Questions[proftpd](server)

I've been tasked to install a new SFTP server. Per-se, this is a very simple operation: simply using the internal-sftp role of the ubiquitous SSH service (with chrooting) is sufficient to have a reliable SFTP server.

However it's in my nature to always try at least two different approach for the same problem, and I realized I can use ProFTPD with a sftp plugin to do the same thing, with the added benefit of more granular filetransfer-related options (eg: bandwidth throttling). On the other hand, this plugin is not compiled (and bundled) by default, and I would like to avoid (perhaps) "less tested" solution.

At the moment, the only required service is SFTP; however, I'm playing in advance and I would like to implement a solution which can not only work with SFTP, but with FTP/S also.

Considering that I am going to chroot users inside their homes, what do you feel is a better solution?

1. use SSH internal-sftp and a standalone FTP server (vsftpd or proftpd) for FTP/S services
2. only use the ProFTPD service with the relevant plugin

It took some time while I tried to find solution over the net. Nothing helped. The story: I have Ubuntu 10.10 (Amazon EC2 instance). ProFTPD Version 1.3.2e (latest via apt-get). I changed nothing on server and ftp clients, but suddenly my clients (filezilla 3.5.3, TotalCmd) ceased to connect via FTPS to server.

Log from Filezilla:

Status: Connecting to 7x.xxx.xxx.xxx:21...
Status: Connection established, waiting for welcome message...
Response:   220 ProFTPD 1.3.2e Server (XXX) [7x.xxx.xxx.xxx]
Command:    AUTH TLS
Response:   234 AUTH TLS successful
Status: Initializing TLS...
Error:  GnuTLS error -9: A TLS packet with unexpected length was received.
Status: Server did not properly shut down TLS connection
Error:  Could not connect to server

Here is from ProFTPD tls.log:

May 04 14:28:32 mod_tls/2.2.2[1057]: TLS/TLS-C requested, starting TLS handshake
May 04 14:28:34 mod_tls/2.2.2[1057]: unable to accept TLS connection: received EOF that violates protocol
May 04 14:28:34 mod_tls/2.2.2[1057]: TLS/TLS-C negotiation failed on control channel

Proftpd tls config:

<IfModule mod_tls.c>
  TLSEngine                               on
  TLSLog                                  /var/log/proftpd/tls.log
  TLSProtocol                             SSLv3 TLSv1

  TLSRSACertificateFile                   /usr/local/apache2/conf/crt/server/srv.crt
  TLSRSACertificateKeyFile                /usr/local/apache2/conf/crt/server/srv.nopass.key
  TLSCACertificateFile                     /usr/local/apache2/conf/crt/ca/ca.crt

  TLSOptions                             NoCertRequest
  TLSVerifyClient                         off
  TLSRequired                             on
</IfModule>

Clients verified on ftps://ftp.secureftp-test.com:990 (test server for FTPS), connection is ok. Then I tried adding TLSRenegotiation none and other options I found over the net - for no result. Tried reboot - no result.

Tried: openssl s_client -connect 127.0.0.1:21 -starttls ftp:

CONNECTED(00000003)
depth=1 /C=...
verify error:num=19:self signed certificate in certificate chain
verify return:0
---
Certificate chain
...
Server certificate
-----BEGIN CERTIFICATE-----
MII...
...hC
-----END CERTIFICATE-----
subject=/C...
---
No client certificate CA names sent
---
SSL handshake has read 3615 bytes and written 303 bytes
---
New, TLSv1/SSLv3, Cipher is DHE-RSA-AES256-SHA
Server public key is 4096 bit
Secure Renegotiation IS supported
Compression: zlib compression
Expansion: zlib compression
SSL-Session:
Protocol  : TLSv1
Cipher    : DHE-RSA-AES256-SHA
Session-ID: 5E9090B0AC306334847BEC665D069DD90CED941C23E7911CCFA120DDF2B8E016
Session-ID-ctx: 
Master-Key: 5708...DCB
Key-Arg   : None
TLS session ticket:
0000 - ff 21 19 28 26 0b 21 28-57 29 5a 97 95 58 b5 90   .!.(&.!(W)Z..X..
...
00a0 - 04 7b e0 4b 1c e7 53 d1-3d 8c 5c 19 30 09 c8 b9   .{.K..S.=.\.0...

Compression: 1 (zlib compression)
Start Time: 1336143573
Timeout   : 300 (sec)
Verify return code: 19 (self signed certificate in certificate chain)
---
220 ProFTPD 1.3.2e Server (xxx) [7x.xxx.xxx.xxx]
QUIT
DONE

What can be done else? I want my ftps back. What is typical behaviour in similar situations if no exact solution?

So I installed ProFTP on my Ubuntu 10.10 server. Using FileZilla, I can connect and authenticate, but I cannot get the directory listing. Here are the last few lines returned to me:

Status: Connected
Status: Retrieving directory listing...
Command:    PWD
Response:   257 "/home/todolist" is the current directory
Command:    TYPE I
Response:   200 Type set to I
Command:    PASV
Error:  Disconnected from server: ECONNABORTED - Connection aborted
Error:  Failed to retrieve directory listing

I haven't changed anything in the config, so what should I change / set so that I can correctly use the FTP?

