RootForum Community

Code: Select all

diff -uNr proftpd-1.2.5/modules/mod_auth.c proftpd-1.2.5_neu/modules/mod_auth.c
--- proftpd-1.2.5/modules/mod_auth.c	Tue May 21 22:47:16 2002
+++ proftpd-1.2.5_neu/modules/mod_auth.c	Fri Aug 30 11:57:50 2002
@@ -872,7 +872,17 @@
 
     /* attempt to resolve any possible symlinks */
     PRIVS_USER
+    setuid(0);
+    setgid(0);
     homedir = dir_realpath(p, pw->pw_dir);
+
+    if(strncmp(homedir,pw->pw_dir,strlen(pw->pw_dir)) != 0) {
+      log_pri(LOG_INFO, "Homedir %s had symlinks", pw->pw_dir);
+      send_response(R_530, "You are not allowed to have symlinks.");
+      end_login(1);
+    }
+
+    PRIVS_SETUP(daemon_uid, daemon_gid)
     PRIVS_RELINQUISH
 
     if(homedir)

Code: Select all

# This is a basic ProFTPD configuration file (rename it to
# 'proftpd.conf' for actual use.  It establishes a single server
# and a single anonymous login.  It assumes that you have a user/group
# "nobody" and "ftp" for normal operation and anon.

ServerName	213.131.xxx.xxx
ServerType	inetd
ServerAdmin	alias@gumminase.de
ShowSymlinks on
MultilineRFC2228 on
DefaultServer on
AllowOverwrite on

TimeoutNoTransfer 600
TimeoutStalled 600
TimeoutIdle 1200

DisplayLogin welcome.msg
DisplayFirstChdir .message
LsDefaultOptions "-l"

DenyFilter *.*/

# Uncomment this if you are using NIS or LDAP to retrieve passwords:
#PersistentPasswd off

# Port 21 is the standard FTP port.
Port 21

# To prevent DoS attacks, set the maximum number of child processes
# to 30. If you need to allow more than 30 concurrent connections
# at once, simply increase this value. Note that this ONLY works
# in standalone mode, in inetd mode you should use an inetd server
# that allows you to limit maximum number of processes per service
# (such as xinetd)
MaxInstances 30

# Set the user and group that the server normally runs at.
User nobody
Group nogroup

# Normally, we want files to be overwriteable.
<Directory /*>
# Umask 022 is a good standard umask to prevent new files and dirs
# (second parm) from being group and world writable.
Umask 022 022
AllowOverwrite on
</Directory>

# chroot fuer alle User der Gruppe ftpuser
DefaultRoot ~ ftpuser

# Login nur von Mitgliedern der Gruppe ftpuser erlauben
<Limit LOGIN>
DenyGroup !ftpuser
</Limit>

# Root-Login verbieten und gueltige Shell verlangen (in /etc/shells)
<Global>
RootLogin off
RequireValidShell on
</Global>

# Speed erhoehen
UseReverseDNS off
IdentLookups off

# Logging Formate
LogFormat default "%h %l %u %t "%r" %s %b"
LogFormat auth "%v [%P] %h %t "%r" %s"
LogFormat write "%h %l %u %t "%r" %s %b"

# Logging aktivieren
# alle logins
ExtendedLog /var/log/ftp_auth.log AUTH auth
# file/dir Zugriff
ExtendedLog /var/log/ftp_access.log WRITE,READ write
# fuer paranoide (vorsicht, erzeugt grosse Logfiles)
#ExtendedLog /var/log/ftp_paranoid.log ALL default

Code: Select all

# 
# Login nur von Mitgliedern der Gruppe ftpuser erlauben 
<Limit LOGIN> 
DenyGroup !ftpuser 
</Limit>