FTPAccess & PUREFTPD Modules not secure?!?

[raphie]

Hi,

I am trying to let my ftp server work nice with power ON/OFF
I've blocked all my local folders with FTPaccess (all red)
and enabled the user root directories in PUREFTPD

Both work, so users with home directories created in PUREFTPD only see their own dir and I only see the FTP root.

HOWEVER: After a reboot FTPaccess is reset to it's default (all dirs on)
and i manually need to switch them back off again. Also 2 out of 5 times PUREFTPD defaulted on me as well after reboot. (3 times it went OK)

As an extra security measure i've ACL's all my folders by excluding the FTP usergroup (users who have an FTP account, but should not access other folders) So there are more or less 3 layers of security

1 - FTPaccess (resets after reboot)
2. PUREFTPD (gives inconsistent results after reboot) and then the FTP users see all folders
3. ACL (at least this works, but it's a pain in the arse for my family since everybody now needs to logon to folders, instead of an anounymous SMB share.

I really want to turn of my N5200 from 24.00h to 07.00h both from a noise and powerconsumption perspective. However reboots don't seem to play nice with these modules 2.00.15

Anybody any ideas what i am doing wrong? also can i backup my settings, so i can reload instead of checking it all (are these settings saved with the Thecus backup?)

[peterfu]

Hi raphie,
What FTPaccess is doing is just to remove the symbolic links in the default ftproot - this is /raid/data/ftproot - but the N5200 rebuilds these links on every reboot. This was introduced in FW 2.00.x - the FTPacess module was done for 1.x firmware, where this rebuild was not done on reboot.

What version of PUREFTPD have You installed - the latest one is 2.00.07.2 and have You disabled the standard FTP service ?

br
Peter

[raphie]

yes the .2 version it is! I've dissabled the standaard FTP service and enabled it once installed.
but reading your question the standard service should probably stay disabled? ;D

[peterfu]

Yes - the problem is, that the standard service kills all pureftpd processes if started - I've not figured out how to avoid this - and the the standard ftp daemon with the settings on the ftp configuration page runs.

Please disable it and the restart the box to be sure all runs as it should be.

Ahhh, writing now this lines I have an idea - may be in the next version of the module.

br
Peter

[raphie]

yes, disabling the THECUS FTP service and applying the FTPD defaults works

settings now seem to stay ok.
I've removed FTP Access since that's no use on > V2.0 firmware anyway

[peterfu]

Perfect
br
Peter

[raphie]

And I almost forgot to thank you for this extensive effort.
you mkae the FTP server actually usefull.

What would be nice as well for a new version is to set an FTP root share as default dir and create users via selecting the Thecus user list.

or even better
create a group in the Thecus groups, call it FTP and any user uo throw in there gets his own root under the FTP root you have defined. This would take out the manual script part and force to synchronize users and ftp root folders.

[peterfu]

In fact I was already working on that in the way You described it, but then it came into my mind, that the Thecus boxes have also the possibility to use external AD users and therefore I decided not to convcentrate only on local users, because then the module would not work anymore for external AD users.
br
Peter