SmbFTPD Handbook
Priv Installation |
Next About |
Chapter 3 smbftpd.conf
Table of Contents
Option: ServerName
Syntax:
ServerName "Server Name"
Description:
Define the name of server. This will show when user logi:
Connected to localhost.com.
220 Server Name FTP server (SmbFTPD Ver 0.9) ready.
Name (localhost:alex):If ServerName is not set, we will use hostname which is get by gethostname(3).
Default:
None (Use hostname)
Option: ListenOnAddress
Syntax:
ListenOnAddress 192.168.0.1
Description:
When -D is specified (standalone), accept connections only on the specified address only. For example, if you have two network address, one is 172.16.1.1, the other is 61.62.63.64. You can set the ListenOnAddress 172.16.1.1 to accept traffic from intranet only.
If you would like to accept traffic from all interface, just remove this option.
Default:
None (Listen on all interfaces)
Option: Port
Syntax:
Port prot_num|service
Deacription:
Set the FTP port for listening connections. When -D (daemon mode) is specified, accept connections at port, specified as a numeric value or service name, instead of at the default ``ftp'' port.
Default:
Port ftp
Option: Umask
Syntax:
Umask umask
Description:
The default file creation mode mask is set to umask, which is expected to be an octal numeric value.
For example, if you would like file's mode to be 644 on creation, just set the umask to 022. Refer to umask(2) for details.
Default:
Umask 022
Option: PidFile
Syntax:
PidFile /some/where/file
Description:
The pid file for ftp daemon. When using daemon mode, the ftp daemon will write it's pid to pid file if set.
Default:
None (don't write pid)
Option: DebugMode
Syntax:
DebugMode Yes|No
Description:
og more information for debug.
Default:
DebugMode No
Option: LogCommand
Syntax:
LogCommand Yes|No
Description:
Each successful and failed ftp(1) session is logged using syslog with a facility of LOG_FTP. If this option is set to "Yes", the retrieve (get), store (put), append, delete, make directory, remove directory and rename operations and their filename arguments are also logged. By default, syslogd(8) logs these to /var/log/xferlog on FreeBSD.
Default:
LogCommand No
Option: DoWtmpLog
Syntax:
DoWtmpLog Yes|No
Description:
Log FTP session to /var/log/wtmp
Default:
DoWtmpLog No
Option: DisableEPSV
Syntax:
DisableEPSV Yes|No
Description:
Disable the EPSV command. This is useful for servers behind older firewalls.
Default:
DisableEPSV No
Option: ShowSymlink
Syntax:
ShowSymlink Yes|No
Description:
When ShowSymlinks is No, we won't show symbolic links when listing files.
Default:
ShowSymlink No
Option: RestrictedPorts
Syntax:
RestrictedPorts Yes|No
Description:
With this option set to "No", ftpd will revert to historical behavior with regard to security checks on user operations and restrictions on PORT requests. Currently, ftpd will only honor PORT commands directed to unprivileged ports (which is > 1024 in most OS) on the remote user's host (which violates the FTP protocol specification but closes some security holes).
Default:
RestrictedPorts Yes
Option: RestrictedDataPorts
Syntax:
RestrictedDataPorts Yes|No
Description:
Set this option to "NO" to make ftpd use data ports in the range of IP_PORTRANGE_DEFAULT instead of in the range of IP_PORTRANGE_HIGH. Such a change may be useful for some specific firewall configurations; see ip(4) for more information.
Default:
RestrictedDataPorts Yes
Option: MaxConnection
Syntax:
MaxConnection number
Description:
This option allows the number of simultaneous connections to a service to be limited. If max connections is greater than 0 then connections will be refused if this number of connections to the service are already open. A value of zero mean an unlimited number of connections may be made.
Default:
MaxConnection 0
Option: RequireValidShell
Syntax:
RequireValidShell Yes|No
Description:
When RequireValidShare=Yes, The user must have a standard shell returned by getusershell(3). In most system, the valid shells will appear in /etc/shells.
Default:
RequireValidShell No
Option: EmptyPasswdLogin
Syntax:
EmptyPasswdLogin Yes|No
Description:
Does the server allow users without password login.
Default:
EmptyPasswdLogin No
Option: NoLoginList
Syntax:
NoLoginList user1,user2,@group1,@group2
Description:
List of unwelcome/restricted users. Users or groups in the list can not login to the system.
The arguments for NoLoginList can be user or group. When using group, please add an prefix '@'. When multi users/groups, seperate
# by ",".For example:
NoLoginList user1,@group1,user2
It means user1, user2, and group group1 can not login.
Default:
None
Option: TimeOut
Syntax:
TimeOut seconds
Description:
The inactivity timeout period is set to timeout seconds. The default is 15 minutes.
