Glftpd
glftpd is a freely available ftp server which runs on unix & linux operating systems. It is also an advanced & multi featured and versatile ftp server. It stands for GreyLine File Transfer Protocol Daemon. It was named after the initial developer GreyLine. The first public release of glftpd dates back to the beginning 1998. glftpd is well known for its detailed user permissions, extensive scripting features and for securely and efficiently transferring files between other sites using FXP.
It has number of features, like logins restricted by a particular set of IP addresses, transfer quotas per-user and per-group basis, and user/groups not stored in the system files. A number of web development books recommend it among other general purpose FTP servers, and some Linux certification exams of SAIR required knowledge of it.
Note that you should always read the official docs and have some unix/linux knowledge prior to start the installation. It does not matter how easy the HOWTO will make things because even if you copy and past everything here and you manage to get glftpd working; you will need to understand how things work to setup your own settings in glftpd.conf
It is strongly recommended that you do not use any sort of package unix/linux management (apt-get, emerge, yum, pacman, etc) to install glftpd. While there is technically nothing wrong about doing the install that way you will however be limited in the usage of glftpd regarding its secure versatility and custom management that will be preset by default by your package manager which in some cases (if not all) you can´t really modify to secure at your own preferences. I also advise to create a unique and restricted user to run ONLY glftpd and that you do a chroot jail install under that user. However creating a user is purely optional and not required.
General Notes
*** <--- means my comments $ <--- means unix normal user without root rights # <--- means root (admin) rights // <--- commented lines on configuration files which will be ignore by the system
Lines with nothing behind mean glftpd valid install settings
Installation
If you decide to create a specific user for glftpd do it now. You must be root to create users and while this is optional and not required it fits the purpose of securing glftpd shell even more! You can skip this step if you want if not; you must be root to create a user. See bellow how.
Create a shell user
adduser
If you created the new user enter his new directory; if not; just ignore this part.
cd /path/<username>
Download glftpd
Download glftpd binary install package from here or the mirror.
wget https://glftpd.io/files/glftpd-LNX-2.09_1.1.0j_x64.tgz
- Extract the archive: example :(tar -zxvf glftp-XXX.x.xx.tgz )
tar -zxvf glftpd-LNX-*
Enter in the extracted glftpd directory:
cd glftpd-*
Install the application and you must be root to install glftpd ( ~ # )!
ROOT means ADMIN. You must have 'administrator rights' At this point if you are not root ( # ) you must gain access. Type ¨su¨ or ¨sudo -i¨ to get root rights!
su Password:********
Install
Execute the install script
./installgl.sh
### # ##### ##### #### #### ###
# # # # # # # # # # #
# # ### # # # # # #
# ## # # # #### # # #
# # # # # # # # #
### ##### # # # #### #####
--== WE MAKE FILES TRANSFER ==--
-----------------------------------------------------------
GLFTPD INSTALLER (linux)n
Originally done by jehsom and dn.
Made ready for the new era by turranius and psxc.
-----------------------------------------------------------
Before we begin: If this installer fails on your system, please let the developers know.
You find us on irc (efnet) in #glftpd. Thank you. Also, any bugs found in glftpd itself should
be reported either to the board at https://glftpd.io, in the irc channel, or both.
Press <enter> to continue.
Tcpd setup
1. TCPD SETUP: -------------- Do you wish to use tcpd? If you are not sure then you should not use it. If you decided to change this at a later time, please search for tcpd in glftpd.docs for the required changes. Use tcpd? [Y]es [N]o:
If you don't know what tcpd is; check TCP_Wrapper. If you choose YES and you don't have tcpd installed you will get the following:
It seems you don't have tcpd installed, install it and try again, or select not to use it next time. Aborting.
Go back to ./installgl.sh and ff you choose NO:
Use tcpd? [Y]es [N]o: Installing glftpd without tcpd.
Jail Setup
2. JAIL SETUP: -------------- Do you want to run glftpd in a "Jailed" environment? In this environment a private directory will be created and glftpd will be installed inside. Regular shell users will not be able to get inside this private directory. The glftpd.conf is also moved inside for added security and a new group will be created so you and other users you specify can access glftpd through the shell. Use a jailed environment? [Y]es [N]o: yes
It is recommended that you use JAIL !!! This is help secure your server. Say yes and check http://en.wikipedia.org/wiki/FreeBSD_jail
Creating the jailed environment. Please enter the private directory to install glftpd inside [/jail]: /home/ftpd
If you get the following output:
Please enter the private directory to install glftpd inside [/jail]: /home/ftpd Path already exists. [D]elete it, [A]bort, [T]ry again, [I]gnore?
If you get this output: Path already exists. [D]elete it, [A]bort, [T]ry again, [I]gnore? Ignore it or Delete to continue. If you abort; then go back to ./installgl.sh and restart the install. Ignore will continue. Delete will re-create it
Do you want to create a private group? If you say no then only root will be able to access glftpd. Otherwise you can add other shell users to the group so they can access glftpd from the shell. Use a private group? [Y]es [No]: y
The use of a private group will be of your choice. The more people have access to glftpd box shell group the less secure it will be. Setting to yes will output the following:
What would you like your private group to be called? [glftpd]:
Press enter for default choice or use your own and if you get:
Warning: Group already exists with the following users: peter, roy, kyle What would you like to do: [D]elete it, [A]bort, [T]ry again, [I]gnore?
Choose according to your liking.
Creating private group . . . Done. ( or ) Setting Permissions on /ftpd . . . Done.
If the group did not exist and or had no users before you will be asked the following:
Who should have access to glftpd? (separate with ,):
Choose which users that have shell access to the box where glftpd runs; to have access and be added to glftpd users group. I added user peter and tester. Peter had a shell account in that box and tester did not.
Warning: user tester does not exist. Adding anyway. Setting permissions on /home/ftpd . . . Done.
Glftpd base Setup
3. GLFTPD BASE SETUP: --------------------- Please enter the directory inside /home/ftpd to install glftpd to [/glftpd]:
You can choose any name you want. Just press enter if you want /glftpd. The private directory must start with a “/”
Copying glftpd files to /ftpd/glftpd . . . Done. Copying required binaries to /ftpd/glftpd/bin: All binaries successfully copied. Making glftpd's /dev/null , /dev/zero & /dev/urandom . . . Done.
Multi install setup
4. SERVICE SETUP & MULTI-INSTALL: ---------------------------------
THIS IS OPTIONAL. IF YOU ARE INEXPERIENCED JUST PRESS ENTER TO SKIP THIS
Enter a service name for glftpd. This name will be used as the service name mapped to the port in /etc/services, the name used in your (x)inetd settings, and the name of your config-file. NOTE: If you (wish to) have multiple instances of glftpd on the same box, you *must* to change this. Press <enter> for the default (ftpd)>
If you want to choose your service name other than the default one. You will get the following output
You did not choose the default service name for glftpd. If you plan on having more than one instance of glftpd, you should change the ipc_key. The ipc_key can be anything you want, but it must be unique. To make things easy in this installer, you will be provided with 10 choices. 1: 0x0000BABE 2: 0xDEADBABE 3: 0x00C0FFEE 4: 0x12345678 5: 0x87654321 6: 0xBEEFBABE 7: 0xBADCOFEE 8: 0x0000BEEF 9: 0xDEADBEEF 0: 0x0000DEAD (default)
This setting also demands to be specified in glftpd.conf. Check the docs or glftpd.conf example for this setting. You may choose any of these keys or quit the install and restart ./install.sh
Once you get to ¨4. SERVICE SETUP & MULTI-INSTALL ¨ choose the default option and press enter or if you choose to use a ipc_key because you might want to run other glftpd server in the same box later on you can go with choice ¨0¨ (default)
This setting is optional !!If the service already existed replace it. (y). If it did not exist you will be sent to step 5.
The service "glftpd" already exists in /etc/services. Replace it? (y/n)> y
Compiling sources
5. COMPILING SOURCES & COPYING LIBS: ------------------------------------ modifying source (bin/sources/glconf.h) ... OK. Compiling source files in /ftpd/glftpd/bin/sources to /ftpd/glftpd/bin: ...... All source files successfully compiled. Copying required shared library files: ...... Copying your system's run-time library linker(s): (NOTE: Searches can take a couple of minutes, please be patient.) ...... Configuring the shared library cache . . . Done.
Port and system setup
6. PORT AND SYSTEM SETUP: ------------------------- Enter the port you would like glftpd to listen on [1337]: You can just press enter to accept this port or simply choose your own port. Lets change it to 2121 NOTE: Do not initially put your ftpd on port 21...stick it on a really high port so you know it works You will also have to add this port number to /etc/services or your /etc/xinetd.d/glftpd> Setting userfile permissions . . . Done. Setting groupfile permissions . . . Done. Adding glftpd service to /etc/services (as glftpd) . . . Done. Copying glftpd.conf to /ftpd/glftpd.conf . . . Done. Do you want to use Inetd or [X]inetd
The choice is yours. Lets go with with Xinetd. It offers a more secure extension in regards to [inetd]].
Do you wish to use European weeks? European weeks starts with a Monday. This is for glftpd's 'reset' binary (see docs for more info) [Y/N]:
Choose according to your liking.
Fixing (potential) localtime problems ... Creating /ftpd/glftpd/etc/localtime Creating /ftpd/glftpd/usr/lib/zoneinfo Creating /ftpd/glftpd/usr/share/zoneinfo Done.
