ProFTPd

From DD-WRT Wiki

Revision as of 07:07, 4 May 2007 by Mcpat (Talk | contribs)
Jump to: navigation, search

by mcpat

Contents

Requirements

First be sure that you have enough memory free. Because of this I describe the installation on SD-cards (/mmc). Additionally this procedure will show how to install even the needed ipkg packages on the SD-card.

It is also possible to replace every occurances of (/mmc) with (/jffs) if you have it enabled.

Preparation

Install first optware!

Then install xinetd

Then install proftpd

Installing optware

Make folder 'opt' in mmc:

mkdir /mmc/opt

Mounten von '/mmc/opt' with '/opt':

mount -o bind /mmc/opt /opt

Save script 'optware-pre-install.sh' to /opt, change rights to 755

Starting Script:

/opt/optware-pre-install.sh

optware-pre-install.sh:

#!/bin/sh
# Optware pre-installation script, Leon Kos 2006
 
REPOSITORY=http://ipkg.nslu2-linux.org/feeds/optware/ddwrt/cross/stable
TMP=/tmp
 
PATH=/bin:/sbin:/usr/bin:/usr/sbin:/opt/bin:/opt/sbin
unset LD_PRELOAD
unset LD_LIBRARY_PATH
 
_check_config()
{
    echo "Checking system config ..."
    GATEWAY=$(netstat -rn |
        sed -n 's/^0.0.0.0[ \t]\{1,\}\([0-9.]\{8,\}\).*/\1/p' )
    if [ -n "${GATEWAY}" ]; then
        echo "Using ${GATEWAY} as default gateway."
    else
        echo "Error: No default gateway set!"
        exit 2
    fi
    if [ -s /etc/resolv.conf ]; then
        echo "Using the following nameserver(s):"
        if grep nameserver /etc/resolv.conf ; then
            GATEWAY_SUBNET=$(echo "${GATEWAY}" |
                sed 's/\.[0-9]\{1,3\}\.[0-9]\{1,3\}$//')
            if [ "${GATEWAY_SUBNET}" = "192.168" ]; then
                if grep -q ${GATEWAY} /etc/resolv.conf ; then
                    echo "Gateway ${GATEWAY} is also nameserver."
                else
                    echo "Warning: local nameserver is different than gateway!"
                    echo "Check config or enter:"
                    if test -L /etc/resolv.conf ; then 
                      echo "  sed -i s/192.168.*/${GATEWAY}/ /tmp/resolv.conf"
                    else
                      echo "  sed -i s/192.168.*/${GATEWAY}/ /etc/resolv.conf"
                    fi
                    echo "to correct this."
                fi
            fi
        else
            echo "Error: No nameserver specified in /etc/resolv.conf"
            exit 5
        fi
    else
        echo "Error: Empty or nonexistent /etc/resolv.conf"
        exit 3
    fi
 
    if mount | grep -q /opt ; then
        [ -d /opt/etc ] && echo "Warning: /opt partition not empty!"
    else
        echo "Error: /opt partition not mounted."
        echo "Enter"
        echo "    mkdir /mmc/opt"
        echo "    mount -o bind /mmc/opt /opt"
        echo "to correct this."
        exit 4
    fi
}
 
 
_install_package()
{
    PACKAGE=$1
    echo "Installing package ${PACKAGE} ..."
    wget -O ${TMP}/${PACKAGE} ${REPOSITORY}/${PACKAGE}
    cd  ${TMP} 
    tar xzf ${TMP}/${PACKAGE} 
    tar xzf ${TMP}/control.tar.gz
    cd /
    if [ -f ${TMP}/preinst ] ; then
        sh ${TMP}/preinst
        rm -f ${TMP}/preints
    fi
    tar xzf ${TMP}/data.tar.gz
    if [ -f ${TMP}/postinst ] ; then
        sh ${TMP}/postinst
        rm -f ${TMP}/postinst
    fi
    rm -f ${TMP}/data.tar.gz
    rm -f ${TMP}/control.tar.gz
    rm -f ${TMP}/control
    rm -f ${TMP}/${PACKAGE}
}
 
_check_config
_install_package uclibc-opt_0.9.28-12_mipsel.ipk
_install_package ipkg-opt_0.99.163-9_mipsel.ipk
/opt/sbin/ldconfig
/opt/bin/ipkg update
/opt/bin/ipkg install -force-reinstall uclibc-opt
/opt/bin/ipkg install -force-reinstall ipkg-opt 

Installing xinetd

Installation of xinetd:

  /opt/bin/ipkg install xinetd

Installing proftpd

Installation of proftpd-Server:

  /opt/bin/ipkg install proftpd


Config Files

Proftpd

Use vi /opt/etc/proftpd.conf to open file

If you would like to use root only use the following:

# This is a basic ProFTPD configuration file (rename it to 
# 'proftpd.conf' for actual use.  It establishes a single server
# and a single anonymous login.  It assumes that you have a user/group
# "nobody" and "ftp" for normal operation and anon.

