 
- 
-If you would like to use root only use the following: 
- 
- <pre># This is a basic ProFTPD configuration file (rename it to  
-# 'proftpd.conf' for actual use. It establishes a single server 
-# and a single anonymous login. It assumes that you have a user/group 
-# "nobody" and "ftp" for normal operation and anon. 
- 
-ServerName "ProFTPD Default Installation" 
-# ServerType standalone 
-ServerType inetd 
-DefaultServer on 
-WtmpLog off 
- 
- 
-# Port 21 is the standard FTP port. 
-Port 21 
- 
-# Umask 022 is a good standard umask to prevent new dirs and files 
-# from being group and world writable. 
-Umask 022 
- 
-# To prevent DoS attacks, set the maximum number of child processes 
-# to 30. If you need to allow more than 30 concurrent connections 
-# at once, simply increase this value. Note that this ONLY works 
-# in standalone mode, in inetd mode you should use an inetd server 
-# that allows you to limit maximum number of processes per service 
-# (such as xinetd). 
-MaxInstances 10 
- 
-<Global> 
- RootLogin On 
- RequireValidShell off 
AuthUserFile /etc/passwd AuthUserFile /etc/passwd
- AllowOverwrite on 
- AllowRetrieveRestart on 
- AllowStoreRestart on 
-# TransferRate RETR 25 
-# TransferRate APPE,STOR 100:2048 
-</Global> 
- 
- 
-# Set the user and group under which the server will run. 
-# User nobody 
-User root 
-Group root 
-# Group nobody 
- 
-# To cause every FTP user to be "jailed" (chrooted) into their home 
-# directory, uncomment this line. 
-#DefaultRoot ~ 
-DefaultRoot /mmc/opt 
- 
-# Normally, we want files to be overwriteable. 
-AllowOverwrite on 
- 
-# Bar use of SITE CHMOD by default 
-<Limit SITE_CHMOD> 
- DenyAll 
-</Limit></pre> 
- 
-For anon login add the following in your vsftpd.conf file. 
-Before you use this realize you will be giving anon login FULL ACCESS (untested!) 
- 
- <pre># A basic anonymous configuration, no upload directories. If you do not 
-# want anonymous users, simply delete this entire <Anonymous> section. 
-<Anonymous ~ftp> 
- User ftp 
- Group ftp 
- 
- # We want clients to be able to login with "anonymous" as well as "ftp" 
- UserAlias anonymous ftp 
- 
- # Limit the maximum number of anonymous logins 
- MaxClients 5 
- 
- # We want 'welcome.msg' displayed at login, and '.message' displayed 
- # in each newly chdired directory. 
- DisplayLogin welcome.msg 
- DisplayFirstChdir .message 
- 
- # Limit WRITE everywhere in the anonymous chroot 
- <Limit WRITE> 
- DenyAll 
- </Limit> 
-</Anonymous></pre> 
- 
-==xinetd== 
-/opt/etc/xinetd.conf 
- 
-<pre>defaults 
-{ 
- only_from = 0.0.0.0/0 
- instances = 60 
- log_type = SYSLOG authpriv info 
- log_on_success = HOST PID 
- log_on_failure = HOST 
- cps = 25 30 
-} 
-includedir /opt/etc/xinetd.d</pre> 
-=Start scripts= 
-==Start script for proftpd (standalone server)== 
- 
-Please set following in the proftpd.conf 
- 
-<pre>ServerType standalone</pre> 
- 
-The following script starts proftpd (/opt/etc/init.d/S58proftpd): 
- 
- <pre>#!/bin/sh 
-# 
-# Startup script for proftpd as standalone server 
-# 
- 
-if [ -n "`pidof proftpd`" ]; then 
- /bin/killall proftpd 2>/dev/null 
-fi 
- 
-/opt/sbin/proftpd --config /opt/etc/proftpd.conf</pre> 
-Don't forget to give the execute privilege (chmod x start). 
- 
-Don't forget to add following lines to the startup (Web interface->Administration->Diagnostic) 
-<pre>mount -o bind /mmc/opt /opt 
-unset LD_LIBRARY_PATH 