SSL/TLS setup
7. SSL/TLS SETUP: ----------------- We will now create a certificate for SSL/TLS support. This step is required. Please specify location, inside /home/ftpd/glftpd to install the cert (ftpd-dsa.pem) [/etc]:
Leave it like this to have the ssl certificates inside glftpd root install If you wish glftpd to use common ssl certificates also used for other applications you can specify other ssl certificates in glftpd.conf
Please specify a generic name for this certificate. This can be any name but should say something about the ftp server like the name for it perhaps (press enter for glftpd):
Lets use the name that you used for the server
Using servbase: glftpd Using openssl: /usr/bin/openssl Please wait while creating certificate... (will take time!) 1024 semi-random bytes loaded Generating DSA parameters, 1024 bit long prime This could take some time ..+.+......+......+....+.+.+...+..+..........+.......+....+.. ..+.+.....+....+.......+..................+.............+.... 1024 semi-random bytes loaded Generating DH parameters, 1024 bit long safe prime, generator 2 This is going to take a long time 1024 semi-random bytes loaded Generating DH parameters, 1024 bit long safe prime, generator 2 This is going to take a long time .....................................+.......................+ .....................................+.......................+ .....................................+.......................+ Generating DSA key, 1024 bits Moving ftpd-dsa.pem to /ftpd/glftpd/etc . . . Done
IMPORTANT !!!! → If you get TLS errors of any kind, read instructions in README.TLS → included in this package!
Starting glftpd
8. STARTING GLFTPD: ------------------- Copying /etc/resolv.conf to /ftpd/glftpd/etc/resolv.conf . . . Done. Testing entries in resolv.conf (can take time): Testing 192.168.2.1 . . . OK. Configuring xinetd for glftpd . . . Done. Restarting xinetd . . . Success. If your system is using RH 7.3, you MUST restart xinetd MANUALLY! Adding crontab entry to tabulate site stats nightly . . . Done. chmod'ing the site/ dir . . . Done.
Finishing
9. FINISH: ---------- Congratulations, glftpd has been installed. Scroll up and note any errors that needs fixing. ./installgl.debug contains a log of the installation process. To get your site running, you must edit /jail/glftpd.conf according to the instructions in /server/setup/docs/glftpd.docs. For help, visit #glftpd on EFnet AFTER you've read (not skimmed) the docs/faq. After configuring glftpd, visit the following websites for additional scripts to give your site some style!: Turranius - http://www.grandis.nu/glftpd Jehsoms - http://runslinux.net/ dn's and ip's - http://www.chimera-coding.com D-ViBE's collection - http://www.glftpd.at The official glftpd homepage is located at https://glftpd.io Thanks for your support! the glFtpD team
Configuration files
This is an advanced configuration:
# https://www.glftpd.eu/files/docs/glftpd.docs
#
# ,----------------------------------------------------------------------------.
# | II. Glftpd.conf |
# `----------------------------------------------------------------------------'
#
#,------------.
#| A. Settings |
#`------------'
#
# All the setting names are case-insensitive, and can be placed anywhere in the file, as long as the order for same-named
# settings is maintained for those where it matters. Paths and filenames are of course case-sensitive.
#
# The arguments for the settings follow this format:
# - if between <>, then it is mandatory
# - if between [], then it is optional
# - ... after an argument means it can be used again
# - if |, then one can choose between the left and right value
# - a -, +, !, *, {, } or digit are literally those symbols
# - #: any integral number, can have restrictions
# - X and Y: two different numbers or symbols
# - string: any non-zero sequence of symbols excluding space
# - stringlist: multiple strings divided by spaces
# - path: an absolute path
# - pathmask: an absolute path with masking symbols
# - dir: a directoryname, has no '/'
# - dirmask: a dir with masking symbols
# - file: a filename
# - filemask: a file with masking symbols
# - filepath: an absolute path to a file
# - filepathmask: a filepath with masking symbols
# - IP: an IP address
# - IPmask: an IP address with masking symbols
# - hostname: a string resolvable to an IP address
# - hostmask: a hostname with masking symbols
# - user: a username
# - flag: a flag a user can have
# - group: a groupname
# - permission: flag|-user|=group|*
#
# SPECIAL SYMBOLS:
# ----------------
# * If you want to use a space in an argument, you need to use [:space:]
# instead. Glftpd will convert it to ' '.
#
# * When glftpd sees the character #, it will replace it with null (meaning everything that follows it will be disregarded).
# All comments should be done this way.
#
# * To represent the # character, use [:hash:].
#
# * For the settings where a mask is used, the following can be used:
# - ?: to match a single symbol
# - *: to match zero or more symbols
# - [X-Y]: to match a single symbol within the given range
#
#
# SETTING SETTINGS:
# -----------------
#ifip IPmask [IPmask ...]
#elseip
#endifip
# Settings in glftpd.conf can be conditional - depending on the IP mask of the user connecting. The "ifip" setting takes one or more IP masks.
# If the connecting IP matches one of those masks, settings that follow (on lines below) will be used, until "elseip" or "endifip" is
# encountered. If the IP does not match any of the masks, settings that follow it will be ignored. If "elseip" is encountered, settings that
# follow it will be used instead.
#
# Nesting in the elseip part is ok, but it's not recommended to nest in
# the if part, it might screw up.
#
# Examples: this was mainly created for the pasv_addr setting, so that users connecting locally could have a different pasv_addr than those
# connecting from the Internet, but it can be used with all settings:
#
# ifip 192.168.* 10.*
# pasv_addr 10.10.10.1
# sitename_long MyLanSite
# elseip
# ifip 127.0.0.1
# include /glftpd/etc/myspeciallocalsettings.conf
# elseip
# pasv_addr 128.1.2.3 1
# sitename_long MyInternetSite
# endifip
# endifip
#
# include <filepath>
# You can use "include" to split the main config file into several pieces, kind of like it's done in C (but without the # in front).
# Just add a line "include /path/to/config.file" to glftpd.conf.
#
#
# TLS SETTINGS:
# -------------
allowed_protocols TLSv1.2
# Put here the TLS protocols that are allowed to be used by clients. Possible options are TLSv1, TLSv1.1 and/or TLSv1.2.
# By default only TLSv1.2 is allowed.
cert_file /.../glftpd/nfoarchive/etc/sslcerts/glftpd-rsa.pem
# The path to your certificate to be used for TLS mode. This can be a certificate generated by RSA, DSA (unusable when DSS is disabled in
# the ciphers_* settings below) or ECDSA (recommended). Default location used is "/glftpd/ftpd.pem".
ciphers_for_ctrl ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384
# Here you can define which ciphers glftpd can use (and not use) and the order of preference to encrypt the control channel with a client. These
# can be explicit names like "ECDHE-ECDSA-AES256-GCM-SHA384" or groups like "HIGH+EDH". See "openssl ciphers -v" for explicit names.
# See the "cipher list format" and "cipher strings" sections in openssl's manual ("man ciphers") for usable ciphers and groups and format to use.
# Default used is "HIGH+EECDH:HIGH+EDH:!aNULL:!MD5:!DSS".
ciphers_for_data ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384
# Here you can define which ciphers glftpd can use (and not use) and the order of preference to encrypt transfers over the data channel with a
# client. See "ciphers_for_ctrl" for usage and default.
ciphers_for_dir ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384
# Here you can define which ciphers glftpd can use (and not use) and the order of preference to encrypt dirlistings over the data channel with a
# client. See "ciphers_for_ctrl" for usage and default.
dhparam_file /.../glftpd/nfoarchive/etc/sslcerts/glftpd_dhparam.pem
# If you want to use your own DH parameters, you can provide these here.
##dsa_cert_file /.../glftpd/nfoarchive/etc/ftpd-dsa.pem
# Same as "cert_file" but kept for backwards compatibility. Used if no "rsa_cert_file" and "cert_file" settings exist.
#
ecdhe_curves secp521r1:secp384r1:secp256k1
# You can specify other ECDHE curves in order of fallback than the default used "P-521:P-384:P-256" or equivalent "secp521r1:secp384r1:secp256k1",
# in case your openssl lib does not provide it or you want to use a faster (but possibly less secure) curve.
# See "openssl ecparam -list_curves" for usable curves.
rsa_cert_file /.../glftpd/nfoarchive/etc/sslcerts/glftpd-rsa.pem
# Same as "cert_file" but kept for backwards compatibility. Used if no "cert_file" setting exists.
tls_ftps 0
# Setting this to 1 enables FTPS mode which uses TLS from the start of the connection, except for connections coming from a bouncer which must run
# the IDNT command first. This should not be used for a regular ftp server. Default 0.
#
tls_ops SSL_OP_NO_COMPRESSION
# The options that you set here are used to change the protocol behaviour of the SSL library. See "man SSL_CTX_set_options" and the openssl/ssl.h
# header file located on your system for the options that you can use. In the header file, the options all start with SSL_OP_.
#
# Do not use the MACRO names as argument, but the hexnumbers found in the header file, OR'd together. See the default as example.
#
# Default used is SSL_OP_NO_COMPRESSION | SSL_OP_SINGLE_DH_USE | SSL_OP_SINGLE_ECDH_USE | SSL_OP_CIPHER_SERVER_PREFERENCE, which is
# 0x00020000L | 0x00100000L | 0x00080000L | 0x00400000L which can be used as argument, and which is 0x005A0000L and can be used as argument too
#
# The SSL_OP_NO_SSL* options are always added to this variable so don't need to be added here, and the SSL_OP_NO_TLS* options are controlled
# through the allowed_protocols setting.
#
#
# SECURITY SETTINGS:
# ------------------
banned_users root admin master god bush trump obama
# List of usernames that can't be used for new users.
#
# If present, file "/rootpath/datapath/help/site.adduser.banned" will be displayed when someone attempts to add such a user.
