Configuration Directives

The following configuration parameters control ProFTPD features and configuration:

AccessGrantMsg
Allow
AllowAll
AllowFilter
AllowForeignAddress
AllowGroup
AllowUser
AllowOverwrite
AllowRetrieveRestart
AllowStoreRestart
AnonRequirePassword
<Anonymous>
AnonymousGroup
AuthAliasOnly
AuthGroupFile
AuthPAMAuthoritative
AuthUserFile
AuthUsingAlias
Bind
CDPath
Class
Classes
CommandBufferSize
DefaultChdir
DefaultRoot
DefaultServer
DefaultTransferMode
DeferWelcome
Deny
DenyAll
DenyFilter
DenyGroup
DenyUser
<Directory>
DirFakeGroup
DirFakeMode
DirFakeUser
DisplayConnect
DisplayFirstChdir
DisplayGoAway
DisplayLogin
DisplayQuit
DisplayReadme
ExtendedLog
<Global>
Group
GroupOwner
GroupPassword
HiddenStor
HideGroup
HideNoAccess
HideUser
IdentLookups
IgnoreHidden
Include
<Limit>
LDAPDefaultAuthScheme

LDAPDefaultGID

LDAPDefaultUID

LDAPDNInfo

LDAPDoAuth

LDAPDoUIDLookups

LDAPDoGIDLookups

LDAPHomedirOnDemand

LDAPNegativeCache

LDAPQueryTimeout

LDAPServer

LogFormat
LoginPasswordPrompt
LsDefaultOptions
MaxClients
MaxClientsPerHost
MaxInstances
MaxLoginAttempts
MultilineRFC2228
Order
PAMConfig
PathAllowFilter
PathDenyFilter
PersistentPasswd
Port
RateReadBPS
RateReadFreeBytes
RateReadHardBPS
RateWriteBPS
RateWriteFreeBytes
RateWriteHardBPS
RequireValidShell
RootLogin
ScoreboardPath
ServerAdmin
ServerIdent
ServerName
ServerType
ShowDotFiles
ShowSymlinks
SocketBindTight
SyslogFacility
SystemLog
tcpBackLog
tcpNoDelay
tcpReceiveWindow
tcpSendWindow
TimesGMT
TimeoutIdle
TimeoutLogin
TimeoutNoTransfer
TimeoutStalled
TransferLog
Umask
UseFtpUsers
UseReverseDNS
User
UserDirRoot
UserAlias
UserPassword
<VirtualHost>
WtmpLog

AccessGrantMsg

Syntax: AccessGrantMsg message
Default: Dependent on login type
Context: server config, <VirtualHost>, <Anonymous>, <Global>
Compatibility: 0.99.0pl5 and later

Normally, a 230 response message is sent to an FTP client immediately after authentication, with a standard message indicating that the user has either logged in or that anonymous access has been granted. This message can be customized with the AccessGrantMsg directive. In the message argument, the magic cookie '%u' is replaced with the username specified by the client during login. Example:

AccessGrantMsg "Guest access granted for %u."

Allow

Syntax: Allow ["from"] "all"|"none"|host|network[,host|network[,...]]
Default: Allow from all
Context: <Limit>
Compatibility: 0.99.0pl6 and later

The Allow directive is used inside a <Limit> context to explicitly specify which hosts and/or networks have access to the commands or operations being limited. Allow is typically used in conjunction with Order and Deny in order to create sophisticated (or perhaps not-so-sophisticated) access control rules. Allow takes an optional first argument; the keyword from. Using from is purely cosmetic. The remaining arguments are expected to be a list of hosts and networks which will be explicitly granted access. The magic keyword all can be used to indicate that all hosts will explicitly be granted access (analogous to the AllowAll directive, except with a lower priority). Additionally, the magic keyword none can be used to indicate that no hosts or networks will be explicitly granted access (although this does not prevent them from implicitly being granted access). If all or none is used, no other hosts or networks can be supplied.

Host and network addresses can be specified by name or numeric address. For security reasons, it is recommended that all address information be supplied numerically. Relying solely on named addresses causes security to depend a great deal upon DNS servers which may themselves be vulnerable to attack or spoofing. Numeric addresses which specify an entire network should end in a trailing period (i.e. 10.0.0. for the entire 10.0.0 subnet). Named address which specify an entire network should begin with a trailing period (i.e. .proftpd.net for the entire proftpd.net domain).

Example:

<Limit LOGIN> Order Allow,Deny Allow from 128.44.26.,128.44.26.,myhost.mydomain.edu,.trusted-domain.org Deny from all </Limit>

AllowAll

Syntax: AllowAll
Default: Default is to implicitly AllowAll, but not explicitly
Context: <Directory>, <Anonymous>, <Limit>, .ftpaccess
Compatibility: 0.99.0 and later

The AllowAll directive explicitly allows access to a <Directory>, <Anonymous> or <Limit> block. Although proftpd's default behavior is to allow access to a particular object, the default is an implicit allow. AllowAll creates an explicit allow, overriding any higher level denial directives.

AllowFilter

Syntax: AllowFilter regular-expression
Default: None
Context: server config, <VirtualHost>, <Anonymous>, <Global>
Compatibility: 1.2.0pre7 and later

AllowFilter allows the configuration of a regular expression that must be matched for all commands sent to ProFTPD. It is extremely useful in controlling what characters may be sent in a command to ProFTPD, preventing some possible types of attacks against ProFTPD. The regular expression is applied against the entire command sent by the client, so care must be taken when creating a proper regex. Commands that fail the regex match result in a "Forbidden command" error being returned to the client.

If the regular-expression argument contains whitespace, it must be enclosed in quotes.

Example:

# Only allow commands containing alphanumeric characters and whitespace AllowFilter ".*/[a-zA-Z0-9 ]+$"

See Also: DenyFilter

AllowForeignAddress

Syntax: AllowForeignAddress on|off
Default: AllowForeignAddress off
Context: server config, <VirtualHost>, <Anonymous>, <Global>
Compatibility: 1.1.7 and later

Normally, proftpd disallows clients from using the ftp PORT command with anything other than their own address (the source address of the ftp control connection), as well as preventing the use of PORT to specify a low-numbered (< 1024) port. In either case, the client is sent an "Invalid port" error and a message is syslog'd indicating either "address mismatch" or "bounce attack". By enabling this directive, proftpd will allow clients to transmit foreign data connection addresses that do not match the client's address. This allows such tricks as permitting a client to transfer a file between two FTP servers without involving itself in the actual data connection. Generally it's considered a bad idea, security-wise, to permit this sort of thing.

AllowForeignAddress only affects data connection addresses; not tcp ports. There is no way (and no valid reason) to allow a client to use a low-numbered port in its PORT command.

AllowGroup

Syntax: AllowGroup group-expression
Default: None
Context: <Limit>
Compatibility: 1.1.1 and later

AllowGroup specifies a group-expression that is specifically permitted within the context of the <Limit> block it is applied to. group-expression has the same format as that used in DefaultRoot, in that it should contain a comma separated list of groups or "not" groups (by re is no way (and no valid reason) to allow a client to use a low-numbered port in its PORT command.