mod_core
The mod_core
module handles most of the core FTP commands.
<VirtualHost>
, <Global>
, <Anonymous>
, <Directory>
The Include
directive allows inclusion of other configuration
files from within the server configuration files.
Shell-style (fnmatch(3)
) wildcard characters can be used to
include several files at once, in alphabetical order. In addition, if
Include
points to a directory, rather than a file, then
proftpd
will read all files in that directory. Note
that including entire directories is not recommended, as it is easy to
accidentally leave temporary files in a directory that can cause
proftpd
to fail.
The path must be an absolute path. Examples:
Include /etc/proftpd/conf/tls.conf Include /etc/proftpd/conf/vhosts/*.conf
<VirtualHost>
, <Global>
The MaxCommandRate
directive is used to configure a maximum
number of commands per time interval, after which proftpd
will
start injecting a delay before handling the command. The more over the
configured command/sec rate the client is, the longer the delay. This feature
is used to "throttle" automated and/or malicious clients.
For example:
MaxCommandRate 200sets a maximum command rate of 200 commands per sec. Or:
MaxCommandRate 500 2sets a maximum command rate of 500 commands every 2 secs.
<VirtualHost>
, <Global>, <Anonymous>
, <Directory>
, .ftpaccess
Module: mod_core
Compatibility: 1.1.7 and later
The PathAllowFilter
directive allows the configuration of a
regular expression pattern that must be matched for all newly
uploaded (stored) files. The regular expression is applied against the entire
pathname specified by the client, so care must be taken when creating a proper
regex. Paths that fail the regex match result in a "Forbidden filename" error
being returned to the client. If the regular expression pattern
parameter contains whitespace, it must be enclosed in quotes.
For example:
# Only allow a-z 0-9 . - _ in file names
PathAllowFilter ^[a-z0-9._-]+$
# As above but with upper case characters as well
PathAllowFilter ^[A-Za-z0-9._-]+$
The optional flags paramete, if present, modifies how the given
pattern will be evaludated. The supported flags are:
- nocase|NC (no case)
This makes the pattern case-insensitive, i.e. there is
no difference between 'A-Z' and 'a-z' when pattern is matched
against the path
The Filters howto covers filtering in
greater detail.
See also: PathDenyFilter
PathDenyFilter
Syntax: PathDenyFilter pattern [flags]
Default: None
Context: server config, <VirtualHost>
, <Global>, <Anonymous>
, <Directory>
, .ftpaccess
Module: mod_core
Compatibility: 1.1.7 and later
Similar to the PathAllowFilter
directive, PathDenyFilter
specifies a regular expression
pattern which must not match any uploaded pathnames. If the
regex does match, a "Forbidden filename" error is returned to the client.
This can be especially useful for forbidding .ftpaccess or .htaccess files.
For example:
# We don't want .ftpaccess or .htaccess files to be uploaded
PathDenyFilter "(\\.ftpaccess|\\.htaccess)$"
The optional flags paramete, if present, modifies how the given
pattern will be evaludated. The supported flags are:
- nocase|NC (no case)
This makes the pattern case-insensitive, i.e. there is
no difference between 'A-Z' and 'a-z' when pattern is matched
against the path
The Filters howto covers filtering in
greater detail.
See also: PathAllowFilter
ProcessTitles
Syntax: ProcessTitles terse|verbose
Default: ProcessTitles verbose
Context: server config
Module: mod_core
Compatibility: 1.3.4rc2 and later
The ProcessTitles
directive is used to tweak how
proftpd
modifies the process title for session processes.
By default, proftpd
updates the process title to show the current
FTP command and its arguments for every session, e.g.:
# ps aux | grep proftpd
proftpd 30667 0.0 0.1 7304 1584 ? Ss 02:12 0:00 proftpd: (accepting connections)
user1 31892 0.2 0.3 8004 3505 ? SL 20:13 0:12 proftpd: user1 - remote.client1.com: RETR file1.doc
user2 31934 0.0 0.3 8004 3500 ? SL 21:27 0:00 proftpd: user2 - 4.3.2.1: STOR file2.zip
user3 31891 0.2 0.3 8004 3504 ? SL 20:11 0:09 proftpd: user3 - remote.client2.com: RETR whatever.iso
This is the same as having:
ProcessTitles verbose
in your proftpd.conf.