#
# Example: banned_users root billgates. The usernames "root" and "billgates" will be denied to be used.
denydatauncrypted *
# You can deny unencrypted transfers for certain users/groups/flags or deny for everyone and only allow certain users/groups/flags.
#
# Example: denydatauncrypted !-idiot !=IDIOTS *
# Only user idiot and group IDIOTS can transfer files unencrypted.
denydiruncrypted *
# Same as denydatauncrypted but for dirlistings over the data channel.
noretrieve xfile.txt
# Specifies files that cannot be downloaded.
# Password files and other sensitive files should be listed here.
#
# Multiple lines allowed, each max 50 filenames.
path-filter =uploads /ftp-data/misc/pathmsg ^[-A-Za-z0-9_.[:space:]]*$ ^\. ^- ^( ^)
# Sets rules for which directory and filenames are allowed and which are denied and for which groups these rules apply. The default is to allow
# anything for anyone, but this is a security risk and not recommended. The filters are applied both on creation and renaming.
#
# The second argument should point to a file that will be displayed when a file or dir isn't allowed. Use a non-existent file to display nothing.
# When a second argument is specified, a third is mandatory. This string is a filter which only allows the files matching it. The fourth and
# following arguments are filters that deny files matching them.
#
# The filters are regular expressions - see 'man re_format' to learn more about these rules. Max 47 denyfilters are allowed.
#
# You can use multiple path-filter lines. The first group match wins, so the line with * in the group field should always be last.
#
# Example: path-filter * none ^[-A-Za-z0-9_.()[:space:]]*$ ^\. ^-. This allows only filenames made up of the symbols A-Z, a-z, 0-9, "._-()"
# and spaces, and they may not start with "." or "-". No message is shown, unless if a file $ROOTPATH/none would exist.
#
# Example: path-filter * none ^[][[:alnum:]_.'()[:space:]-]*$ ^\. ^-
# This is the same as above, except now "[" and "]" are allowed too.
#
# Example: path-filter MUSiC /ftp-data/misc/pathmsg ^.*\.[Mm][Pp]3$
# This will allow the MUSiC group to only create and rename to files and directories ending in ".MP3", ".Mp3" or ".mp3".
secure_ip 0 1 0 *
# secure_ip <0|1|2|3|4> <#> <0|1> <0|1> [!]<permission> [[!]permission .. .]
# Glftpd will not allow an IP, IPmask or hostname to be added that doesn't pass these rules. By default no rules are applied.
#
# The first argument specifies the minimum number of fully numeric fields that need to be in the IP address.
# The second argument specifies the minimum number of bits a CIDR IPmask must have. This ranges from 0 to 32.
# The third argument, if set to 1, allows hostnames. The fourth argument, if set to 1, will require a valid ident for the IP.
#
# You can have several secure_ip entries; glftpd will go through all of them. If a match for the user adding the IP is found in the flags,
# users and groups on the right, and the security settings allow the IP, the search will stop. Otherwise, glftpd will continue until either
# another rule allows the IP or there are no more rules. In the second case, if there were any rules that matched the user but denied the IP,
# the IP will be denied, otherwise it will be allowed.
#
# Example: secure_ip 2 16 1 0 =STAFF 1
# This will allow STAFF and siteops to add numeric IP's with 2 or more fully numeric fields, 16 or more CIDR bits and let them add hostnames,
# as in a@b.com. A valid ident will not be required.
#
# Example: secure_ip 3 24 0 1 *
# This will allow everyone else to add IP's with 3 or more fully-numeric fields or equivalent 24 or more CIDR bits and it will not allow anyone
# to add hostnames. A valid ident will be required.
#
# secure_pass aA1..... =staff
# secure_pass <string> [!]<permission> [[!]permission ...]
# Glftpd will not allow passwords that do not follow these rules. By default no rules are applied.
#
# The string's length sets the minimum password length. You can also specify the minimum number of capital and lowercase letters, digits and
# "other symbols".
#
# The '.' is a placeholder to "fill in" to the minimum length you want.
#
# You can use any (capital) letter, digit, or "other symbol" (except '.') in the mask.
#
# You can have several secure_pass entries; glftpd will go through all of them. If a match for the user changing the pass is found in the flags,
# users and groups on the right, and the security settings allow the pass, the search will stop. Otherwise, glftpd will continue until either
# another rule allows the pass or there are no more rules. In the second case, if there were any rules that matched the user but denied the pass,
# the pass will be denied, otherwise it will be allowed.
#
# Example: secure_pass Ab1... *
# This will only allow passwords 6 characters or longer that contain at least one capital letter, one lowercase letter and one digit.
# Everyone who changes a password (through either "site passwd" or "site chpass" will have to stick to this mask.
#
# Example: secure_pass ZZf3$. !1 !=STAFF *
# This will force everyone but siteops and members of STAFF to have passwords at least 6 characters long, with at least 2 capital letters,
# one lowercase letter, one digit, and one "other symbol".
userrejectinsecure *
# This forces TLS mode for certain users or for everyone except some. You cannot use =group or flag as the userfile isn't loaded yet.
#
# Example: userrejectinsecure !-hoe * Only user hoe is not forced to use TLS mode.
userrejectsecure !*
# This denies TLS mode for certain users or for all users except some. You cannot use =group or flag as the userfile isn't loaded yet.
#
# Example: userrejectsecure -lamer !*. Only user lamer is denied to use TLS mode.
#
#
#PRIVACY SETTINGS:
# -----------------
hidden_files /site .*
# Specifies masks for files, directories, links, etc that will be skipped during directory listing below the given path, even if the -a or -A
# switch is used to show standard hidden files (starting with ".").
#
# Multiple lines are allowed, even with same paths; each line can have max 49 filemasks.
#
# Example: hidden_files / .message hidden.*
#
##hide_user_or_group <#|"no"> <#|"no"> <path> [path ...]
# This will make glftpd show fake username and/or groupname for directories and files, instead of the real username and/or groupname, when a user does a "LIST".
#
# The first argument is for the UID, the second for the GID.
#
# The third argument should be the path for which this option will work. You may specify several paths. No wildcards. You don't even need full
# paths, instead of /site you can use /si and it will work for /site as well as every other directory starting with /si, and every subdirectory
# of that directory.
#
# Example: hide_user_or_group 0 1000 /site/archive/remote/
# This will show the username belonging to UID 0 and groupname belonging to GID 1000 for all directories and files in "/site/archive/remote/".
#
# Example: hide_user_or_group 2300 no /site/archive /site/remote. This will show the username belonging to UID 2300 and the original
# groupname for every directory that begins with "/site/archive" or "/site/remote", like /site/archive/whatever, /site/remote1, etc.
hideuser -admin
# Allows you to hide users from being displayed in site who, added to the last-users-online file, or listed with "site users".
#
# Example: hideuser -Usurper =HIDDENGROUP 1 7 =LEECH
# This will hide all users with siteop or useredit flags, all members of HIDDENGROUP or LEECH and user Usurper.
#
# Note: this setting does not affect siteops - they can see all.
#
# If you want to hide users from stat commands, you need to chown their userfiles to 99:99.
privgroup staff Administrators
privgroup guest Guest
privgroup upload Uploader
# Here you define a private group and an optional description.
#
# Example: privgroup STAFF Siteops[:space:]And[:space:]Such
privpath /site =staff =guest
privpath /site/incoming =staff =upload
# privpath <path> [!]<permission> [[!]permission ...]
# Here it is specified who gets access to certain directories. Users that do not match the permissions will not see the directory.
# First path-match stops the search, so deepest path first. Special variables "[:username:]" and "[:groupname:]" replace current
# user's username and primary groupname, respectively.
#
# Note: no wildcards allowed in the path, this would slow down directory listings too much.
#
#
# LOCATION SETTINGS:
#------------------
datapath /ftp-data
# The path where you keep all data-files, relative to your rootpath. The default used is "/ftp-data".
#
# If your rootpath is "/", this would be "/glftpd/ftp-data".
grp_path /etc/group
# The path where you want glftpd's group file stored, relative to your rootpath. The default is "/etc/group".
#
# If your rootpath is "/", this would be "/glftpd/etc/group", otherwise you would be using the system's group file which is incompatible.
min_homedir /site
# You need this set to allow siteops to change users' home directories with "site change". Path should be relative to rootpath.
