2

Can I use ProFTPd without using a chroot jail (thereby preventing access to anything outside of the FTP root)? I have a requirement to have symlinks in my FTP source that point to locations outside of the directory where I root my FTP service.

All of the docs and discussion I've read on ProFTPd talk about how to use the chroot functionality (even within StackExchange), but I'm wondering if I can bypass using that and use a different method to serve my FTP root. Since the symlinks must remain as symlinks, mounting the directories as a way of bypassing the chroot restriction (the clever "solution" to the problem) does not work.

Improve this question
4
  • This link here : proftpd.org/docs/howto/Chroot.html will give you what you need, especially the "Filesystem tricks" section.
    – schaiba
    Jan 25, 2013 at 21:21
  • Again, I need to completely bypass the chroot functionality.
    – palswim
    Jan 25, 2013 at 21:36
  • That need is motivated solely by the symlinks issue or is there something else? If the symlinks are the only problem, the link I posted is valid.
    – schaiba
    Jan 25, 2013 at 22:00
  • The suggestions in the chroot documentation cause the filesystem to treat the mounts as actual directories. My filesystem contains symlinks that should remain as symlinks, so that solution does not suffice.
    – palswim
    Jan 25, 2013 at 22:25

2 Answers 2

Reset to default
2

The problem is that FTP was defined in the earliest prehistory of the Internet, and so has no provisons for security (passwords in plain text, ...). That is why FTP servers are usually used only for anonymous login, and as it is open to the Internet and has a rich command set (and a lot of very surprising functionality, this was created to transfer files between machines with really bizarre architectures, differing character representations, and strange operating systems). For sanity one runs such beasts clamped down.

Is it an option to use something like scp(1)? Use a webserver instead (should even be more efficient)?

Why do the symbolic links have to be symbolic links?

Improve this answer
5
  • Other programs are accessing the filesystem in a way where they may want to ignore the symlinks. The FTP server should not ignore the symlinks.
    – palswim
    Jan 25, 2013 at 22:50
  • I know that Pure-FTPd can accomplish my requirements, but I was wondering about ProFTPd specifically.
    – palswim
    Jan 25, 2013 at 22:51
  • @palswim, are hard links out of the question? Place the files in the FTP area and link to them from outside? Keep copies inside?
    – vonbrand
    Jan 25, 2013 at 22:52
  • @vonbrand hard links may be unusable if one needs to have links to other file systems.
    – Ruslan
    Sep 6, 2013 at 6:46
  • @palswim you may use mount --bind as a workaround (will need to mount on every boot though)
    – Ruslan
    Sep 6, 2013 at 6:47
1

ProFTPD has the mod_vroot module for this purpose. You can compile this module into ProFTPD yourself or install it if your repositories have it (apt-get install proftpd-mod-vroot for certain Debian repositories).

mod_vroot allows a user to configure a "virtual chroot", setting the DefaultRoot directive (the initial/root directory for a session; ProFTPD would chroot to this directory without mod_vroot), but allowing symbolic links to point outside of the DefaultRoot path. mod_vroot also supports the VRootServerRoot directive, to which ProFTPD will perform a real chroot, meaning that symlinks can point outside of the DefaultRoot, but must target locations within the VRootServerRoot path.

Example config:

<IfModule mod_vroot.c>
    VRootEngine on

    VRootServerRoot /usr/share/ # Symlinks can only point to location within /usr/share/
    VRootOptions allowSymlinks
    DefaultRoot /usr/share/ftproot/
</IfModule>
Improve this answer
1
  • I have had problems implementing this with certain distributions (Raspbian).
    – palswim
    Jan 23, 2015 at 18:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.