0

I've installed Pureftpd on 16.04, but I'm struggling to configure it the way I want.

I want to prevent the regular system users from being able to login, so I've got the file /etc/pure-ftpd/conf/UnixAuthentication with the contents no and a symbolic link /etc/pure-ftpd/auth/65unix to /etc/pure-ftpd/conf/UnixAuthentication. When I restart the pureftpd server, I'm still able to log in with any system user.

I've tried removing the link with the contents no and a symbolic link /etc/pure-ftpd/auth/65unix, but I'm still able to log in.

When I restart the server I'm using systemctl restart.

It appears that the configuration is not being respected by the server. How can I make it so that pureftpd wont allow logins by regular users?

UPDATE

OK, so configuration files are being respected. At least the ones for MinUID and NoAnonymous. Its just that changing the contents of /etc/pure-ftpd/conf/UnixAuthentication from yes to no has no effect. Either this configuration option doesn't do as I expected and prevent system users from logging in, or the option doesn't work.

FURTHER UPDATE

Just discovered the command pure-ftpd-wrapper --show-options which shows which options pure-ftpd is running with. When I set the contents of /etc/pure-ftpd/conf/UnixAuthentication to No, the output of pure-ftpd-wrapper --show-options is

-J ALL:!aNULL:!SSLv3 -u 1000 -8 UTF-8 -E -O clf:/var/log/pure-ftpd/transfer.log -g /var/run/pure-ftpd/pure-ftpd.pid

When I set it to yes, the output is

-l unix -J ALL:!aNULL:!SSLv3 -u 1000 -8 UTF-8 -E -O clf:/var/log/pure-ftpd/transfer.log -g /var/run/pure-ftpd/pure-ftpd.pid

The man page for pure-ftpd says -l unix For standard (/etc/passwd) authentication.

I don't understand why pure-ftpd without the -l unix options allows users to log into the system authenticating against standard linux (/etc/passwd) account.

Dom
  • 173

1 Answers1

0

So it appears that with no authentication methods explicitly set Pureftpd defaults to standard unix authentication from /etc/passwd. This is true even when etc/pure-ftpd/conf/UnixAuthentication is explicitly set to no!

It seems there is a mismatch between pure-ftpd-wrapper and pure-ftpd itself. Pure-ftpd only has command line switches to explicitly enable an authentication method, but not to explicitly exclude a method. However, the pure-ftpd-wrapper man page says

To disable the option use "No",0 or "Off".

but really all it can do is not pass an 'on' switch to the command line arguments of pure-ftpd, as pure-ftpd doesn't accept any disable flags.

As pure-ftpd falls back to Unix authentication in the absence of any other type of authentication, the presence of an 'Off' flag is not the same as the absence of an 'On' flag!

By enabling PureDB authentication, I was able to disable standard Unix authentication as it seems to take presence over the default.

Dom
  • 173