#
# Example: min_homedir /site
# This will allow homedir to be inside the /site dir but not outside.
#
# Note: This setting has nothing to do with the actual users' homedirs, it is a simple security setting to stop siteops from allowing people to
# start in protected directories. To change actual homedirs, either edit /glftpd/etc/passwd for existing users, or modify the HOMEDIR line in
# /glftpd/ftp-data/users/default.* for new users.
pwd_path /etc/passwd
# The path where you want glftpd's passwd file stored, relative to your rootpath. The default is "/etc/passwd".
#
# If your rootpath is "/", this would be "/glftpd/etc/passwd", otherwise you would be using the system's passwd file which is incompatible.
reload_config /.../glftpd/nfoarchive
# The config file used when we receive a SIGHUP signal.
#
# Glftpd will reload the config file when it receives the SIGHUP signal. This will only happen if there is a reload_config line in the config
# file. The path specified is relative to the rootpath and to make this work the file must be within the rootpath.
#
# Note: when a bad config path is specified and glftpd gets a SIGHUP signal, all users will be logged out with an error telling it's
# impossible to read the config file.
rootpath /.../glftpd/nfoarchive
# The path where all your system directories reside. (bin, etc, lib...)
#
# Glftpd will chroot to this directory when a user connects, meaning nothing above this directory can be accessed through ftp. If no path
# is specified, glftpd will assume /glftpd as its rootpath.
#
#
# SCRIPT SETTINGS:
# ----------------
# The following environment variables can be used by external scripts:
# $USER Username.
# $FLAGS User's flags.
# $TAGLINE User's tagline.
# $GROUP User's primary group.
# $RATIO User's main ratio.
# $PGROUP User's first private group.
# $SPEED Speed in KiB/s, updated after every upload/download.
# $HOST User's ident@ip.
# $HOME User's home directory (from /glftpd/etc/passwd).
# $SECTION The name of the section user is currently in.
#
##botscript_path <filepath>
# The path to your bot script, default "/bin/botscript".
#
# The botscript will be executed after a directory is created, deleted, nuked or unnuked.
# You can use it to signal your bot to 'announce' those events.
#
##cscript <string> <"pre"|"post"> <filepath>
# CScript is short for Custom Script. This is a custom script (or binary) to be executed before or after any command. Multiple lines allowed,
# but every command can only have one "pre" and one "post".
#
# The first argument is the name of the command, the second if this is before ("pre") or after ("post") the command execution and the third
# is the script or binary to execute.
#
# If using a command with a space in it, like a site command, you need to use "[:space:]" between the words, e.g. site[:space:]who.
#
# CScripts for "pre" mode are run without checking the permissions of the command they are executed before.
#
# CScripts run in "post" mode won't be able to echo anything to the client because they are executed after glftpd sends the response to the client;
# output to a logfile is however still possible.
#
# If a CScript in "pre" mode exits with anything bigger than 0 (or if it can't be executed), then the command which should run after the CScript
# will NOT be executed, neither the command's "post" CScript.
#
# Some "post" scripts will not be executed when the command they follow fails (for example, if you try to add a user, but have no access to the
# 'site adduser' command).
# A list of commands that behave this way:
# APPE, CDUP, CPSV, CWD, DELE, MKD, MODE, PASV, RETR, RMD, RNFR, RNTO, SSCN, STOR, STOU, STRU, TYPE, XCUP, XCWD, XMKD, XRMD.
# and SITE commands:
# ADDUSER, CHANGE, DELUSER, GADDUSER, GRPADD, GRPCHANGE, GRPDEL, GRPREN, KICK, KILL, NUKE, ONEL, READD, RENUSER, REQFILLED, REQUEST, UNNUKE, WIPE.
# This list might grow in the future upon funded request.
#
# It is YOUR responsibility to send the correct MESSAGE CODE with every line sent to the client; if a wrong code is used, ftp clients may
# 'hang'. To find out what code you need to use, just look at what glftpd uses when that command is executed.
# Example: if you run a script before "site who", and you want to print something from it, use: printf "200Your message here\r".
#
# If you exit a pre script with 1 in order to prevent the user from executing the command, you might want to use a generic error code with
# your sent lines, like 500, which will tell the clients that this command was denied - or use the error code that glftpd uses when denying
# execution of this command.
#
# Both kind of scripts will be passed 3 parameters:
# $1 = full command string the user used.
# $2 = user's login name.
# $3 = user's primary non-private group.
#
# Example: cscript site[:space:]who pre /bin/sitewhoprescript.sh
# cscript retr post /bin/postdownloadscript.sh
max_sitecmd_lines 30
# Specifies the maximum number of output lines from a custom site command that are shown to users. Default is 9999.
post_check /bin/zipscript /site/incoming
# Also called zipscript, this executes the first argument, which is relative to the rootpath, AFTER an upload finishes.
# See example /glftpd/bin/zipscript.
#
# See "pre_check" for pathmask info and echoing.
#
# Example:
# post_check none /site/public/* # disables zipscript in /site/public
# post_check /bin/special.sh /site/special/* # special zipscript
# post_check /bin/zipscript # normal zipscript for all other paths
#
# If you want to enable upload resume in a certain path, you should disable the zipscript for that path, so that partial files are not
# deleted when the uploader loses connection.
#
# The post_check script receives 3 parameters from glftpd:
# $1 - the name of the uploaded file
# $2 - the directory the file was uploaded to
# $3 - the CRC code of the file (with calc_crc enabled, else 00000000)
# Note: if the uploader times out, the CRC code is 00000000 as well, this to prevent that if one reconnected and started uploading the
# same file again but left a stalled upload session alive, a bad crc would be passed and the file would be deleted.
#
# Exit with 1 or 127 to indicate a problem with the execution of the script, exit with anything else besides 0 to have the file deleted.
# The user's credits and stats will not be added and the file will be removed from the dupe database.
# Exit with a number between 10 and 1010 to have glftpd "sleep" that many seconds minus 10 before continuing. This might be helpful to prevent
# users uploading a bad file over and over until it is complete on source.
# Example: a user waits 10 seconds after a bad file upload with "exit 20".
# Note: exit code 127 is exempted; it will NOT cause a delay and is treated like exit code 1 instead.
pre_check /bin/dupescript /site/incoming
# Also called dupescript, this executes the first argument, which is relative to the rootpath, BEFORE an upload begins.
# See example /glftpd/bin/dupescript.
#
# Multiple lines can be used, first pathmask match stops the search. No pathmask present is the same as *. If you want to have multiple scripts
# executed in the same path, you must use a wrapper.
#
# The pre_check script receives 2 parameters from glftpd:
# $1 - the name of the file to be uploaded
# $2 - the directory the file will be uploaded to
#
# You should only echo normal text if the exit code that follows it will be > 0 (meaning the file upload will be rejected). If you want to echo
# something and then exit with 0, you have to put "#0" at the beginning of the echo string. Example: echo "#0File will be accepted!".
#
# Exit with 1 or 127 to indicate a problem with the execution of the script, exit with anything else besides 0 to deny the upload.
#
##pre_del_check <filepath> [pathmask]
# Also called delscript, this executes the first argument, which is relative to the rootpath, BEFORE a directory or file is deleted.
# See example /glftpd/bin/delscript.
#
# See "pre_check" for pathmask info, parameters, echoing and exitcodes.
pre_dir_check /bin/dirscript /site/incoming
# Also called dirscript, this executes the first argument, which is relative to the rootpath, BEFORE a directory is created.
# See example /glftpd/bin/dirscript.
#
# See "pre_check" for pathmask info, parameters, echoing and exitcodes.
site_cmd rules text /ftp-data/misc/site.rules
site_cmd rules exec /bin/locate.sh
custom-rules !8 *
#locate allows users to search priv dirs !!!!, do not use it
custom-locate 1
# site_cmd <string> <"exec"|"text"|"is"> <filepath> [string]
# custom-<string> [!]<permission> [[!]permission ...]
# New "site" commands are specified with this setting. The "custom" and "site_cmd" settings always need to be specified
# together, with "string" being the same. They however do not have to be specified on successive lines on the conf.
#
# The first argument will be the command after the "site ".
#
# The second argument can be:
# EXEC: execute the third argument (and optional fourth).
# TEXT: display the third argument, converting cookies to their values.
# IS: execute the third argument which is an internal command.
#
# Example: site_cmd upurge exec /bin/upurge.sh
# custom-upurge 1 =STAFF
# site_cmd rules text /ftp-data/misc/site.rules
# custom-rules *
# site_cmd picture text /ftp-data/misc/picture.asc
# site_cmd weektop is wkup
# custom-picture =STAFF -Usurper 1 7
# custom-weektop !8 *
#
# Be aware that commands defined in "is" mode are subject to 2 sets of restrictions: first, the custom-* setting, and then the permissions
# for the internal command.
# For "weektop" above in the example this would be "-stats".
#
# If using the "exec" mode, an optional argument can be used that will be passed to the program in front of any user arguments. To specify
# multiple arguments, use [:space:].
#
# Example: site_cmd TEST EXEC /bin/test.sh arg1[:space:]arg2
# custom-test *
# Now when someone issues "site test moo", test.sh will be executed with 3 arguments: test.sh arg1 arg2 moo.
#
#
# CONNECTION SETTINGS:
# --------------------
active_addr 0.0.0.0
# active_addr <IP|hostname> [#] [#] [IP|hostname] Tells glftpd which interface to bind to when doing active file
# transfers. Without this, glftpd uses the same interface the user connected to.
#
# If you have multiple active_addr lines, glftpd will cycle through them in a round-robin style each time the user transfers a file.
#
# The remaining arguments are used for loadbalancing.
#
# The second argument specifies the maximum download bandwith capacity allocated to this active_addr in KiB/s.
# The third argument does the same for upload.
# A 0 means that this is a fallback address that will only be used if the other active_addr's are fully loaded.
# The active_addr with the most remaining bandwidth will always be used in priority. If more than one active_addr is eligible, they will be
# cycled in a round-robin style.
#
# The fourth argument is used to specify which pasv_addr follows the same route as active_addr (needed for a precise computation of the speed,
# when passive mode is also used).
active_ports 65517-65534
# active_ports <X[-Y]> [X[-Y] ...]
# Causes glftpd to pick an open port between X and Y when making a active connection, instead of picking a random port.
#
# If Y isn't present, glftpd will just use X. If Y is present, glftpd will pick a random port between X and Y, including X and Y. If there are
# too many errors trying to pick a port from the current range, glftpd will move on to the next one.
#
# Maximum is 50 arguments. It makes most sense to use the biggest range as the first argument, since it'll be used more often.