Default:
TimeOut 900
Option: MaxTimeOut
Syntax:
MaxTimeOut seconds
Description:
A client may also request a different timeout period; the maximum period allowed may be set to MaxTimeOut. The default limit is 2 hours.
Default:
MaxTimeOut 7200
Option: DefaultMode
Syntax:
DefaultMode SMB|Normal
Description:
here are two modes. The SMB mode or Normal mode. The smbftpd will use the share access rights in smb.conf under SMB mode. On the contrary, it will be normal FTP daemon under the Normal mode.
Default:
DefaultMode Normal
Option: ExceptionList
Syntax:
ExceptionList user1,user2,@group1,@group2
Description:
You can use the ExceptionList to set users/groups that do not use the default ftp mode that is set by DefaultMode. For example, if you would like to use SMB mode for all users execpt wheel group, you can set the DefaultMode to the SMB and add @wheel to the ExceptionList.
The arguments for ExceptionList can be user or group. When using group, please add an prefix '@'. When multi users/groups, seperate by ",". For example:
ExceptionList user1,user2,@group1,@group2
Default:
None
Option: ShareConfPath
Syntax:
ShareConfPath /some/where/smb.conf
Description:
Set the path of share configuration file "smbftp_share.conf". If DefaultMode is SMB or DefaultMode is Normal with ExceptionList, you must set the path of samba's config file.
I will check the following keywords in share folder setting:
- path: The path of share.
- rw: users/groups that have write privilege.
- ro: users/groups that have read only privilege.
- browseable: does the share is visible when ls in root directory. If it is set to "no", users will not be able to see the share. But they can still "cd" into the it.
- disable_download: Set the users/groups that can perform download operation. If user has read only privilege on the share, you can also add the user in "disable_download" list to disable the download privilege for the user.
- disable_ls: Set users/groups that can see directory contents when perform LIST command.
- disable_modify: Users/groups in the list will not able to modify files/directories in the share. If users have read/write privilege and is in the "disable_modify" list, they can upload files and create new directories. But can not perform rename, delete, rmdir, chmod.
Example 1:
Here is an example that there is a share named "public" and the path is /home/public, users in samba group have read privilege, root has write privilege:
[public] path = /home/public rw = root ro = @sambaExample 2:
Share name is private only wheel group can write, and is not browseable when LIST, but you can cd to private share even you can see it when ls.
[private] path = /root/ftp rw = @wheel browseable = noExample 3:
The share name is upload. Users "ftp" and "anonymous" can upload files or create new directories. But they are not able to see the files in the share. They can not download nor modify existed files. Users in "wheel" group have full privileges.
[upload] path=/home/upload" rw=ftp,@wheel disable_ls=ftp disable_modify=ftp disable_download=ftpNotice that the anonymous users "ftp" and "anonymous" are mapped to real user "ftp". If you would like to set the privilege for these users, you would have to use user "ftp".
Default:
None
Option: ChrootSet
Syntax:
ChrootSet user path
ChrootSet @group path
ChrootSet @ path
Description:
Users/Groups in the list will be applied to this session by changing its root directory with chroot(2) to that specified on the "path".
The first field specifies a user or group name. If it is prefixed by an ``at'' sign, `@', it specifies a group name; the line will match each user who is a member of this group. As a special case, a single `@' in this field will match any user. A username is specified otherwise.
Notice: The chrooted users will use Normal mode rather then SMB mode even they are set to use SMB mode. See option "DefaultMode".
Here are some examples:
Example 1:
When user "anonymous" login, chroot to /var/spool/ftp
ChrootSet anonymous /var/spool/ftpExample 2:
Members in "ftpgroup" group would be changed root directory to their home directory. For example, user alex's home directory is /home/alex, then it's root directory would be /home/alex. If user jack's home directory is /home/jack, its root directory would be /home/jack. We use "~" to represent user's home directory. The system will transfer it into real path.
ChrootSet @ftpgroup ~Example 3:
Members of "webusers" group would be changed root directory to the "public_html" directory under their home directory, thus lowering possible impact on the system from intrinsic insecurity of FTP.
ChrootSet @webusers ~/public_htmlExample 4:
All users (a single `@') will be chroot to their home directory.
ChrootSet @ ~
Default:
None
Option: AnonymousLogin
Syntax:
AnonymousLogin Yes|No
Description:
Does the server allow anonymous users login. The anonymous accounts are "anonymous" and "ftp". To enable anonymous account, you must add an user "ftp".
Default:
AnonymousLogin No
Option: AnonymousOnly
Syntax:
AnonymousOnly Yes|No
Description:
Does the server allow ONLY anonymous users login.