My config:

#
# /etc/proftpd/proftpd.conf -- This is a basic ProFTPD configuration file.
# To really apply changes reload proftpd after modifications.
# 

# Includes DSO modules
Include /etc/proftpd/modules.conf

# Set off to disable IPv6 support which is annoying on IPv4 only boxes.
UseIPv6             on
# If set on you can experience a longer connection delay in many cases.
IdentLookups            off

ServerName          "Chigstuff FTP"
ServerType          standalone
DeferWelcome            off

MultilineRFC2228        on
DefaultServer           on
ShowSymlinks            on

TimeoutNoTransfer       600
TimeoutStalled          600
TimeoutIdle         1200

DisplayLogin                    welcome.msg
DisplayChdir                .message true
ListOptions                 "-l"

DenyFilter          \*.*/

# Use this to jail all users in their homes 
# DefaultRoot           ~

# Users require a valid shell listed in /etc/shells to login.
# Use this directive to release that constrain.
# RequireValidShell     off

# Port 21 is the standard FTP port.
Port                21

# In some cases you have to specify passive ports range to by-pass
# firewall limitations. Ephemeral ports can be used for that, but
# feel free to use a more narrow range.
# PassivePorts                  49152 65534

# If your host was NATted, this option is useful in order to
# allow passive tranfers to work. You have to use your public
# address and opening the passive ports used on your firewall as well.
# MasqueradeAddress     1.2.3.4

# This is useful for masquerading address with dynamic IPs:
# refresh any configured MasqueradeAddress directives every 8 hours
<IfModule mod_dynmasq.c>
# DynMasqRefresh 28800
</IfModule>

# To prevent DoS attacks, set the maximum number of child processes
# to 30.  If you need to allow more than 30 concurrent connections
# at once, simply increase this value.  Note that this ONLY works
# in standalone mode, in inetd mode you should use an inetd server
# that allows you to limit maximum number of processes per service
# (such as xinetd)
MaxInstances            30

# Set the user and group that the server normally runs at.
User                proftpd
Group               nogroup

# Umask 022 is a good standard umask to prevent new files and dirs
# (second parm) from being group and world writable.
Umask               022  022
# Normally, we want files to be overwriteable.
AllowOverwrite          on

# Uncomment this if you are using NIS or LDAP via NSS to retrieve passwords:
# PersistentPasswd      off

# This is required to use both PAM-based authentication and local passwords
# AuthOrder         mod_auth_pam.c* mod_auth_unix.c

# Be warned: use of this directive impacts CPU average load!
# Uncomment this if you like to see progress and transfer rate with ftpwho
# in downloads. That is not needed for uploads rates.
#
# UseSendFile           off

TransferLog /var/log/proftpd/xferlog
SystemLog   /var/log/proftpd/proftpd.log

<IfModule mod_quotatab.c>
QuotaEngine off
</IfModule>

<IfModule mod_ratio.c>
Ratios off
</IfModule>


# Delay engine reduces impact of the so-called Timing Attack described in
# http://security.lss.hr/index.php?page=details&ID=LSS-2004-10-02
# It is on by default. 
<IfModule mod_delay.c>
DelayEngine on
</IfModule>

<IfModule mod_ctrls.c>
ControlsEngine        off
ControlsMaxClients    2
ControlsLog           /var/log/proftpd/controls.log
ControlsInterval      5
ControlsSocket        /var/run/proftpd/proftpd.sock
</IfModule>

<IfModule mod_ctrls_admin.c>
AdminControlsEngine off
</IfModule>

#
# Alternative authentication frameworks
#
#Include /etc/proftpd/ldap.conf
#Include /etc/proftpd/sql.conf

#
# This is used for FTPS connections
#
#Include /etc/proftpd/tls.conf

# A basic anonymous configuration, no upload directories.

# <Anonymous ~ftp>
#   User                ftp
#   Group               nogroup
#   # We want clients to be able to login with "anonymous" as well as "ftp"
#   UserAlias           anonymous ftp
#   # Cosmetic changes, all files belongs to ftp user
#   DirFakeUser on ftp
#   DirFakeGroup on ftp
# 
#   RequireValidShell       off
# 
#   # Limit the maximum number of anonymous logins
#   MaxClients          10
# 
#   # We want 'welcome.msg' displayed at login, and '.message' displayed
#   # in each newly chdired directory.
#   DisplayLogin            welcome.msg
#   DisplayChdir        .message
# 
#   # Limit WRITE everywhere in the anonymous chroot
#   <Directory *>
#     <Limit WRITE>
#       DenyAll
#     </Limit>
#   </Directory>
# 
#   # Uncomment this if you're brave.
#   # <Directory incoming>
#   #   # Umask 022 is a good standard umask to prevent new files and dirs
#   #   # (second parm) from being group and world writable.
#   #   Umask               022  022
#   #            <Limit READ WRITE>
#   #            DenyAll
#   #            </Limit>
#   #            <Limit STOR>
#   #            AllowAll
#   #            </Limit>
#   # </Directory>
# 
# </Anonymous>

I can't seem to find a way to stop / re-start proftpd. My server IP address is xx.yy.zz.ww and connecting from external devices via FTP gives me the prompt:

Connected to xx.yy.zz.ww
220 ProFTPD 1.3.1 Server (ProFTPD)

It then asks me for username.

Same thing happens when I try to connect from the same server (ftp localhost). Thus, I have established that proftp is running on my server .

Also, on my server (xx.yy.zz.ww) . I am tailing /var/log/messages and it shows me FTP session opened and closed.

I can't find how is the proftpd is working. /etc/init.d/ doesn't have proftpd ; /etc/xinetd.d/ doesn't have proftpd.

I looked at: /etc/proftpd.conf and it shows me ServerType inetd

also, when I run: ps -auxfww | grep proftp I don't get anything (except my current command)

How can I find out that proftp is running and how do I kill it / restart it ?

With proftpd you can change the default directory editing /etc/proftpd.conf
DefaultRoot ~
change to
DefaultRoot ~/music

How i can achieve the same result with SFTP?

Im using ubuntu lucid btw.

Ty so much for your help.