Fetch ProFTPd users from mysql on ubuntu 10.04 LTS

Posted on 2012-11-14 15:20:23
by Geert Vandeweyer

Loading Content

Fetch ProFTPd users from mysql on ubuntu 10.04 LTS

Posted on 2012-11-14 15:20:23
by Geert Vandeweyer

Download Proftpd

~$ wget ftp://ftp.proftpd.org/distrib/source/proftpd-1.3.4b.tar.gz
~$ tar xzvf proftpd-1.3.4b.tar.gz
~$ cd proftpd-1.3.4b

Install needed packages

the configuration I use needs the crypto.h from libssl-dev. MySQL interaction also needs the mysql-headers from the development package.

sudo apt-get install libssl-dev libmysqlclient-dev

Configure, make and install

If needed, install the 'build-essential' package first. Then compile with the mysql modules enabled.

~$ ./configure --with-modules=mod_sql:mod_sql_mysql:mod_sql_passwd
~$ make
~$ make install

This will install the proftpd package into /usr/local  (etc, sbin, ...)

Add an init script

Save the folowing script as /etc/init.d/proftpd to autostart the server on boot.

#!/bin/sh 

### BEGIN INIT INFO
# Provides:          proftpd
# Required-Start:    $syslog $local_fs $network
# Required-Stop:     $syslog $local_fs $network
# Should-Start:      $remote_fs $named
# Should-Stop:       $remote_fs $named
# Default-Start:     2 3 4 5
# Default-Stop:      0 1 6
# Short-Description: Starts ProFTPD daemon
# Description:       This script runs the FTP service offered
#                    by the ProFTPD daemon
### END INIT INFO

# Start the proftpd FTP daemon.

PATH=/bin:/usr/bin:/sbin:/usr/sbin:/usr/local/sbin:/usr/local/bin
DAEMON=/usr/local/sbin/proftpd
NAME=proftpd

# Defaults
RUN="no"
OPTIONS="--config /usr/local/etc/proftpd.conf"

PIDFILE=`grep -i 'pidfile' /usr/local/etc/proftpd.conf | sed -e 's/pidfile[\t ]\+//i'`
if [ "x$PIDFILE" = "x" ];
then
        PIDFILE=/usr/local/var/proftpd.pid
fi

# Read config (will override defaults)
[ -r /etc/default/proftpd ] && . /etc/default/proftpd

trap "" 1
trap "" 15

test -f $DAEMON || exit 0

. /lib/lsb/init-functions

#
# Servertype could be inetd|standalone|none.
# In all cases check against inetd and xinetd support.
#
if ! egrep -qi "^[[:space:]]*ServerType.*standalone" /usr/local/etc/proftpd.conf
then
    if [ $(dpkg-divert --list xinetd|wc -l) -eq 1 ] 
    then
        if egrep -qi "server[[:space:]]*=[[:space:]]*/usr/local/sbin/proftpd" /etc/xinetd.conf 2>/dev/null || \
           egrep -qi "server[[:space:]]*=[[:space:]]*/usr/local/sbin/proftpd" /etc/xinetd.d/* 2>/dev/null
        then
                RUN="no"
                INETD="yes"
        else
                if ! egrep -qi "^[[:space:]]*ServerType.*inetd" /usr/local/etc/proftpd.conf
                then
                        RUN="yes"
                        INETD="no"
                else
                        RUN="no"
                        INETD="no"
                fi
        fi
    else
        if egrep -qi "^ftp.*/usr/local/sbin/proftpd" /etc/inetd.conf 2>/dev/null
        then
                RUN="no"
                INETD="yes"
        else
                if ! egrep -qi "^[[:space:]]*ServerType.*inetd" /usr/local/etc/proftpd.conf
                then
                        RUN="yes"
                        INETD="no"
                else
                        RUN="no"
                        INETD="no"
                fi
        fi
    fi
fi

# overrule: 
RUN="yes"
INETD="no"

# /var/run could be on a tmpfs

[ ! -d /var/run/proftpd ] && mkdir /var/run/proftpd

start()
{
    log_daemon_msg "Starting ftp server" "$NAME"

    start-stop-daemon --start --quiet --pidfile "$PIDFILE" --oknodo --exec $DAEMON -- $OPTIONS  
    if [ $? != 0 ]; then
        log_end_msg 1
        exit 1
    else
        log_end_msg 0
    fi
}

signal()
{

    if [ "$1" = "stop" ]; then
        SIGNAL="TERM"
        log_daemon_msg "Stopping ftp server" "$NAME"
    else
        if [ "$1" = "reload" ]; then
            SIGNAL="HUP"
            log_daemon_msg "Reloading ftp server" "$NAME"
        else
            echo "ERR: wrong parameter given to signal()"
            exit 1
        fi
    fi
    if [ -f "$PIDFILE" ]; then
        start-stop-daemon --stop --signal $SIGNAL  --pidfile "$PIDFILE"
         if [ $? = 0 ]; then
                log_end_msg 0
        else
                SIGNAL="KILL"
                start-stop-daemon --stop --signal $SIGNAL --pidfile "$PIDFILE"
                if [ $? != 0 ]; then
                        log_end_msg 1
                        [ $2 != 0 ] || exit 0
                else
                        log_end_msg 0
                fi
        fi
        if [ "$SIGNAL" = "KILL" ]; then
                rm -f "$PIDFILE"
        fi
    else
        log_end_msg 0
    fi
}