Default:
AnonymousOnly No
Option: TransferLog
Syntax:
TransferLog path/to/logfile
Description:
The TransferLog is the file that will record download/upload log. When TransferLog is specified, we will log all download and upload information in the file.
We will log the following information: Current time, remote host, user, command, transfer type(ASCII or Binary), transfer time, bytes, and filename.
Default:
None
Option: MaxDownloadRate
Syntax:
MaxDownloadRate @grou|user rate
Description:
Configure transfer rate for download. The rate is in KB/s. You may set multiple MaxDownloadRate lines to control rates for different users and groups.
The first field specifies a user or group name. If it is prefixed by an ``at'' sign, `@', it specifies a group name; the line will match each user who is a member of this group. As a special case, a single `@' in this field will match any user. A username is specified otherwise. For example:
MaxDownloadRate @group100 100 MaxDownloadRate anonymous 20 MaxDownloadRate @friends 1000
Default:
unlimited
Option: MaxUploadRate
Syntax:
MaxUploadRate @grou|user rate
Description:
Configure transfer rate for users upload. The rate is in KB/s. You may set multiple MaxUploadRate lines to control rates for different users and groups.
The first field specifies a user or group name. If it is prefixed by an ``at'' sign, `@', it specifies a group name; the line will match each user who is a member of this group. As a special case, a single `@' in this field will match any user. A username is specified otherwise. For example:
MaxUploadRate @group100 100 MaxUploadRate anonymous 20 MaxUploadRate @friends 1000
Default:
unlimited
Option: SecurityPolicy
Syntax:
SecurityPolicy secure|nosecure|both
Description:
This option allow you to enable/disable SSL/TLS. There are three options - secure, nosecure, and both.
- secure - Don't fall back into the non-secure mode if the TLS/SSL handshake fails.
- nosecure - Disable the TLS/SSL encryption at all and allow only non-secure clients.
- both - Allow both SSL/TLS encryption and non-secure clients.
The default is to allow both secure and non-secure connections.
Default:
SecurityPolicy both
Option: EncryptionType
Syntax:
EncryptionType tls|ssl|both
Description:
We support TLS (RFC2228) and SSL encryptions. This option allow you to set the which encryption protocol you would like to use.
- tls - Use only the RFC2228-compliant FTP-TLS negotiation mode; don't try to negotiate something different.
- ssl - Use only the FTP-SSL compatibility mode (for early implementations of the FTP-SSL upgrade); don't try to negotiate something different.
- both - Accept both FTP-TLS and FTP-SSL security extensions.
Default:
EncryptionType both
Option: NormalUserMustSecure
Syntax:
NormalUserMustSecure Yes|No
Description:
When NormalUserMustSecure is set to "Yes", it require the TLS/SSL encryption for non-anonymous users.
The propose of SSL/TLS encryption is to protect user's password and data travel in network. Set this option on to force users using secure connection is a good idea.
Default:
NormalUserMustSecure No
Option: AnonymDisableSecure
Syntax:
AnonymDisableSecure Yes|No
Description:
Set the AnonymDisableSecure to "Yes" if you would like to disable the TLS/SSL encryption for anonymous users. Since the SSL/TLS is used to protect private data, there is no reason to apply data encryption on anonymous users.
Set this to "Yes" to save CPU resource and speed up anonymous connections.
Default:
AnonymDisableSecure No
Option: SSLCertFile
Syntax:
SSLCertFile /path/to/server.crt
Description:
The certificate to use. This certificate will be passed to the client. If it is not specified, it will be default to /usr/local/etc/smbftpd/ssl.crt/server.crt.
You may use the Apache+SSL's certificate which is normally located in /usr/local/apache/conf/ssl.crt/server.crt.
Default:
SSLCertFile /usr/local/etc/smbftpd/ssl.crt/server.crt
Option: SSLKeyFile
Syntax:
SSLKeyFile /path/to/server.key
Description:
The private key that matches the certificate specified by the SSLCertFile option. Both SSLCertFile and SSLKeyFile files are assumed to be in PEM format. Default is /usr/local/etc/smbftpd/ssl.key/server.key
You may use the Apache+SSL's private key if you are using its certificate. The Apache+SSL's private key is usually in: /usr/local/apache/conf/ssl.key/server.key
Default:
SSLKeyFile /usr/local/etc/smbftpd/ssl.key/server.key
Option: SSLDebugMode
Syntax:
SSLDebugMode Yes|No
Description:
Set to "Yes" if you would like to enable SSL debug log. If "Yes", you would have to set the SSLDebugLog to specify location of the log file.
Default:
SSLDebugMode No
Option:SSLDebugLog
Syntax:
SSLDebugLog /var/log/smbftpd-ssl.log
Description:
When SSLDebugMode is enabled, you have to specify the path of log file.
Default:
None
Priv Installation |
Index |
Next About |