请教关于ProFTPD的配置问题

cashlu

用户组ftpuser下有两个用户，分别是down和upload，down用户只能下载，不能上传;upload用户只能上传不能下载。但是现在有一个问题，任何一个用户登录服务器之后，都能访问上级目录，怎么样才可以让所有用户通过FTP都只能访问FTP的目录？

下面是我的配置文件：

1. 
   
2. ServerName                        "ProFTPD Default Installation"
   
3. ServerType                        standalone
   
4. DefaultServer                        on
   
5. RequireValidShell off
   
6. ServerIdent on
   
7. Port                                21
   
8. Umask                                022
   
9. MaxInstances                        30
   
10. User                                nobody
    
11. Group                                nogroup
    
12. AllowOverwrite                on
    
13. AllowStoreRestart   on
    
14. DisplayLogin welcome.msg
    
15. DefaultRoot /home/ftpuser/down down
    
16. DefaultRoot /home/ftpuser/upload upload
    
17. 
    
18. <Directory /home/ftp>
    
19. <Limit WRITE>
    
20.         DenyUser down
    
21. </Limit>
    
22. 
    
23. <Limit RMD RNFR DELE RETR>
    
24.         DenyUser upload
    
25. </Limit>
    
26. 
    
27. </Directory>
    
28. 
    
29. 
    

复制代码

memory

从你目前的配置看，upload和down用户ftp登录后应该是chroot在相应的目录下的，其它用户则没有此限制。如果需要限制其他用户只能登录到ftp目录，在那两条DefaultRoot后面加上：
DefaultRoot /home/ftpuser

就应该可以了。

cashlu

Post by memory
从你目前的配置看，upload和down用户ftp登录后应该是chroot在相应的目录下的，其它用户则没有此限制。如果需要限制其他用户只能登录到ftp目录，在那两条DefaultRoot后面加上：
DefaultRoot /home/ftpuser

就应该可以了。

我现在这么配置完之后，down和upload两个用户登录FTP后，默认是处在我设置目录下，但是如果用cd ..命令的话，他们都能访问上级目录，我是想禁止这一点，不希望他们访问上级目录！

cashlu

奇怪，我用DefaultRoot ~ ftpusers ( #ftpusers是down和upload归属的用户组)就可以限制，但是如果用DefaultRoot ~ down或者DefaultRoot ~ upload单独限制，就不行，是不是限制单个用户的语法不一样？

memory

哈，应该只能跟用户组。

下面是有关DefaultRoot的文档：
DefaultRoot
Name
DefaultRoot -- Sets default chroot directory
Synopsis

DefaultRoot [ directory [group-expression]]


Default

DefaultRoot /
Context

server config, <VirtualHost>, <Global>
Module

mod_auth
Compatibility

0.99.0pl7 and later
Description

The DefaultRoot directive controls the default root directory assigned to a user upon login. If DefaultRoot is set to a directory other than "/", a chroot operation is performed immediately after a client authenticates. This can be used to effectively isolate the client from a portion of the host system filespace. The specified root directory must begin with a / or can be the magic character '~'; meaning that the client is chroot jailed into their home directory.

When the specified chroot directory is a symlink this will be resolved to it's parent first before setting up the chroot. This can have unwanted side effects. For example if a user has write access to the symlink he could modify it so that it points to '/'. Thus the chroot would be the root directory of the server, resulting in insufficient or no restrictions.

If the DefaultRoot directive specifies a directory which disallows access to the logged-in user's home directory, the user's current working directory after login is set to the DefaultRoot instead of their normal home directory. DefaultRoot cannot be used in <Anonymous> configuration blocks, as the <Anonymous> directive explicitly contains a root directory used for Anonymous logins. The special character '~' is replaced with the authenticating user's home directory immediately after login. Note that the default root may be a subdirectory of the home directory, such as "~/anon-ftp".

The optional group-expression argument can be used to restrict the DefaultRoot directive to a unix group, groups or subset of groups. The expression takes the format: [!]group-name1[,[!]group-name2[,...]]. The expression is parsed in a logical boolean AND fashion, such that each member of the expression must evaluate to logically TRUE in order for the DefaultRoot directive to apply. The special character '!' is used to negate group membership.

Care should be taken when using DefaultRoot. Chroot "jails" should not be used as methods for implementing general system security as there are potentially ways that a user can "escape" the jail.
See also

Examples
Example of a DefaultRoot configuration:

ServerName "A test ProFTPD Server"
ServerType inetd
User ftp
Group ftp
#
# This causes proftpd to perform a chroot into the authenticating user's directory
# immediately after login.
# Once this happens, the user is unable to "see" higher level directories.
# Because a group-expression is included, only users who are a member of
# the group 'users' and NOT a member of 'staff' will have their default
# root directory set to '~'.
DefaultRoot ~ users,!staff

cashlu

Oh I see！
Thank you very much!