ProFTPd

From DD-WRT Wiki

Revision as of 09:21, 30 April 2010 by Glenn (Talk | contribs)
Jump to: navigation, search

by mcpat, adapted by MeisterEder & MrAlvin

Contents

ProFTPd included in web-GUI

As of version v24TNG - Eko svn11218 - Dec 17, 2008 (recommended version is svn11296) Mega and Mini_usb_ftp versions have built-in FTP server option.

In latest firmwares with ProFTPd embedded, go to the WEB GUI, and under SERVICES>NAS, you can configure your ftp server this way:Image:Ftp_pass_189.jpg

In the web-GUI select:

tab: Services -> tab: NAS -> section: ProFTPD ->
  • option: ProFTPD = enable
  • option: Server Port - 21 - is recommended
  • option: Files Directory - can be any rw-able drive space
  • option: Allow Write - enable - is needed if you want to be able to FTP-write to the drive
  • option: User Password List -> any name [space] password can be entered
  • Name and password must be seperated by a space.
  • You should enter at least one user name and password,
so you do not need to use the "root-user" to get FTP access.
Click "Save" and "Apply Settings"

And you should now have FTP LAN access to your data drive

FTP Option - allow WAN FTP access

To allow WAN access using FTP protocol run the following line in a terminal window:

/usr/sbin/iptables -I INPUT 1 -p tcp --dport 21 -j logaccept 

Note: FTP is a clear text protocol, so your FTP username and password can be sniffed, so you should think twice before enabling WAN FTP access.

FTP Option - allow WAN FTP access including passive modes

Allowing WAN access was not so simple for me. Here is what I did to make the ftp work for the WAN.
1 - First proftpd has to be configured properly for incoming connection for both Active and Passive modes. For that purpose a couple of lines need to be added to /tmp/proftpd/etc/proftpd.conf.
Add this if using a domain name(needless to say replace the domain name or IP with your domain name or IP:

MasqueradeAddress	xxx.mydomain.com  # DNS name  
#OR this if not using a domain name 
MasqueradeAddress	123.45.67.89      # WAN IP  

Other line to add is the Passive ports on which proftpd will be listening. I chose the port range 60000 to 61000 opening 1000 ports. Change this range to your requirement.

PassivePorts 60000 61000

The problem is that /tmp/proftpd/etc/proftpd.conf gets overwritten every time router is restarted. So add these lines using a startup[Administration->commands->startup] script. Here is how I did it:

#-------- for proftpd passive WAN access -----
echo 'MasqueradeAddress xxxxx.dyndns.org'>> /tmp/proftpd/etc/proftpd.conf   #Masquerade the responses
echo 'PassivePorts 60000 61000'>> /tmp/proftpd/etc/proftpd.conf    #Set the passive ports range
killall -HUP proftpd    #restart the ftp server

2 - Now forward these passive ports to the internal IP address of your router e.g. 192.168.1.1. I forwarded the ports using the UI. It can also be done using the iptables. However I feel comfortable with the UI

FTP Option - allow anonymous FTP access to all or part of the data drive

You can allow anyone on your LAN to read all or a specific folder-tree on your data drive. If you enable WAN access, the anonymous settings will also apply to all WAN users ( = all of the internet users )

  • option: Anonymous Login (Read-only)
Can be enabled if you want anyone to be able to read files on your data drive.
  • option: Anonymous Home Sub-directory
Can be set to a sub-folder where you keep your public files and folders, like: /mnt/public - so your private and public files and folders can be kept seperate.
Anonymous example
You must create the public folder in a terminal or using the normal FTP user.
cd /mnt
mkdir public
In Anonymous Home Sub-directory text field write: /public
Click "Save" and "Apply Settings"


Optware ProFTPd versions

Preface

To run a ftp-server you need appropriate free space on your device. So its best you have sd-card-modded your device (or you can connect an HD). This tutorial points on an installed sd-card mounted to "/mmc". It is also possible to replace every occurances of (/mmc) with (/jffs) if you have it enabled.

First: install optware

If you dont have installed this wonderful system, so do it now! It easy and descriped in Optware (up to 2.2).

Install xinetd

Xinetd is a so called super-server. It receives requests on configurable ports and then starts an appropriate serverprocess. In our case xinetd should manage the ftp-requests and start proftpd. So install xinetd:

/opt/bin/ipkg update xinetd
/opt/bin/ipkg install xinetd

Install proftpd

Also install the proftpd-server:

/opt/bin/ipkg install proftpd

Because of the good work of the optware-people there is only a little bit configuration to do:

Configure xinetd

In default-configuration xinet only listens to requests from network 192.168.1.0/24 If your network does not meet this netmask you have to change the value:

Open the file /opt/etc/xinetd.conf with you favorite editor (maybe "nano")

nano opt/etc/xinetd.conf

Change the value for "only_from" to your netmask (something like 192.168.4.0/24?) To allow request from everywhere you can comment this line out (note "#" at beginning of the line)

Configure proftpd

Open the file /opt/etc/proftpd.conf with you favorite editor (maybe "nano")

nano opt/etc/proftpd.conf

We have to change some values for meeting the standards of dd-wrt: Replace the lines:

User                            nobody
Group                          nobody

with

User                            root
Group                          root

Also you can change the "DefaultRoot" to "/mmc" if you want.

If you dont want to allow anonymous access delete the entire "<Anonymous>" section!


Start the xinet-superserver

/opt/etc/init.d/S10xinetd start

Test the service

Connect with your favorite ftp-client to the new server. Login with your wrt-"root"-Login (or another existing user) Maybe the login takes a while - the proftpd-server have to start for every connect!