21 |
supplies (virtual server mode) </item> |
supplies (virtual server mode) </item> |
22 |
</enumerate> |
</enumerate> |
23 |
</para> |
</para> |
24 |
|
|
25 |
|
<para> |
26 |
|
<emph> Information specific to these ways can be in the the subsections of this |
27 |
|
chapter. </emph> |
28 |
|
</para> |
29 |
|
|
30 |
|
<para> |
31 |
|
In both cases however, muddleftpd expects a list of group commands that |
32 |
|
describes how users are to be authenticated. Each group command specifies |
33 |
|
a section name that contains the group configuration, and the order you |
34 |
|
specify the group commands in the configuration file specifies what order |
35 |
|
muddleftpd will attempt to match a username to a group. |
36 |
|
</para> |
37 |
|
|
38 |
|
<para> |
39 |
|
Muddleftpd uses the following process to determine which group a user |
40 |
|
belongs to: |
41 |
|
<enumerate> |
42 |
|
<item>Muddleftpd determines a list of groups to search through, given |
43 |
|
the group list described in the configuration file.</item> |
44 |
|
<item>For each group in the list Muddleftpd will: |
45 |
|
<enumerate> |
46 |
|
<item> |
47 |
|
Use the authuser command to modify the username to authenticate. |
48 |
|
This only applies to each individual group, not any following |
49 |
|
groups the server will check. If authuser is not used, then it |
50 |
|
defaults to the username the user entered. <emph> See the |
51 |
|
command authuser in the reference for more information. </emph> |
52 |
|
</item> |
53 |
|
<item> |
54 |
|
Check the IP of the user to determine if it allowed to |
55 |
|
authenticate with the group, using ipacl commands. If an IP |
56 |
|
address is rejected by the group, muddleftpd will move onto |
57 |
|
the next. <emph> See the command ipacl in the reference |
58 |
|
for more information. </emph> |
59 |
|
</item> |
60 |
|
<item> |
61 |
|
Check the authentication username to see if is allowed to |
62 |
|
authenticate with this group, using nameacl commands. If a |
63 |
|
username is rejected by the group, muddleftpd will move onto |
64 |
|
the next group. <emph> See the command nameacl in the |
65 |
|
reference for more information. </emph> |
66 |
|
</item> |
67 |
|
<item> |
68 |
|
Pass the authentication username and the password the user |
69 |
|
entered onto the authentication module. The authentication |
70 |
|
module then decides if: |
71 |
|
<itemize> |
72 |
|
<item> The username password are correct, and allow the user to |
73 |
|
login. Muddleftpd will stop searching through the groups, and |
74 |
|
log the user using the current group. |
75 |
|
</item> |
76 |
|
<item> The username is unknown to this modules, and allow |
77 |
|
muddleftpd to move onto the next group. |
78 |
|
</item> |
79 |
|
<item> The username exists, but the password is incorrect. |
80 |
|
Muddleftpd will stop authentication, and report bad password |
81 |
|
to the client. |
82 |
|
</item> |
83 |
|
</itemize> |
84 |
|
</item> |
85 |
|
</enumerate> |
86 |
|
</item> |
87 |
|
<item> |
88 |
|
If muddleftpd has found the group the username belongs to, and |
89 |
|
the password is correct, then authentication is successful and the |
90 |
|
user is logged in. Otherwise, authentication is failed, and the user |
91 |
|
is given a bad password message. |
92 |
|
</item> |
93 |
|
</enumerate> |
94 |
|
The following is an example where users with specific usernames and/or |
95 |
|
ips cannot connect, valid usernames from other ip's can connect, and |
96 |
|
every other username is given anonymous access. Example (single server, |
97 |
|
trimmed): |
98 |
|
</para> |
99 |
|
<verbatim> |
100 |
|
|
101 |
|
[section] main |
102 |
|
|
103 |
|
group badusernames |
104 |
|
group badips |
105 |
|
group realusers |
106 |
|
group anonymous |
107 |
|
|
108 |
|
[section] badusernames |
109 |
|
|
110 |
|
nameacl A:root |
111 |
|
nameacl A:uucp |
112 |
|
nameacl A:*nonftp |
113 |
|
|
114 |
|
authmethod disabled |
115 |
|
|
116 |
|
[section] badips |
117 |
|
|
118 |
|
ipacl A:10.1.1.* |
119 |
|
ipacl A:(*.edu) |
120 |
|
|
121 |
|
|
122 |
|
</verbatim> |
123 |
|
<section> |
124 |
|
<heading> Single server configuration </heading> |
125 |
|
</section> |
126 |
|
<section> |
127 |
|
<heading> Virtual server configuration </heading> |
128 |
|
</section> |
129 |
|
|
130 |
</chapter> |
</chapter> |
131 |
|
|