-unset LD_PRELOAD 
-/opt/etc/init.d/S58proftpd</pre> 
- 
-==Start script for proftpd (via xinetd)== 
-Please set following in the proftpd.conf 
-<pre>ServerType inetd</pre>+in proftdp.conf file and define a different file for passwords. Let's put in near proftpd.conf itself:
-The following script starts xinetd (/opt/etc/init.d/S10xinetd):+ AuthUserFile /opt/etc/passwd
-<pre>#!/bin/sh+From now on, the ftp server will look up user passwords in /opt/etc/passwd rather than /etc/passwd
-OPTWARE_TARGET=ddwrt+
-#+
-# Startup script for xinetd+
-#+
-# Stop myself if running+
-killall xinetd 2>/dev/null+
-# Stop other inetd processes if running+We can edit the /opt/etc/passwd file and add users to it. The format is common linux passwd file, the passwords are MD5.
-if [ ${OPTWARE_TARGET} = "nslu2" ] ; then+I was way too lazy to create it manually, so you may use the same trick:
- killall inetd 2>/dev/null+
-fi+
-/opt/sbin/xinetd</pre>+1. Change your dd-wrt web gui username ans password to the user you would like to have on ftp, then reboot.
-The following script starts proftpd via xinetd (/opt/etc/xinetd.d/proftpd):+2. Copy the /etc/passwd to /opt/etc/passwd
- <pre>service ftp+3. Change the gui login credentials back
-{+
- flags = REUSE+
- socket_type = stream+
- instances = 30+
- wait = no+
- user = root+
- server = /opt/sbin/proftpd+
- server_args = --config /opt/etc/proftpd.conf+
- log_on_success = HOST PID+
- log_on_failure = HOST+
- disable = no+
-}</pre>+
-Don't forget to give 0644 privilege (chmod 644 proftpd).+
-Don't forget to add following lines to the startup (Web interface->Administration->Diagnostic)+Open /opt/etc/passwd . Let us assume the username is "ftp" and the password is "test".
-<pre>mount -o bind /mmc/opt /opt+You should see 2 lines inside /opt/etc/passwd , the second one starting with reboot. Delete the second one.
-unset LD_LIBRARY_PATH+The one left will look something like this:
-unset LD_PRELOAD+
-/opt/etc/init.d/S10xinetd</pre>+
-=Notes=+ ftp:$1IBcY2cN82WXH9/vq/:0:0:Root User,,,:/root/tmp:/bin/sh
-Don't use both methods. Either you start proftpd as standalone server, or you start proftpd via xinetd+
-If you have xinetd installed for other apps, and would like to start proftpd standalone then set in "(/opt/etc/xinetd.d/proftpd"+You may want to change the user home dir to /jffs/ftp . Change the /root/tmp to /jffs/ftp
-<pre>disable = yes</pre>+ ftp:$1IBcY2cN82WXH9/vq/:0:0:Root User,,,:/jffs/ftp:/bin/sh
-=Firewall settings=+
-To get the FTP-Server enabled from WAN side add the following line to the firewall section:+So, now we have a ftp user "ftp" with his home dir in /jffs/ftp . If you want this to be his upper (root) folder, enable DefaultRoot as described above. I would recommend enabling this function for security reasons.
- /usr/sbin/iptables -I INPUT 1 -p tcp --dport 21 -j logaccept+
-=External Links=+Add additional lines to this file to create more users.
-[http://www.castaglia.org/proftpd/ ProFTPD (Professional FTP Daemon)]+
-[http://www.proftpd.de/ ProFTPD (german homepage)]+====Start the xinet-superserver====
 + /opt/etc/init.d/S10xinetd start
 +====Test the service====
 +Connect with your favorite ftp-client to the new server. Login with your wrt-"root"-Login (or another existing user)
 +Maybe the login takes a while - the proftpd-server have to start for every connect!
-[[Category:English documentation]]+[[Category:FTP]]