To obscure the process titles, you can use:
ProcessTitles terse
which results in process titles which look like:
# ps aux | grep proftpd
proftpd 30667 0.0 0.1 7304 1584 ? Ss 02:12 0:00 proftpd: (accepting connections)
user1 31892 0.2 0.3 8004 3505 ? SL 20:13 0:12 proftpd: processing connection
user2 31934 0.0 0.3 8004 3500 ? SL 21:27 0:00 proftpd: processing connection
user3 31891 0.2 0.3 8004 3504 ? SL 20:11 0:09 proftpd: processing connection
Protocols
Syntax: Protocols protocol1 ...
Default: None
Context: server config, <VirtualHost>
, <Global>
Module: mod_core
Compatibility: 1.3.4rc1 and later
The Protocols
directive is used to enable/disable specific
protocols support by the proftpd
and its collection of modules.
This directive can be used, in conjunction with the
mod_ifsession
module,
to enable certain features for specific users/groups/classes.
The allowed protocols must be configured as a space-delimited list. For
example:
# Only enable FTPS and SFTP support, but not FTP or SCP
Protocols ftps sftp
The currently known/supported protocols include:
TCPBacklog
Syntax: TCPBacklog backlog-size
Default: 5
Context: server config
Module: mod_core
Compatibility: 0.99.0 and later
The TCPBacklog
directive controls the TCP connection queue
size for listening sockets; this directive only applies to proftpd
when it is configured with "ServerType standalone
". It has
no effect if "ServerType inetd
" is configured.
When a TCP connection is established by the TCP/IP stack within the kernel,
there is a short period of time between the actual establishment of the
TCP connection and when that connection is accepted for use by the listening
daemon via the accept(2)
system call. The duration of this period
of time can vary quite a bit, and can depend upon several factors (e.g.
hardware, system load, etc). Any TCP connection which hasn't been
accepted by the listening daemon is placed in a "backlog" or queue of pending
connections. The TCPBacklog
directive controls how the size
of this queue of pending connections.
If this queue of pending connections becomes full, new TCP connections
cannot be estaslished. Under heavy load, this can result in occasional
(or even frequent) errors seen by clients, such as "Connection refused",
even though the daemon is clearly running.
The larger the backlog-size, the more TCP connections can be
established to the daemon. This also means more kernel memory and other kernel
resources.
The issue is complicated further by the fact that different operating
systems handle the backlog-size value differently. The pending
connection queue is a critical kernel-level structure, and is sensitive
to TCP syn floods.
Each operating system, then, has different ways of handling incoming and
pending connections, to attempt to guard against such attacks. For Linux
systems, read the tcp(7)
man page and specifically about
tcp_abort_on_overflow
,
tcp_max_syn_backlog
,
and tcp_syncookies
. On FreeBSD, read the
syncookies(4)
man page. And read
here for
additional tuning considerations on Solaris.
<VirtualHost>
, <Global>
The Trace
directive is used to configure which trace channels
are logged to the TraceLog
file, and
which log levels for messages in that trace channel.
For example, to get the default trace channels logged:
Trace DEFAULT:10
To disable logging of a particular trace channel entirely, use a log level of zero, e.g.:
# Log all of the default trace channels except for 'lock' and # 'scoreboard' Trace DEFAULT:10 lock:0 scoreboard:0
To see only a certain range of log levels in a given trace channel, you can specify the log level range like this:
# Log only messages at levels 7-10 for the default channels TraceLog DEFAULT:7-10
See the Tracing howto for more information.
The TraceLog
directive is used to specify a log file for trace
logging messages. The path parameter given must be the full path to
the file to use for logging.
Note that this path must not be to a world-writable directory and,
unless AllowLogSymlinks
is explicitly set to on
(generally a bad idea), the path must not be a symbolic link.
See the Tracing howto for more information.
The TraceOptions
directive can be used to change the format
of the TraceLog
messages, e.g.
adding/remove certain fields of data.
The options supported by the TraceOptions
directive are:
To enable an option, preface the option name with a '+' (plus) character; to disable the option, use a '-' (minus) character prefix. For example:
# Log timestamps inncluding millisecs, but do not include the connection # IP address/port information TraceOptions +TimestampMillis -ConnIPs
The TransferLog
directive configures the full path to the
"wu-ftpd style" file transfer log; see the xferlog(5)
man page
for a description of this log file format. Separate log files can be created
for each <Anonymous>
and/or <VirtualHost>
.
Additionally, the special keyword "none" (available in proftpd-1.1.7 and later)
can be used, which disables wu-ftpd style transfer logging for the context in
which the directive is used.
See also: ExtendedLog
,
LogFormat
mod_core
module is always installed.