ProFTPD module mod_wrap2

ProFTPD module `mod_wrap2_file`

This submodule provides the file-specific "driver" for storing IP/DNS-based access control information in files.

Many programs will automatically add entries in the common hosts.allow/hosts.deny files, and use of this module will allow a proftpd daemon running in standalone mode to adapt as these entries are added. The portsentry program does this, for example: when illegal access is attempted, it will add hosts to the /etc/hosts.deny file.

This mod_wrap2 submodule is contained in the mod_wrap2_file.c, and is not compiled by default. See the mod_wrap2 installation instructions.

Author

Please contact TJ Saunders <tj at castaglia.org> with any questions, concerns, or suggestions regarding this module.

File Access Tables

Using file-based access tables (source-type of "file") the data will be stored in the familiar hosts.allow, hosts.deny file format.

The mod_wrap2_file module supports the "file" string for the source-type parameter of the WrapUserTables, WrapGroupTables, and WrapTables, configuration directives. If the "file" source-type is used, then the source-info parameter must be the full path to the file table.

Both file names are required. Also, the paths to both files must be the full path, with two exceptions: if the path starts with ~/, the check of that path will be delayed until a user requests a connection, at which time the path will be resolved to that user's home directory; or if the path starts with ~user/, where user is some system user. In this latter case, mod2_wrap will attempt to resolve and verify the given user's home directory on start-up. The %U variable can also be used in the paths; it will be resolved to the USER name sent by the client.

The format for the files used by mod_wrap2_file is described in the host_access(5) man page.

Examples:

  # Server-wide access files
  WrapTables file:/etc/hosts.allow file:/etc/hosts.deny

  # FTP server-specific access files
  WrapTables file:/etc/ftpd.allow file:/etc/ftpd.deny

  # Per-user access files, which are to be found in the user's home directory
  WrapUserTables file:~/my.allow file:~/my.deny

  # Per-user access files, which are not found in the user's home.
  WrapUserTables file:/etc/ftpd/acls/%U.allow file:/etc/ftpd/acls/%U.deny

Example File Tables

The following examples are taken from the hosts_access(5) man page:

Mostly Closed
In this case, access is denied by default. Only explicitly authorized hosts are permitted access.

The default policy (no access) is implemented with a trivial deny file:

  /etc/hosts.deny:
    ALL: ALL

This denies all service to all hosts, unless they are permitted access by entries in the allow file.

The explicitly authorized hosts are listed in the allow file. For example:

  /etc/hosts.allow:
    ALL: LOCAL @some_netgroup
    ALL: .foobar.edu EXCEPT terminalserver.foobar.edu

The first rule permits access from hosts in the local domain (no `.' in the host name) and from members of the some_netgroup netgroup. The second rule permits access from all hosts in the .foobar.edu domain (notice the leading dot), with the exception of terminalserver.foobar.edu.

Mostly Open
Here, access is granted by default; only explicitly specified hosts are refused service.

The default policy (access granted) makes the allow file redundant so that it can be omitted. The explicitly non-authorized hosts are listed in the deny file. For example:

  /etc/hosts.deny:
    ALL: some.host.name, .some.domain
    ALL EXCEPT in.fingerd: other.host.name, .other.domain

The first rule denies some hosts and domains all services; the second rule still permits finger requests from other hosts and domains.