Current revision

by mcpat, adapted by MeisterEder & MrAlvin

Contents

[edit] ProFTPd included in web-GUI

As of version v24TNG - Eko svn11218 - Dec 17, 2008 (recommended version is svn11296) Mega and Mini_usb_ftp versions have built-in FTP server option.

In latest firmwares with ProFTPd embedded, go to the WEB GUI, and under SERVICES>NAS, you can configure your ftp server this way:Image:Ftp_pass_189.jpg

In the web-GUI select:

tab: Services -> tab: NAS -> section: ProFTPD ->
  • option: ProFTPD = enable
  • option: Server Port - 21 - is recommended
  • option: Files Directory - can be any rw-able drive space
  • option: Allow Write - enable - is needed if you want to be able to FTP-write to the drive
  • option: User Password List -> any name [space] password can be entered
  • Name and password must be seperated by a space.
  • You should enter at least one user name and password,
so you do not need to use the "root-user" to get FTP access.
Click "Save" and "Apply Settings"

And you should now have FTP LAN access to your data drive

[edit] FTP Option - allow WAN FTP access (outdated since 19550)

To allow WAN access using FTP protocol run the following line in a terminal window:

/usr/sbin/iptables -I INPUT 1 -p tcp --dport 21 -j logaccept 

Note: FTP is a clear text protocol, so your FTP username and password can be sniffed, so you should think twice before enabling WAN FTP access.

[edit] FTP Option - allow WAN FTP access including passive modes

Allowing WAN access was not so simple for me. Here is what I did to make the ftp work for the WAN.
1 - First proftpd has to be configured properly for incoming connection for both Active and Passive modes. For that purpose a couple of lines need to be added to /tmp/proftpd/etc/proftpd.conf.
Add this if using a domain name(needless to say replace the domain name or IP with your domain name or IP:

MasqueradeAddress	xxx.mydomain.com  # DNS name  
#OR this if not using a domain name 
MasqueradeAddress	123.45.67.89      # WAN IP  

Other line to add is the Passive ports on which proftpd will be listening. I chose the port range 60000 to 61000 opening 1000 ports. Change this range to your requirement.

PassivePorts 60000 61000

The problem is that /tmp/proftpd/etc/proftpd.conf gets overwritten every time router is restarted. So add these lines using a startup[Administration->commands->startup] script. Here is how I did it:

#-------- for proftpd passive WAN access -----
echo 'MasqueradeAddress xxxxx.dyndns.org'>> /tmp/proftpd/etc/proftpd.conf   #Masquerade the responses
echo 'PassivePorts 60000 61000'>> /tmp/proftpd/etc/proftpd.conf    #Set the passive ports range
killall -HUP proftpd    #restart the ftp server

2 - Now forward these passive ports to the internal IP address of your router e.g. 192.168.1.1. I forwarded the ports using the UI. It can also be done using the iptables. However I feel comfortable with the UI

2.1 - The Iptables command to open the passive ports for the firewall are:
/usr/sbin/iptables -I INPUT -p tcp -m tcp --dport 60000:61000 --syn -j logaccept 

(If using this it is unnecessary to forward the range of ports in the GUI to the router, I could not use the GUI to get passive mode to work correctly but this did the trick).

[edit] FTP Option - allow anonymous FTP access to all or part of the data drive

You can allow anyone on your LAN to read all or a specific folder-tree on your data drive. If you enable WAN access, the anonymous settings will also apply to all WAN users ( = all of the internet users )

  • option: Anonymous Login (Read-only)
Can be enabled if you want anyone to be able to read files on your data drive.
  • option: Anonymous Home Sub-directory
Can be set to a sub-folder where you keep your public files and folders, like: /mnt/public - so your private and public files and folders can be kept seperate.
Anonymous example
You must create the public folder in a terminal or using the normal FTP user.
cd /mnt
mkdir public
In Anonymous Home Sub-directory text field write: /public
Click "Save" and "Apply Settings"


[edit] Optware ProFTPd versions

[edit] Preface

To run a ftp-server you need appropriate free space on your device. So its best you have sd-card-modded your device (or you can connect an HD). This tutorial points on an installed sd-card mounted to "/mmc". It is also possible to replace every occurances of (/mmc) with (/jffs) if you have it enabled.

