diff -uprk.orig vsftpd-1.2.1.orig/tunables.c vsftpd-1.2.1/tunables.c --- vsftpd-1.2.1.orig/tunables.c 2003-11-06 04:08:29 +0300 +++ vsftpd-1.2.1/tunables.c 2004-01-17 20:12:24 +0300 @@ -38,7 +38,7 @@ int tunable_userlist_enable = 0; int tunable_userlist_deny = 1; int tunable_use_localtime = 0; int tunable_check_shell = 1; -int tunable_hide_ids = 0; +int tunable_hide_ids = 1; int tunable_listen = 0; int tunable_port_promiscuous = 0; int tunable_passwd_chroot_enable = 0; @@ -65,8 +65,8 @@ unsigned int tunable_ftp_data_port = 20; unsigned int tunable_idle_session_timeout = 300; unsigned int tunable_data_connection_timeout = 300; /* IPPORT_USERRESERVED + 1 */ -unsigned int tunable_pasv_min_port = 5001; -unsigned int tunable_pasv_max_port = 0; +unsigned int tunable_pasv_min_port = 49152; +unsigned int tunable_pasv_max_port = 65535; unsigned int tunable_anon_max_rate = 0; unsigned int tunable_local_max_rate = 0; /* IPPORT_FTP */ @@ -77,19 +77,19 @@ unsigned int tunable_file_open_mode = 06 unsigned int tunable_max_per_ip = 0; unsigned int tunable_trans_chunk_size = 0; -const char* tunable_secure_chroot_dir = "/usr/share/empty"; -const char* tunable_ftp_username = "ftp"; +const char* tunable_secure_chroot_dir = "/var/empty"; +const char* tunable_ftp_username = "vsftpd"; const char* tunable_chown_username = "root"; const char* tunable_xferlog_file = "/var/log/xferlog"; const char* tunable_vsftpd_log_file = "/var/log/vsftpd.log"; const char* tunable_message_file = ".message"; -const char* tunable_nopriv_user = "nobody"; +const char* tunable_nopriv_user = "novsftpd"; const char* tunable_ftpd_banner = 0; -const char* tunable_banned_email_file = "/etc/vsftpd.banned_emails"; -const char* tunable_chroot_list_file = "/etc/vsftpd.chroot_list"; -const char* tunable_pam_service_name = "ftp"; -const char* tunable_guest_username = "ftp"; -const char* tunable_userlist_file = "/etc/vsftpd.user_list"; +const char* tunable_banned_email_file = "/etc/vsftpd/banned_emails"; +const char* tunable_chroot_list_file = "/etc/vsftpd/chroot_list"; +const char* tunable_pam_service_name = "vsftpd"; +const char* tunable_guest_username = "vsftpd"; +const char* tunable_userlist_file = "/etc/vsftpd/user_list"; const char* tunable_anon_root = 0; const char* tunable_local_root = 0; const char* tunable_banner_file = 0; @@ -101,5 +101,5 @@ const char* tunable_cmds_allowed = 0; const char* tunable_hide_file = 0; const char* tunable_deny_file = 0; const char* tunable_user_sub_token = 0; -const char* tunable_email_password_file = "/etc/vsftpd.email_passwords"; +const char* tunable_email_password_file = "/etc/vsftpd/email_passwords"; diff -uprk.orig vsftpd-1.2.1.orig/vsftpd.conf vsftpd-1.2.1/vsftpd.conf --- vsftpd-1.2.1.orig/vsftpd.conf 2003-01-21 04:15:34 +0300 +++ vsftpd-1.2.1/vsftpd.conf 2004-01-17 20:29:05 +0300 @@ -1,13 +1,19 @@ -# Example config file /etc/vsftpd.conf +# The configuration file for vsftpd. # # The default compiled in settings are fairly paranoid. This sample file # loosens things up a bit, to make the ftp daemon more usable. -# Please see vsftpd.conf.5 for all compiled in defaults. +# Please see vsftpd.conf(5) for all compiled in defaults. # # READ THIS: This example file is NOT an exhaustive list of vsftpd options. -# Please read the vsftpd.conf.5 manual page to get a full idea of vsftpd's +# Please read the vsftpd.conf(5) manual page to get a full idea of vsftpd's # capabilities. # +# Uncomment this to disallow the PORT method of obtaining a data connection. +#port_enable=NO +# +# Uncomment this to disallow the PASV method of obtaining a data connection. +#pasv_enable=NO +# # Allow anonymous FTP? (Beware - allowed by default if you comment this out). anonymous_enable=YES # @@ -21,6 +27,16 @@ anonymous_enable=YES # if your users expect that (022 is used by most other ftpd's) #local_umask=022 # +# The minimum port to allocate for PASV style data connections. +# Can be used to specify a narrow port range to assist firewalling. +# The default is shown below. +#pasv_min_port=49152 +# +# The maximum port to allocate for PASV style data connections. +# Can be used to specify a narrow port range to assist firewalling. +# The default is shown below. +#pasv_max_port=65535 +# # Uncomment this to allow the anonymous FTP user to upload files. This only # has an effect if the above global write enable is activated. Also, you will # obviously need to create a directory writable by the FTP user. @@ -61,7 +77,7 @@ connect_from_port_20=YES # # It is recommended that you define on your system a unique user which the # ftp server can use as a totally isolated and unprivileged user. -#nopriv_user=ftpsecure +#nopriv_user=novsftpd # # Enable this and the server will recognise asynchronous ABOR requests. Not # recommended for security (the code is non-trivial). Not enabling it, @@ -88,18 +104,31 @@ connect_from_port_20=YES # useful for combatting certain DoS attacks. #deny_email_enable=YES # (default follows) -#banned_email_file=/etc/vsftpd.banned_emails +#banned_email_file=/etc/vsftpd/banned_emails # # You may specify an explicit list of local users to chroot() to their home # directory. If chroot_local_user is YES, then this list becomes a list of # users to NOT chroot(). +# Warning: these features have non-trivial security implications, especially +# if the users also have shell access. Only enable if you know what you are +# doing (and you probably don't). #chroot_list_enable=YES # (default follows) -#chroot_list_file=/etc/vsftpd.chroot_list +#chroot_list_file=/etc/vsftpd/chroot_list # # You may activate the "-R" option to the builtin ls. This is disabled by # default to avoid remote users being able to cause excessive I/O on large # sites. However, some broken FTP clients such as "ncftp" and "mirror" assume # the presence of the "-R" option, so there is a strong case for enabling it. #ls_recurse_enable=YES +# +# If enabled, all user and group information in directory listings will be +# displayed as "ftp". +# The default is to hide user and group information. +#hide_ids=YES +# +# If enabled, vsftpd will display directory listings with the time in your +# local time zone. The default is to display GMT. The times returned by the +# MDTM FTP command are also affected by this option. +#use_localtime=YES diff -uprk.orig vsftpd-1.2.1.orig/vsftpd.conf.5 vsftpd-1.2.1/vsftpd.conf.5 --- vsftpd-1.2.1.orig/vsftpd.conf.5 2003-11-12 04:06:25 +0300 +++ vsftpd-1.2.1/vsftpd.conf.5 2004-01-17 20:32:32 +0300 @@ -128,7 +128,7 @@ chroot() jail in their home directory up different if chroot_local_user is set to YES. In this case, the list becomes a list of users which are NOT to be placed in a chroot() jail. By default, the file containing this list is -/etc/vsftpd.chroot_list, but you may override this with the +/etc/vsftpd/chroot_list, but you may override this with the .BR chroot_list_file setting. @@ -156,7 +156,7 @@ Default: NO (but the sample config file .B deny_email_enable If activated, you may provide a list of anonymous password e-mail responses which cause login to be denied. By default, the file containing this list is -/etc/vsftpd.banned_emails, but you may override this with the +/etc/vsftpd/banned_emails, but you may override this with the .BR banned_email_file setting. @@ -209,7 +209,7 @@ Default: NO If enabled, all user and group information in directory listings will be displayed as "ftp". -Default: NO +Default: YES .TP .B listen If enabled, vsftpd will