#
# You should have at least 10 ports per user, so if you have 30 users
# online, this range should be 300, i.e. active_ports 13000-13300.
#
# This option together with pasv_ports will control which ports will be used on the server by glftpd.
#
##bouncer_ip <IP|hostname> [IP|hostname ...]
# If you have (an) ftp bouncer(s), you have to put their IP('s) here so glftpd knows when the connection is from a bouncer and when it's from a regular user.
#
# Example: bouncer_ip 1.2.3.4 bnc.dynamicip.net static.bouncer.com
pasv_addr 0.0.0.0
# Determines which IP or hostname is used for passive mode.
#
# If you want glftpd to bind to this interface (for example, if you use more than one NIC in the same box and you want passive connections to
# not use the default one), just do "pasv_addr x.x.x.x". If you want glftpd to only report this IP to the client but to bind to the default
# interface (as in when your box only has an internal IP and you're using NAT), do "pasv_addr x.x.x.x 1".
#
# If you have multiple pasv_addr lines, glftpd will cycle through them in a round-robin style each time a file is transferred using passive mode.
pasv_ports 65501-65516
# Causes glftpd to pick an open port between X and Y when making a passive connection, instead of picking a random port.
#
# If Y isn't present, glftpd will just use X. If Y is present, glftpd will pick a random port between X and Y, including X and Y. If there are
# too many errors trying to pick a port from the current range, glftpd will move on to the next one.
#
# Example: pasv_ports 10000-11000 20 21 22 23 80 110 1600-1610 35000-35050
#
# Maximum is 50 arguments. It makes most sense to use the biggest range as the first argument, since it'll be used more often.
#
# You should have at least 10 ports per user, so if you have 30 users online, this range should be 300, i.e. pasv_ports 2000-2300.
valid_ip 192.168.1.100
# If you have multiple IP's on your system, enter the ones you want glftpd to listen on. Only connections to the listed IP('s) will be allowed.
#
# Example: valid_ip 127.0.0.1
# This will only allow connections to localhost, and thus only connections from localhost will work.
#
#
# BANDWIDTH SETTINGS:
# -------------------
sim_xfers 15 -1
# sim_xfers [max_downloads] [max_uploads]
# Global setting controlling the maximum allowed simultaneous downloads (first argument) and uploads (second argument) on the whole site.
# A -1 means unlimited and is the default.
#
# Note: Users with the EXEMPT flag are not affected and can download even if this limit is reached.
#
# Example: sim_xfers 10 -1
# This only allows 10 downloads at a time. If a user tries to download something and there are already 10 other downloads in progress, the
# user will receive an error message.
speed_limit /site* 0 0 -admin
speed_limit /site* 500000 0 *
# speed_limit <pathmask> <#> <#> [[!]permission ...]
# Global bandwidth limit based on directory and permissions. The second argument is the download limit, third argument the upload
# limit. Both are in bytes/second, 0 means unlimited.
#
# If you have multiple speed_limit rules, first path and permission match decides which rule is active.
#
# Example: speed_limit /site/Incoming* 150000 0
# speed_limit /site/Archives* 50000 0 1
# speed_limit /* 200000 0 =group -user
#
# This means that in all dirs matching "/site/Incoming*" (so also "/site/Incomingfiles/") the global downloadlimit is 150KB/s and no
# uploadlimit, in all dirs matching "/site/Archives*" the global downloadlimit is 50KB/s for siteops only and no uploadlimit, in all
# other dirs there's a global downloadlimit of 200KB/s for user "user" and users of group "group". All other users and for all other paths
# have no speedlimits besides their own.
#
#
# RIGHTS SETTINGS:
# ----------------
#Function Pathmask Permission
#--------------------------------------------------------------------------------
rename /site/* -admin
filemove /site/* -admin
delete /site/* -admin
resume /site/* -admin
makedir /site/* -admin
upload /site/* -admin
filemove /site/* -admin
dirlog /site/* =guest =staff
download /site/* =guest =staff
nuke /site/incoming/* =uploads =staff
renameown /site/incoming/* =uploads =staff
deleteown /site/incoming/* =uploads =staff
resume /site/incoming/* =uploads =staff
makedir /site/incoming/* =uploads =staff
upload /site/incoming/* =uploads =staff
filemove /site/incoming/* =uploads =staff
#--------------------------------------------------------------------------------
#
# These are examples only and do not reflect the tree you need to use. See the file glftpd.conf-EXAMPLES for more examples.
#
# The functions are read from top to bottom. The first directory match will stop the search, so you should put the more specific directories on
# top and the least specific ones on the bottom.
#
# Special variables:
# If the paths in the settings contain "[:username:]" or "[:groupname:]", glftpd will replace them with the current user's username or primary
# groupname, respectively.
#
# Example: upload /home/[:username:]/* *
# This will only allow joe to upload in /home/joe.
#
#
# NUKE SETTINGS:
# --------------
empty_nuke 25000
# The amount of KiB that will be removed from the user if its "empty" directory is nuked. See the "nukedir_style" setting for when a directory is considered empty.
multiplier_max 20
# The highest multiplier a nuker can use, default is "unlimited".
nukedir_style NUKED-%N 2 50000
# nukedir_style [string] [0|1|2] [#]
# Settings for the 'site nuke' command.
#
# The default is: nukedir_style %N 2 50000
#
# The first argument specifies what the nuked dir will be renamed to.
# Possible vars are:
# %N = original dirname
# %% = %
#
# The second argument specifies what should be done with the files and
# directory:
# 0 = delete all nuked directories
# 1 = delete files, keep directories
# 2 = keep files and directories
# If you want to be able to unnuke, you must set this to 2.
#
# If the size in bytes of all files in the nuked directory is below the third argument, the directory will be treated as empty and nuked with
# the empty dir penalty, see the "empty_nuke" setting.
#
# Note: "empty" dirs are always deleted, no matter what your second argument's value is.
nukesubdir_style by[:space:]%U[:space:]-[:space:]%M"
# Specifies the style of the directory created within a nuked directory. The string set here is always prepended by "NUKED %dx " upon a nuke, with %d being the multiplier.
# The usable vars are:
# %U = nuker's username
# %M = the nuke reason
# %% = %
# Default is "by[:space:]%U[:space:]-[:space:]%M".
#
#
# APPEARANCE SETTINGS:
# --------------------
banner /ftp-data/misc/banner
# Displayed before the prompt for username.
color_mode 0
# This option determines whether colors are present in directory listings when a user has the color flag.
#
# Use "color_mode 0" to prevent glftpd from using color codes in directory listings. The control connection (the dialog between client and server)
# will show colors when the user has the color flag turned on.
#
# Use "color_mode 1" to make glftpd act like before, using colors both in the control connection and directory listing. This is the default.
dir_names 0 none [:space:].
# dir_names <0|1> ["lower"|"upper"|string] [XY ...]
# Which conversions to do on new and renamed directory names.
#
# The first argument makes the first symbol capitalized when enabled.
#
# The second argument converts the case of all other symbols. To disable use any word other than "lower" or "upper".
#
# The third and following arguments convert specified symbols X to the specified symbols Y. If the symbol Y is the word "NULL", the symbol X
# of that pair will simply be deleted.
#
# Example: dir_names 1 lower [:space:]_ ,. [( ])
# This will change the case of every character in new directories to lower case, capitalize the first character, convert all spaces to underscores,
# all commas to periods, and all brackets to parentheses.
#
# Example: dir_names 1 nothing ,NULL 'NULL
# This will delete commas and apostrophes.
email admin@server.email
# Admin's e-mail (used for the e-mail cookie and the site help output).
file_dl_count 1
# When enabled (the default), glftpd increments a file's GID by 1 when it is downloaded (up to 99 times). This number is displayed when you do a
# long listing (list -l) and your color is on (so it's safe to assume you're in UNIX; Windows clients choke on listings like that).
#
file_names 0 lower [:space:].
# file_names <0|1> ["lower"|"upper"|string] [XY ...]
# Which conversions to do on new and renamed file names.
#
# See "dir_names" for an explanation of the arguments.
goodbye_msg /ftp-data/misc/goodbye.msg *
# Displayed at logoff.
#
# Same matching as "welcome_msg".
login_prompt Who_comes_there_?
# String to replace the standard login prompt.
lslong -a 1
# This sets the default 'ls' command parameters. All options should be combined as one string prepended with -,
# unrecognized options are silently ignored. Recognized options are: 1aAcCdefFGklLnorRsStuUX, see 'man ls' for
# more information on what they do.
#
# The second argument specifies the number of asterisks that are allowed in arguments to LIST, this to prevent abuse of the globbing function
# which could raise load average on the box to very high levels. The default is 2, use 0 for unlimited.
#
# Example: lslong -an
# This will show hidden files by default and only show UIDs and GIDs instead of the usernames and groupnames in long format.
#
# Example: lslong - 3
# No special options, list /*/*/* will work but list /*/*/*/* not.
max_gstats -1 1
# max_gstats <#> [!]<permission> [[!]permission ...]
# The maximum amount of results shown when the matching users use the group stats commands, being the all, month, week and day up and download tops.
#
# The first argument specifies the maximum number of results shown for the users matching the permissions. Use -1 to have no limit. Default is 10.
#
# First match wins so order is important. Thus if you would like everyone with flag 1 to be able to see the complete top but others only the first
# 10 then you would need:
# max_gstats -1 1
# max_gstats 10 *
max_ustats -1 1
# max_ustats <#> [!]<permission> [[!]permission ...]
# The maximum amount of results shown when the matching users use the user stats commands, being the all, month, week and day up and download tops.
#
# The first argument specifies the maximum number of results shown for the users matching the permissions. Use -1 to have no limit. Default is 10.
