54 |
Check the IP of the user to determine if it allowed to |
Check the IP of the user to determine if it allowed to |
55 |
authenticate with the group, using ipacl commands. If an IP |
authenticate with the group, using ipacl commands. If an IP |
56 |
address is rejected by the group, muddleftpd will move onto |
address is rejected by the group, muddleftpd will move onto |
57 |
the next. <emph> See the command ipacl in the reference |
the next. By default, a group will not accept any IP address. |
58 |
for more information. </emph> |
<emph> See the command ipacl in the reference for more |
59 |
|
information. </emph> |
60 |
</item> |
</item> |
61 |
<item> |
<item> |
62 |
Check the authentication username to see if is allowed to |
Check the authentication username to see if is allowed to |
63 |
authenticate with this group, using nameacl commands. If a |
authenticate with this group, using nameacl commands. If a |
64 |
username is rejected by the group, muddleftpd will move onto |
username is rejected by the group, muddleftpd will move onto |
65 |
the next group. <emph> See the command nameacl in the |
the next group. By default, no username is accepted by a group. |
66 |
|
<emph> See the command nameacl in the |
67 |
reference for more information. </emph> |
reference for more information. </emph> |
68 |
</item> |
</item> |
69 |
<item> |
<item> |
93 |
is given a bad password message. |
is given a bad password message. |
94 |
</item> |
</item> |
95 |
</enumerate> |
</enumerate> |
96 |
The following is an example where users with specific usernames and/or |
The following is an example where users with the specific usernames |
97 |
ips cannot connect, valid usernames from other ip's can connect, and |
root, uucp, and any name ending with nonftp cannot login. Any other |
98 |
every other username is given anonymous access. Example (single server, |
real usernames can log in via their username/password. All other |
99 |
trimmed): |
usernames are redirected to an anonymous account. This server will |
100 |
|
also block access from any 10.1.1.x IP and from anyone who's domain name |
101 |
|
ends with edu. (details have been omitted to save space). |
102 |
|
</para> |
103 |
|
<para> |
104 |
|
Example: |
105 |
</para> |
</para> |
106 |
<verbatim> |
<verbatim> |
|
|
|
107 |
[section] main |
[section] main |
108 |
|
|
109 |
group badusernames |
group badusernames |
113 |
|
|
114 |
[section] badusernames |
[section] badusernames |
115 |
|
|
116 |
|
ipacl A:* |
117 |
nameacl A:root |
nameacl A:root |
118 |
nameacl A:uucp |
nameacl A:uucp |
119 |
nameacl A:*nonftp |
nameacl A:*nonftp |
122 |
|
|
123 |
[section] badips |
[section] badips |
124 |
|
|
125 |
|
nameacl A:* |
126 |
ipacl A:10.1.1.* |
ipacl A:10.1.1.* |
127 |
ipacl A:(*.edu) |
ipacl A:(*.edu) |
128 |
|
|
129 |
|
authmethod disabled |
130 |
|
|
131 |
|
[section] realusers |
132 |
|
|
133 |
|
nameacl A:* |
134 |
|
ipacl A:* |
135 |
|
authmethod unix |
136 |
|
|
137 |
|
[seciton] anonymous |
138 |
|
|
139 |
|
nameacl A:* |
140 |
|
ipacl A:* |
141 |
|
authmethod anonymous |
142 |
</verbatim> |
</verbatim> |
143 |
|
<para> |
144 |
|
In this example, muddleftpd will try matching users to groups |
145 |
|
badusernames, badips, realusers and then anonymous, in that order. |
146 |
|
If the provided username matches any allowed usernames in badusernames, |
147 |
|
they get accepted into that group, and their login fails because the |
148 |
|
disabled authmethod fails them. Then, if the user's originating IP address |
149 |
|
matches the allowed IP addresses in badips, they also fail to login. |
150 |
|
If the user does not match the usernames/ips in badusernames and badips, |
151 |
|
then they move onto the realusers group. Their username and password |
152 |
|
are passed to the unix authenticator. If the given username exists on |
153 |
|
the machine, then the user is accepted into that group. If it does not, |
154 |
|
then they are passed to the anonymous group, which accepts any other |
155 |
|
username. |
156 |
|
</para> |
157 |
<section> |
<section> |
158 |
<heading> Single server configuration </heading> |
<heading> Single server configuration </heading> |
159 |
|
<para> |
160 |
|
In single server configurtations muddleftpd uses a 2 level |
161 |
|
configuration scheme. |
162 |
|
</para> |
163 |
|
<para> |
164 |
|
At the top level, is the <emph>main</emph> section. The main |
165 |
|
section contains the parameters for the server. These |
166 |
|
parameters are applied to all connections on that server. This |
167 |
|
section must also conatin serveral <strong>group</strong> |
168 |
|
commands. These specifiy what sections the server uses as group |
169 |
|
sections, and what order to use them. |
170 |
|
</para> |
171 |
|
<para> |
172 |
|
At the lower level are the group sections, as specified in the |
173 |
|
main section. These specify how users are authenticated, and |
174 |
|
what access they have if their login is successful. The |
175 |
|
parameters in each of these groups are only relevent in that |
176 |
|
particular group. |
177 |
|
</para> |
178 |
</section> |
</section> |
179 |
<section> |
<section> |
180 |
<heading> Virtual server configuration </heading> |
<heading> Virtual server configuration </heading> |