ServerName			"ProFTPD Default Installation"
# ServerType			standalone
ServerType			inetd
DefaultServer			on
WtmpLog                         off


# Port 21 is the standard FTP port.
Port				21

# Umask 022 is a good standard umask to prevent new dirs and files
# from being group and world writable.
Umask				022

# To prevent DoS attacks, set the maximum number of child processes
# to 30.  If you need to allow more than 30 concurrent connections
# at once, simply increase this value.  Note that this ONLY works
# in standalone mode, in inetd mode you should use an inetd server
# that allows you to limit maximum number of processes per service
# (such as xinetd).
MaxInstances			10

<Global>
  RootLogin On
  RequireValidShell off
  AuthUserFile /etc/passwd
  AllowOverwrite on
  AllowRetrieveRestart on
  AllowStoreRestart on
#  TransferRate RETR 25
#  TransferRate APPE,STOR 100:2048
</Global>


# Set the user and group under which the server will run.
# User				nobody
User root
Group root
# Group				nobody

# To cause every FTP user to be "jailed" (chrooted) into their home
# directory, uncomment this line.
#DefaultRoot ~
DefaultRoot /mmc/opt

# Normally, we want files to be overwriteable.
AllowOverwrite		on

# Bar use of SITE CHMOD by default
<Limit SITE_CHMOD>
  DenyAll
</Limit>

For anon login add the following in your vsftpd.conf file. Before you use this realize you will be giving anon login FULL ACCESS (untested!)

# A basic anonymous configuration, no upload directories.  If you do not
# want anonymous users, simply delete this entire <Anonymous> section.
<Anonymous ~ftp>
  User				ftp
  Group				ftp

  # We want clients to be able to login with "anonymous" as well as "ftp"
  UserAlias			anonymous ftp

  # Limit the maximum number of anonymous logins
  MaxClients			5

  # We want 'welcome.msg' displayed at login, and '.message' displayed
  # in each newly chdired directory.
  DisplayLogin			welcome.msg
  DisplayFirstChdir		.message

  # Limit WRITE everywhere in the anonymous chroot
  <Limit WRITE>
    DenyAll
  </Limit>
</Anonymous>

xinetd

/opt/etc/xinetd.conf

defaults
{
        only_from      = 0.0.0.0/0
        instances      = 60
        log_type       = SYSLOG authpriv info
        log_on_success = HOST PID
        log_on_failure = HOST
        cps            = 25 30
}
includedir /opt/etc/xinetd.d

Start scripts

Start script for proftpd (standalone server)

Please set following in the proftpd.conf

ServerType			standalone

The following script starts proftpd (/opt/etc/init.d/S58proftpd):

#!/bin/sh
#
# Startup script for proftpd as standalone server
#

if [ -n "`pidof proftpd`" ]; then
    /bin/killall proftpd 2>/dev/null
fi

/opt/sbin/proftpd --config /opt/etc/proftpd.conf

Don't forget to give the execute privilege (chmod x start).

Don't forget to add following lines to the startup (Web interface->Administration->Diagnostic)

mount -o bind /mmc/opt /opt
unset LD_LIBRARY_PATH
unset LD_PRELOAD
/opt/etc/init.d/S58proftpd

Start script for proftpd (via xinetd)

Please set following in the proftpd.conf

ServerType			inetd

The following script starts xinetd (/opt/etc/init.d/S10xinetd):

#!/bin/sh
OPTWARE_TARGET=ddwrt
#
# Startup script for xinetd
#
# Stop myself if running
killall xinetd 2>/dev/null

# Stop other inetd processes if running
if [ ${OPTWARE_TARGET} = "nslu2" ] ; then
  killall inetd 2>/dev/null
fi

/opt/sbin/xinetd

The following script starts proftpd via xinetd (/opt/etc/xinetd.d/proftpd):

service ftp
{
       flags            = REUSE
       socket_type      = stream
       instances        = 30
       wait             = no
       user             = root
       server           = /opt/sbin/proftpd
       server_args	= --config /opt/etc/proftpd.conf
       log_on_success   = HOST PID
       log_on_failure   = HOST
       disable          = no
}

Don't forget to give 0644 privilege (chmod 644 proftpd).

Don't forget to add following lines to the startup (Web interface->Administration->Diagnostic)

mount -o bind /mmc/opt /opt
unset LD_LIBRARY_PATH
unset LD_PRELOAD
/opt/etc/init.d/S10xinetd

Notes

Don't use both methods. Either you start proftpd as standalone server, or you start proftpd via xinetd

If you have xinetd installed for other apps, and would like to start proftpd standalone then set in "(/opt/etc/xinetd.d/proftpd"

disable          = yes

Firewall settings

To get the FTP-Server enabled from WAN side add the following line to the firewall section:

  /usr/sbin/iptables -I INPUT 1 -p tcp --dport 21 -j logaccept

External Links

ProFTPD (Professional FTP Daemon)

ProFTPD (german homepage)