#
# First match wins so order is important. Thus if you would like everyone with flag 1 to be able to see the complete top but others only the first
# 10 then you would need:
# max_ustats -1 1
# max_ustats 10 *
msgpath /site/ /ftp-data/msgs/site.txt *
msgpath /site/incoming/ /ftp-data/msgs/incoming.txt *
# msgpath <pathmask> <filepath> [!]<permission> [[!]permission ...]
# Display a file (second argument) when a user matching the permissions enters a directory within a path matching the pathmask.
#
# Note: a trailing slash at the end of the pathmask is mandatory if no wildcard is present.
#
# Example: msgpath /site/inc/ /ftp-data/misc/incoming.txt *
# This shows incoming.txt only when entering "/site/inc/".
#
# Example: msgpath /site/inc/????/* /ftp-data/misc/dir_and_subdirs.txt *
# This shows the file when entering a directory matching "/site/inc/????/" and any of it's subdirs, subsubdirs etc.
#
# Example: msgpath /site/inc/????/*/ /ftp-data/misc/somedirs.txt *
# Same as above but only the subdirs of "/site/inc/????/".
newsfile /ftp-data/misc/newsfile *
# newsfile <filepath> [!]<permission> [[!]permission ...]
# Displayed after the first cwd-command you issue.
#
# Same matching as "welcome_msg", except the search will not stop and all matches will be displayed.
show_diz .message *
# show_diz <filename> [[!]permission ...]
# A file that will be shown if it exists in the directory that you enter. You can have multiple lines and they can be bound to permissions.
# The filename is case-sensitive and no wildcards or the likes allowed.
#
# Cookies present in the file will not be interpreted by glftpd due to security concerns.
#
# Example: show_diz FILE_ID.DIZ 1
# show_diz .message
# This would show the files FILE_ID.DIZ just for siteops and .message for everyone when you change into any directory in which they exist.
show_totals * *
# show_totals <#> <pathmask> [pathmask ...]
# When a user enters a directory matching a pathmask, the totals for this directory (race info) will be calculated and displayed, showing max
# results specified in the first argument.
#
# You can have multiple lines with multiple (max 49) path arguments each.
#
# Example: show_totals 30 /site/incoming/????/*/
# This will show statistics for all directories in /incoming/0301, but not for their subdirectories (remove the trailing / if you want that).
sitename_long glftpd private server
# Your site's name.
sitename_short glftpd srv
# The abbreviation of your site's name.
timezone -5
# This modifies the timezone + or - for different regions.
#
# Example: timezone -4
# This will show the time 4 hours behind what it was showing originally.
#
# Note: this setting has been reported to slow down glftpd for some people for unknown reasons, it works fine for most. Because of this,
# there is still an unfixed bug: new files and directories will have the system time, not the timezone-corrected time.
#
# It's best to use the 'localtime fix' instead of this setting - search the FAQ for how to do that.
use_dir_size m /site
use_dir_size M /site/incoming
# use_dir_size <"b"|"g"|"k"|"m"> <path> [path ...]
# This will make glftpd show directories' size (the total size of all files in that directory), instead of the number of bytes the directory
# itself takes up, when a user does a "LIST".
#
# The size can be shown in b = bytes, k = KiB, m = MiB or g = GiB.
#
# Note: For slow processors/harddrives, this might cause slow dir listing.
#
# The second argument should be the path for which this option will work. You may specify several paths. No wildcards. You don't even need full
# paths, instead of /site you can use /si and it will work for /site as well as every other directory starting with /si, and every subdirectory
# of that directory.
#
# Example: use_dir_size k /
# This will show directory size, in kilobytes, for every directory on
# your site.
#
# Example: use_dir_size m /site/incom /site/private
# This will show directory size, in megabytes, for every directory that begins with "/site/incom" and "/site/priva", like /site/incoming,
# /site/incoming/whatever, /site/private, /site/privateer, etc.
#
welcome_msg /ftp-data/misc/welcome.msg *
# welcome_msg <filepath> [!]<permission> [[!]permission ...]
# A file displayed at login, after the user has entered its password.
#
# If you have multiple lines, glftpd will try to match the user with the permissions on the right. The first match will display the file (first
# argument) and stop the search.
#
#
# TRANSFER SETTINGS:
# ------------------
allow_fxp yes yes no 1
# Don't allow anonymous users
allow_fxp no no no 8
# Allow upload but not download for everyone else
allow_fxp no yes yes *
# allow_fxp <"yes"|"no"> <"yes"|"no"> <"yes"|"no"> [[!]permission ...]
# Fxp is an unofficial name for site-to-site transfers, where a user can directly upload from, or download to, another ftp server. This is done
# by "cheating" the ftp server, and using another server's IP and port in the PORT command.
# This setting can check whether the IP in the PORT command is the same as the IP the user connected from. If it isn't, then the user is trying t o
# establish a connection to another ftp server and this will be denied if the user doesn't match permissions. This will also check whether an
# incoming data connection, when using the PASV command, is from the user or not (this is another way to cheat).
#
# The first argument controls if fxp downloads are allowed, the second if uploads are allowed. The third argument, if set to yes, will log all
# attempted transfers (whether successful or not) to foreign addresses to transfer.log for users that match permissions.
#
# Defaults are: allow_fxp yes yes no *
#
# If you have multiple allow_fxp rules, first permission match decides which rule is active.
#
# Example: allow_fxp no yes no =Leech 8
# This will allow people in group Leech or anonymous users to upload from foreign addresses (like other ftp sites), but will not allow them to
# download to foreign addresses. All other users are allowed both.
#
# Example: allow_fxp yes yes yes *
# This will allow everyone to do site-to-site transfers, but it will log all of them to transfer.log.
#
# Example: allow_fxp yes yes no =STAFF
# allow_fxp no yes no *
# This will allow users in group STAFF to both download and upload using fxp, and it will deny downloads for everyone else.
##pre_fxp_check <filepath> [pathmask]
# Can additionally control allow_fxp by a script
#
# Parameters are:
#
# # $1 = Direction of FXP "from" or "to"
# # $2 = IPv4
# # $3 = Name of the file
# # $4 = Actual path the file is stored in
#
# See "pre_check" for pathmask info, echoing and exit codes.
ascii_downloads 20000 *.[Tt][Xx][Tt] *.[Dd][Ii][Zz]
# The maximum byte size that can be downloaded in ASCII mode. Set it to 0 or any string (like 'disabled') to disable size check.
#
# The filemasks specify which files are allowed in ASCII mode. Files that don't match them have to be downloaded in BINARY mode. Omitting this
# setting is the same as using *, meaning all files will be downloadable.
#
# Example: ascii_downloads 20000 *.[Tt][Xx][Tt] *.[Dd][Ii][Zz]
# This will only allow downloading of .txt and .diz files that are 20 thousand bytes or smaller in ASCII mode.
#
# Note: directory listings are not affected by this.
calc_crc *.rar *.zip /site/incoming/* *
# This is for on-the-fly CRC checking. It can take multiple arguments. You can use filemasks or paths or you can mix them.
#
# The CRC will be passed on to the post_check script as third argument. If you upload a file that does not match any mask listed and is not in
# any path listed, "00000000" will be used.
#
# Example: calc_crc *.rar /site/rars/games/* *.[Mm][Pp][3]
# This will calculate CRC for all rars, all files uploaded to the
# /site/rars/games directory (and its subdirectories), and all mp3s, including different cases (like .MP3 or .Mp3).
##creditcheck <pathmask> <#> [[!]permission ...]
# Set different ratio than default when in paths matching pathmask.
#
# If the user doesn't match the permissions on the right, glftpd will move on to the next rule. Pathmask is only checked if the permissions
# for the rule apply. If you don't have any permissions, * is assumed, so the rule applies to everyone.
#
# This ratio is only used for uploading, users get file size * ratio credits when they upload. This isn't used for downloading, so setting
# this to 0 doesn't allow users to download for free. Use the "creditloss" setting for that.
creditloss 0 yes /site/* * =uploads
# creditloss <#> <"yes"|"no"> <filepathmask> [!]<permission> [[!]permission ...]
#
# By user
# # creditloss 0 yes /site/* -admin
#
# By Path for everyone
# creditloss 0 yes /site/* * *
#
# Sets the multiplier for credits lost in paths matching pathmask. This is sort of a reverse-ratio.
#
# If the first argument is 0, users downloading files in paths matching pathmask will not lose any credits. If it's >1, users that match this
# rule will lose that number * filesize of credits for each file they download matching pathmask.
#
# If the second argument is "no" and the user's active ratio (either main ratio if sratio for the current section is -1, or sratio) is 0, the
# user will be denied downloads from paths matching pathmask. The error given is the same as if the user had no 'download' right in glftpd.conf.
#
# You can have multiple creditloss statements - first path match wins.
#
# Example: creditloss 0 yes /site/freestuff/* *
# This will allow everyone to download for free from /site/freestuff/
#
# Example: creditloss 2 yes /site/heavystuff/* =somegroup
# This will charge members of somegroup twice the amount of credits they would lose for downloading files from /site/heavystuff without this rule.
#
# Example: creditloss 3 no /site/specialfile.zip *
# This will cause file /site/specialfile.zip to cost 3 * file size of
# credits to users downloading it, and users with leech (ratio=0) will
# not be allowed to download it at all.
dl_incomplete 1
# Allow or deny users to download a file before it is completely uploaded.
#
# It is recommended to set this to 1 (the default); if a file is in the process of being uploaded and a user tries to download it, then the
# transfer will not be closed until the file is finished. That way no incomplete files will be downloaded when the upload goes slower than the download.