[edit] First: install optware

If you dont have installed this wonderful system, so do it now! It easy and descriped in Optware (up to 2.2).

[edit] Install xinetd

Xinetd is a so called super-server. It receives requests on configurable ports and then starts an appropriate serverprocess. In our case xinetd should manage the ftp-requests and start proftpd. So install xinetd:

/opt/bin/ipkg update xinetd
/opt/bin/ipkg install xinetd

[edit] Install proftpd

Also install the proftpd-server:

/opt/bin/ipkg install proftpd

Because of the good work of the optware-people there is only a little bit configuration to do:

[edit] Configure xinetd

In default-configuration xinet only listens to requests from network 192.168.1.0/24 If your network does not meet this netmask you have to change the value:

Open the file /opt/etc/xinetd.conf with you favorite editor (maybe "nano")

nano opt/etc/xinetd.conf

Change the value for "only_from" to your netmask (something like 192.168.4.0/24?) To allow request from everywhere you can comment this line out (note "#" at beginning of the line)

[edit] Configure proftpd

Open the file /opt/etc/proftpd.conf with you favorite editor (maybe "nano")

nano opt/etc/proftpd.conf

We have to change some values for meeting the standards of dd-wrt: Replace the lines:

User                            nobody
Group                          nobody

with

User                            root
Group                          root

Also you can change the "DefaultRoot" to "/mmc" if you want.

If you dont want to allow anonymous access delete the entire "<Anonymous>" section!

If proftpd doesn't start when you connect to it, try deleting/commenting "Anonymous" section.

[edit] Setting up users

In orthodox, proftpd uses system passwd file to define users access. That means ftp users are system users. Buuump! It's not possible to define more than one user in dd-wrt. However, there is a way out.

Find this option:

 AuthUserFile /etc/passwd

in proftdp.conf file and define a different file for passwords. Let's put in near proftpd.conf itself:

AuthUserFile /opt/etc/passwd

From now on, the ftp server will look up user passwords in /opt/etc/passwd rather than /etc/passwd

We can edit the /opt/etc/passwd file and add users to it. The format is common linux passwd file, the passwords are MD5. I was way too lazy to create it manually, so you may use the same trick:

1. Change your dd-wrt web gui username ans password to the user you would like to have on ftp, then reboot.

2. Copy the /etc/passwd to /opt/etc/passwd

3. Change the gui login credentials back

Open /opt/etc/passwd . Let us assume the username is "ftp" and the password is "test". You should see 2 lines inside /opt/etc/passwd , the second one starting with reboot. Delete the second one. The one left will look something like this:

    ftp:$1IBcY2cN82WXH9/vq/:0:0:Root User,,,:/root/tmp:/bin/sh

You may want to change the user home dir to /jffs/ftp . Change the /root/tmp to /jffs/ftp

    ftp:$1IBcY2cN82WXH9/vq/:0:0:Root User,,,:/jffs/ftp:/bin/sh

So, now we have a ftp user "ftp" with his home dir in /jffs/ftp . If you want this to be his upper (root) folder, enable DefaultRoot as described above. I would recommend enabling this function for security reasons.

Add additional lines to this file to create more users.

[edit] Start the xinet-superserver

/opt/etc/init.d/S10xinetd start

[edit] Test the service

Connect with your favorite ftp-client to the new server. Login with your wrt-"root"-Login (or another existing user) Maybe the login takes a while - the proftpd-server have to start for every connect!