case "$1" in
    start)
        if [ "x$RUN" = "xyes" ] ; then
            start
        else
            if [ "x$INETD" = "xyes" ] ; then
                echo "ProFTPd is started from inetd/xinetd."
            else 
                echo "ProFTPd warning: cannot start neither in standalone nor in inetd/xinetd mode. Check your configuration."
            fi
        fi
        ;;

    force-start)
        if [ "x$INETD" = "xyes" ] ; then
            echo "Warning: ProFTPd is started from inetd/xinetd (trying to start anyway)."
        fi
        start
        ;;
    
    stop)
        if [ "x$RUN" = "xyes" ] ; then
            signal stop 0
        else
            if [ "x$INETD" = "xyes" ] ; then
                echo "ProFTPd is started from inetd/xinetd."
            else 
                echo "ProFTPd warning: cannot start neither in standalone nor in inetd/xinetd mode. Check your configuration."
            fi
        fi
        ;;

    force-stop)
        if [ "x$INETD" = "xyes" ] ; then
            echo "Warning: ProFTPd is started from inetd/xinetd (trying to kill anyway)."
        fi
        signal stop 0
        ;;

    reload)
        signal reload 0
        ;;

    force-reload|restart)
        if [ "x$RUN" = "xyes" ] ; then
            signal stop 1
            sleep 2
            start
        else
            if [ "x$INETD" = "xyes" ] ; then
                echo "ProFTPd is started from inetd/xinetd."
            else 
                echo "ProFTPd warning: cannot start neither in standalone nor in inetd/xinetd mode. Check your configuration."
            fi
        fi
        ;;

    status)
        if [ "x$INETD" = "xyes" ] ; then
            echo "ProFTPd is started from inetd/xinetd."
                exit 0
        else 
            if [ -f "$PIDFILE" ]; then
                pid=$(cat $PIDFILE)
            else
                pid="x"
            fi
            if [ `pidof proftpd|grep "$pid"|wc -l` -ne 0 ] ; then
                echo "ProFTPd is started in standalone mode, currently running."
                        exit 0
            else
                echo "ProFTPd is started in standalone mode, currently not running."
                        exit 3
            fi
        fi
        ;;

    check-config)
        $DAEMON -t >/dev/null && echo "ProFTPd configuration OK" && exit 0
        exit 1
        ;;

    *)
        echo "Usage: /etc/init.d/$NAME {start|status|force-start|stop|force-stop|reload|restart|force-reload|check-config}"
        exit 1
        ;;
esac

exit 0

~$ sudo update-rc.d proftpd defaults

 Configure mysql login

The following lines in /usr/local/etc/proftpd.conf specify where to get the login names. You should replace the database, tablename, username, password, and columns with the needed values for your setup.

# To cause every FTP user to be "jailed" (chrooted) into their home
# directory, uncomment this line.
DefaultRoot ~

# Create home directories as needed, using chmod 755
# chmod 755 is set to make them readable to the user who needs them (apache for example).
CreateHome on 755 dirmode 755


# Set up mod_sql to authenticate against the VariantDB database
SQLEngine   on
AuthOrder    mod_sql.c
SQLBackend    mysql


# Set up mod_sql_password -my passwords are stored as encoded strings.  
SQLPasswordEngine     on
SQLPasswordEncoding     hex

# replace DBHOST, DBUSER and DBPASS with your mysql login credentials
# adapt 'DATABASE' to your database name
SQLConnectInfo   DATABASE@DBHOST DBUSER DBPASS
SQLAuthTypes     SHA1
SQLAuthenticate    users
# An empty directory in case chroot fails
SQLDefaultHomedir     /tmp
# Define a custom query for lookup that returns a passwd-like entry. UID (here 1000) and GID (here 1000) should match the user that owns the /home/USER/ftp-data folder (user holding the ftp-tree in its homedir).
SQLUserInfo    custom:/LookupUser
SQLNamedQuery    LookupUser SELECT "username,passwd_sha1,'1000','1000','/home/USER/ftp-data/%U','/bin/bash' FROM `TABLENAME` WHERE username='%U'"

This returns a /etc/passwd like line for the provided username,  that is checked by proftpd against the provided password. Upon success, the user is chrooted to /home/USER/ftp-data/<provided-username>. This directory is owned by <USER>. 

make sure you have sha1 encoded password strings in the database with the current setup. 

FTP, Installation, mysql, proftpd, Ubuntu