# When this setting is enabled, files being upload have 0755 permissions, otherwise 0600.
#
# Note: this only works if the upload is steady; if there are long periods of inactivity during the upload (over 30 seconds), glftpd stops waiting
# and closes the transfer. It does this by checking the file's modification time, so older files with 755 permissions will be sent without waiting.
freefile *.doc *
# freefile <filemask> [!]<permission> [[!]permission ...]
# Files matching the filemask can be downloaded for free by those matching the permissions. As soon as a filemask matches, the search stops.
#
#
# MEMORY SETTINGS:
# ----------------
dl_sendfile >0
# This option determines if we should use the zerocopy systemcall sendfile() on systems where this is available. This option overrules
# mmap_amount which is one of the 3 possible downloading methods: plain, mmap and zerocopy.
# The number specifies the blocksize (in KiB) for one sendfile systemcall. During the call the shmem (user info) is not updated, so
# for slow lines it's better to use a low number.
#
# Setting this to 0 or smaller disables the option, the default is 512. This option is also disabled if the user has a speedlimit or the
# transfer is using TLS. In all other cases this function is recommended.
#
# Note: This system is not available on all operating systems, confirmed to support this are Linux, FreeBSD, Solaris and AIX.
free_space 11000
# This will prevent people from uploading if your free space on current drive is smaller than the given size in MB. The default size is 10 MB.
# Without this, if there is for example only 1 MB of free space and someone is uploading files of 3 MB, all of them would fail the test and
# be deleted, resulting in a big waste of bandwidth.
ipc_key 0xDEADBABE
# Glftpd uses shared memory, so it needs to use an ipc_key. The default key that glftpd uses is "0x0000DEAD". A second key being ipc_key+2 or
# "0x0000DEAF" is used for a seperate shared memory segment holding extra transfer data.
#
# When running another glftpd server, a different ipc_key needs to be defined in its own config file. The key can be any 8-digit hexadecimal
# string, like: 0x01234567, 0xDEADBABE, 0xBEEFBABE, 0xBADC0FEE, etc but should not be ipc_key+1 (see "ipc_key_dirlog" setting) or ipc_key+2.
#
# If you're using external tools which use shmem, you should verify the correct ipc key is used to gather data.
##ipc_key_dirlog <string>
# Part of the dirlog is also stored in shared memory, which uses another ipc_key. The default key is glftpd's ipc_key+1 or "0x0000DEAE".
#
# See the "ipc_key" setting for which strings can be used.
mmap_amount 5
# The size can be from 0 to 100 and represents the size in MiB. Files being downloaded and smaller than the given size are kept in
# memory, causing a faster download for users wanting the same file. Setting this to 0 or smaller disables the option, the default is 5.
#
# If you have little memory and big files, setting this to a low number may also improve speed.
ul_buffered_force 1
# The size can be from 0 to 100 and represents the size in MiB. Data being uploaded is stored in a buffer equal to the given size,
# which should decrease disk writes. Setting this to 0 or smaller disables the option, which is the default.
#
# WARNING: this feature should only be used on special file systems which for some weird reason need it; it won't make your uploads faster as
# buffering done by the operating system is always faster and doesn't create such a system load.
#
#
# OTHER SETTINGS:
# ---------------
alias rules /README
# Defines an alias for a directory.
#
# Example: alias util /incoming/utils
# This would allow a user to issue the command 'cwd util' anywhere, and it would take the user to "$HOME/incoming/utils", with $HOME the user's
# home directory like /site (in which case it'd be /site/incoming/utils).
cdpath *
# Defines a search-path when changing directories.
#
# Example: cdpath /incoming/utils
# cdpath /incoming/games
# If a user tries to cwd to the directory "foo", it will be searched for
# in the following order:
#
# ./foo
# an alias called 'foo'
# $HOME/incoming/utils/foo
# $HOME/incoming/games/foo
#
# where $HOME is the user's home directory (/site by default).
#
# This only works with the cwd and xcwd commands.
dupe_check 1 yes
# Sets the amount of days back to check for dupe filenames. Set this to 0 to disable dupe-checking, which is the default.
#
# The second parameter is optional - "no" is assumed if it's missing. It refers to ignoring file case when checking dupes. If you set it to
# "yes", it will act like Windows, so file.zip will be treated the same as FILE.zip and glftpd will say it's a dupe.
#
# The datapath/logs/dupefile is automatically "compressed" after every 1000th added file in average by removing all entries older than your
# days limit.
idle_commands noop pwd cwd* site[:space:]who
# This sets which commands to ignore when resetting the idle counter.
#
# The 'STOR', 'APPE' and 'RETR' commands can't be used as idle commands
# because the timer *has to* be refreshed during transfer, otherwise people would drop out downloading big files.
#
# Example: idle_commands noop pwd cwd* site[:space:]who
# This will not reset the idle counter when a user issues noop, pwd, cwd (alone or followed by other characters/arguments), or "site who", so
# users who use these commands and not any others will be disconnected after their idle timeout expires.
#
# Note: the "idle time" that you see in site who, gl_spy, etc, is NOT the same timer used to disconnect people, it is time idle since the
# last command issued by the user. The "real" idle timer is internal and cannot be seen (not that there is any reason to see it) .
ignore_type *.[tT][xX][tT] *.[nN][fF][oO] [rR][eE][aA][dD][mM][eE]
ignore_type *.[sS][fF][vV] *.[cC][rR][cC] *.[dD][iI][zZ]
ignore_type *.vob *.svf *.db *.php *.diz .message *.htm*
# Will ignore the files matching the given filemasks in the directory race info ("show_totals" option), nukes, unnukes and dupes.
# You can have multiple lines with max 50 arguments per line.
#
# Example: ignore_type *.[tT][xX][tT] *.[nN][fF][oO] [rR][eE][aA][dD][mM][eE] .message
# ignore_type *.[sS][fF][vV] *.[cC][rR][cC] *.[dD][iI][zZ]
lastonline 0 25
# This setting determines when users are logged upon logout.
# If 0, all users will be logged.
# If 1, users who timed out and didn't upload, download, nuke or add users will not be logged.
# If 2, users who quit, timed out or lost connection and didn't upload, download, nuke, or add users will not be logged.
#
# The second argument is the default number of lines to show when someone does 'site laston'. If none specified the default is 10.
#
# If there is no lastonline line in the config we will not log at all.
master admin
# Here you can specify the master(s) of the site. The master(s) can change
# anyone's flags and deluser anyone, including all siteops.
#
max_users 10 3
# The maximum number of users allowed to log in at once.
#
# The first argument specifies the maximum amount of users allowed to connect to the site, default 1.
# The second specifies how many extra users with the exempt-flag can connect, if the site is already full. Default 0. If the site isn't full,
# then exempt users take up a slot, just like everyone else. So if you have max_users 5 5, and 5 exempt users are logged in, then noone else
# will be able to log in.
#
# Note: You cannot change this setting with people connected to the site; you MUST have 0 users connected and no gl_spy running, otherwise you'll
# get a "220 Server Error: (SHMGET) Failed!" error. See the FAQ for a fix.
##nodupecheck <pathmask>
# This suspends both the internal dupe check (done by searching datapath/logs/dupefile) and the execution of pre_check scripts (also
# called dupescript) for files uploaded in a path matching pathmask. Multiple lines allowed.
##nopathmatch <pathmask>
# This disables pathmatching in paths matching pathmask when trying to CWD into a dir that doesn't exist. Example: if you are in a dir with a
# subdir "incoming" and you try to "CWD incom" then, if "incom" does not exist, is not an alias and also not a dir in a defined cdpath, it will
# match "incoming" and enter it. Multiple lines allowed.
##nosymderef <pathmask>
# This causes symlinks not to be dereferenced when cwding to paths matching the pathmask. The main effect is that you can cwd back to the directory
# containing the symlink, previously having cwd'd to, by cwd'ing to the parent (either via 'cdup', 'xcup', 'cwd ..' or 'xcwd ..').
oneliners 5
# This tells the number of oneliners to show on the site onel command. Set to 0 to disable oneliners, which is the default.
requests /ftp-data/misc/requests 100
# Where is the request display file and how many requests to store. You can use 0 as second argument to disable requesting.
# Example: requests /ftp-data/misc/requests 10
shutdown 0
# Shuts glftpd down for everyone EXCEPT the users matching on the right.
#
# 'shutdown 0' is the same as 'shutdown *'
# Glftpd will display the /ftp-data/text/shutdown file to users that are denied login because of this setting.
#
# Example: shutdown 1 =STAFF
# This will only allow users with flag 1 and members of group STAFF to log in.
#
# Example: shutdown !*
# This will not allow anyone to log in.
stat_section default * 25
# Here you can define up to 10 multiple statistic sections, including the default section which should always be added as the first stat section:
# stat_section DEFAULT * yes
#
# The last argument specifies if credits are to be counted seperately.
#
# If you want to create one section from multiple paths, use the special keyword "[:and:]" to separate the paths, like:
# stat_section LINUX /slackware[:and:]/debian[:and:]/redhat yes
#
# Based on the directory you are in, the 'site USERS', 'site GIVE',
# 'site TAKE', 'site GINFO' and all stats commands show or change data from the current stat section only.
#
# All stat commands that display text files with cookies in them look for STRINGfilename when invoked in a stat section other than DEFAULT.