run in standalone mode. This means that vsftpd must @@ -306,7 +306,7 @@ anonymous logins are prevented unless th file specified by the .BR email_password_file setting. The file format is one password per line, no extra whitespace. The -default filename is /etc/vsftpd.email_passwords. +default filename is /etc/vsftpd/email_passwords. Default: NO .TP @@ -511,13 +511,13 @@ Default: 0 (unlimited) The maximum port to allocate for PASV style data connections. Can be used to specify a narrow port range to assist firewalling. -Default: 0 (use any port) +Default: 65535 .TP .B pasv_min_port The minimum port to allocate for PASV style data connections. Can be used to specify a narrow port range to assist firewalling. -Default: 0 (use any port) +Default: 49152 .TP .B trans_chunk_size You probably don't want to change this, but try setting it to something like @@ -541,7 +541,7 @@ passwords which are not permitted. This .BR deny_email_enable is enabled. -Default: /etc/vsftpd.banned_emails +Default: /etc/vsftpd/banned_emails .TP .B banner_file This option is the name of a file containing text to display when someone @@ -570,7 +570,7 @@ is enabled. If the option is enabled, then the list file becomes a list of users to NOT place in a chroot() jail. -Default: /etc/vsftpd.chroot_list +Default: /etc/vsftpd/chroot_list .TP .B cmds_allowed This options specifies a comma separated list of allowed FTP commands (post @@ -606,13 +606,13 @@ This option can be used to provide an al .BR secure_email_list_enable setting. -Default: /etc/vsftpd.email_passwords +Default: /etc/vsftpd/email_passwords .TP .B ftp_username This is the name of the user we use for handling anonymous FTP. The home directory of this user is the root of the anonymous FTP area. -Default: ftp +Default: vsftpd .TP .B ftpd_banner This string option allows you to override the greeting banner displayed @@ -626,7 +626,7 @@ See the boolean setting for a description of what constitutes a guest login. This setting is the real username which guest users are mapped to. -Default: ftp +Default: vsftpd .TP .B hide_file This option can be used to set a pattern for filenames (and directory names @@ -674,12 +674,12 @@ totally unprivileged. Note that this sho than nobody. The user nobody tends to be used for rather a lot of important things on most machines. -Default: nobody +Default: novsftpd .TP .B pam_service_name This string is the name of the PAM service vsftpd will use. -Default: ftp +Default: vsftpd .TP .B pasv_address Use this option to override the IP address that vsftpd will advertise in @@ -692,7 +692,7 @@ This option should be the name of a dire directory should not be writable by the ftp user. This directory is used as a secure chroot() jail at times vsftpd does not require filesystem access. -Default: /usr/share/empty +Default: /var/empty .TP .B user_config_dir This powerful option allows the override of any config option specified in @@ -700,10 +700,10 @@ the manual page, on a per-user basis. Us with an example. If you set .BR user_config_dir to be -.BR /etc/vsftpd_user_conf +.BR /etc/vsftpd/user_conf and then log on as the user "chris", then vsftpd will apply the settings in the file -.BR /etc/vsftpd_user_conf/chris +.BR /etc/vsftpd/user_conf/chris for the duration of the session. The format of this file is as detailed in this manual page! PLEASE NOTE that not all settings are effective on a per-user basis. For example, many settings only prior to the user's session @@ -739,7 +739,7 @@ This option is the name of the file load .BR userlist_enable option is active. -Default: /etc/vsftpd.user_list +Default: /etc/vsftpd/user_list .TP .B vsftpd_log_file This option is the name of the file to which we write the vsftpd style