#
# Example: stat_section GAMES /site/incoming/games/* yes
# stat_section UTILS /site/incoming/utils/* no
# This would make 2 new sections, 1 Games and 1 Utils. The games section is using a seperate credit system which means that all uploads,
# downloads and credits will change as soon as a user changes to the games directory. If the user goes into the utils directory then only the
# uploads and downloads will change but the credits will be the same as in the default section.
tagline FREE[:space:]YOUR[:space:]MIND
# If a user's tagline matches string, he will be forced to change it before glftpd lets the user download.
total_users 5
# This sets a limit of how many users that can be added.
xdupe *.txt *.nfo *.nfos *.zip *.rar *.tar *.r?? *.gz *.tgz *.bzip
xdupe *.sfv *.[Rr][0-9][0-9] *.[Rr][Aa][Rr] *.[mM][pP][3] *.bizp2 *.ace
# If the user turns x-dupe on, only files which match any of the filemasks will be reported.
# Default is "*.zip *.[Rr][0-9][0-9] *.[Rr][Aa][Rr] *.[Mm][Pp]3".
#
# Example: xdupe *.zip *.r?? *.gz *.tgz
# This will report zips, rars, gzips and gzipped tars on the x-dupe line.
#
#
#,-----------------------------.
#| B. Site command permissions |
#`-----------------------------'
#
# Below is a list of configurable site commands (or grouping of). To the right of a command are the permissions (same format as settings) to be able to
# execute the command.
#
# By default, gadmins have access to the following commands:
# -addip, -adduser, -changeratio, -chpass, -delip, -deluser, -flags, -ginfo,
# -grpnfo, -readd, -userextra, -grp .
# These commands are gadmin-restricted, meaning that if you are a gadmin you can only use those commands on users who are in the same group as your first
# (primary) group. Other commands are not gadmin-restricted, so if you give gadmins access to them, they will be able to use them on ANY user.
# The -purge and -usercomment commands are also gadmin-restricted, but gadmins don't have access to them by default.
#
# You can define your own "You do not have access to this command." message for each of the commands.
# First, create directory "ad" in "/rootpath/datapath/misc". Then, create a file in that directory with the same name as the command keyword in the list
# below without the leading dash, and put the text you want displayed in it. For custom site commands use "custom-yourcommand".
# Glftpd will try to display the individual file first; if that doesn't work, it will show the generic no access error.
# Example: if you want "You do not have access to see who is online" to be displayed when a user does "site who" without access to it, create a file
# "/rootpath/datapath/misc/ad/who" with that text in it.
# FLAGS:
# ``````
# Flagname Flag Description
# -------------------------------------------------------------
# siteop 1 User is siteop
# GADMIN 2 User is Groupadmin
# GLOCK 3 User cannot change group
# EXEMPT 4 Allows to log in when site is full
# color 5 Enable/Disable the use of color (toggle with "site color")
# DELETED 6 User is deleted
# USEREDIT 7 "Co-Siteop"
# ANON 8 User is anonymous (per-session like login)
#
# *NOTE* If you have flag 1 then you DO NOT WANT flag 2
#
# NUKE A User is allowed to use site NUKE
# UNNUKE B User is allowed to use site UNNUKE
# UNDUPE C User is allowed to use site UNDUPE
# KICK D User is allowed to use site KICK
# KILL E User is allowed to use site KILL/SWHO
# TAKE F User is allowed to use site TAKE
# GIVE G User is allowed to use site GIVE
# USERS/USER H This allows you to view users ( site USER/USERS )
# IDLER I User is allowed to idle forever
# PASSWORD J User cannot change his password
# SITE CMDS K User cannot access any site cmds
# I - Z Custom flags
#
# Example: site change user flags +4ABCI
-addip 1 2 7
-adduser 1 2 7
-change 1 7 #who can change a user's settings, except those listed below
-changeallot 1 2 7 #who can change a user's allotment
-changeflags 1
-changehomedir 1
-changeratio 1 2 7
-changesratio 1 7 #who can change a user's section ratio
-chgadmin 1 7 #who can set/unset gadmins
-chgrp 1 7
-chgrp-priv 1 #chgrp for private groups
-chmod 1
-chpass 1 2 7
-chpgrp 1 7 #who can change a user's primary group
-delip 1 2 7
-delownip !8 !K * #who can delete their own IP's
-deluser 1 2 7
-dirs !8 !K * #(alias|cdpath|dupe|fdupe|new|nukes|unnukes)
-emulate -specialuser
-errlog 1
-flags !8 !K *
-gadduser 1 7
-ginfo 2 H
-give G
-group !3 !K *
-groupcomment 1 #who can see "/rootpath/datapath/text/group.comment" when doing site grp
-groups !8 !K *
-grp !8 !K *
-grpadd 1
-grpchange 1
-grpdel 1
-grpnfo 1 2
-grpren 1
-grpstats !K * #who can restrict the userstats commands by =group
-help * #who can get site help menu and commands
-info * #(welcome), need access to "welcome_msg" setting too
-kick D
-kill E
-laston !8 *
-logins 1
-misc * #(color|idle|time|vers)
-msg !8 !K * #reading and sending messages, perms here will affect the 3 settings below too
-msg* 1 #(msg *), msg to everyone
-msg= 1 #(msg =group), msg to a group (members of =group are exempted)
-msg{ !8 !K * #(msg { user user }), msg to several users
-nuke A
-onel !8 !K * #who can view oneliners
-oneladd !8 !K * #who can add oneliners with 'site onel something'
-passwd !8 !J
-predupe C
-purge 1
-readd 1 2 7
-renuser 1 7
-reqlog 1 A B 7
-request !8 !K * #who can view requests and use 'site reqfilled'
-requestadd !8 !K * #who can add requests with 'site request something'
-seen !8 *
-show 1
-showhiddenusers 1 #who can see hidden users (via the "hideuser" setting) in 'site who' and 'site swho'
-stat !8 !K * #who can use 'site stat' and has statline displayed after transfers
-stats !8 !K * #(aldn|alup|daydn|dayup|gpad|gpal|gpdaydn|gpdayup|gpmonthdn|gpmonthup|gpwd|gpwk|monthdn|monthup|nuketop|stats|wkdn|wkup)
-swho =STAFF 1 E
-syslog 1 =STAFF
-take F
-traffic 1 7
-undupe C
-unnuke B
-update 1
-user !8 !K * #(tagline|user)
-usercomment 1 7 #who can see "/rootpath/datapath/text/user.comment" when doing site user
-userextra 1 2 7 #who can see "/rootpath/datapath/text/user.extra" (user's IP's) when doing site user
-userothers !8 * #who can use 'site stats user', need perms for "-stats" too
-users H #who can see detailed user listing.
-who !8 !K *
-wipe -trusteduser
Xinetd.d
Xinet.d is an open-source super-server daemon which runs on many Unix-like systems and manages Internet-based connectivity. It offers a more secure extension to or version of inetd, the Internet daemon.
The following switches can be used:
-B This will only allow connections from the port bouncer (connecting from localhost 127.0.0.1 will still work)
-b This allows connections from a port bouncer or direct connections.
-e This will use european week (Mon-Sun) when modifying stats
-l Logs new dirs,deleted dirs,nukes,unnukes,logins,logouts to /glftpd/ftp-data/logs/glftpd.log and login.log in ascii.
-L Works just like -l, but it will always log creation and deletion of directories to glftpd.log.
The -l option only logs those if they are in dirlog path (specified in glftpd.conf).Most likely, you want to use -l, this is for special cases.
-i Logs uploads to /glftpd/ftp-data/logs/xferlog.
-I Disables ident lookups. Note that if you use tcpd, it will do an ident lookup independently from glftpd.
-o Logs downloads /glftpd/ftp-data/logs/xferlog.
-d Logs connections and all user commands to system logs as debug (usually /var/log/debug, but refer to your /etc/syslog.conf).
-r <file> Use alternate glftpd.conf file.
-t <seconds> Sets the default idle timeout period.
-T <seconds> Sets the maximum idle timeout period a user may select using the 'site idle' command if he/she doesn't have a personal idle time set (site change user idle_time xx).
-n <#> Number of DNS retries, 0 disables DNS resolving.
-s <path> The full path to the glstrings binary (default is /glftpd/bin/glstrings.bin). Example: -s/.../glftpd/bin/myownglstrings.bin
-x makes glftpd only log ips on errors. (by default everything will be logged)
-X forces glftpd not to log ips (not even for error messages in login.log)
Add the following line to '/etc/services' or set it like the following example on xinet.d:
glftpd <Port you want glftpd on>/tcp
Example:
glftpd 8000/tcp # Glftpd
- Important Notes
- Do not initially put your ftpd on port 21…stick it on a really high port so you know it works
- DO NOT PUT THE PORT RIGHT NEXT TO ANOTHER PORT, SPACE THEM OUT BY AT LEAST 5-10 PORTS
Xinet.d example
service glftpd { # *** The following 5 options are optional and not required to make glftpd to work # port = 21 # setting the port here is optional # log_type = FILE /var/log/glftpd.log # if you want to have xinet to create logs # -t <seconds> Sets the default idle timeout period. # -T <seconds> Sets the maximum idle timeout period a user may select using # the 'site idle' command if he/she doesn't have a personal # idle time set (site change user idle_time xx). # -n <#> Number of DNS retries, 0 disables DNS resolving. # -s <path> The full path to the glstrings binary (default is /glftpd/bin/glstrings.bin) # Example: -s/.../glftpd/bin/myownglstrings.bin # -x makes glftpd only log ips on errors. (by default everything will be logged) # -X forces glftpd not to log ips (not even for error messages in login.log) }
Working configuration
service glftpd
{
# *** The following 5 options are optional and not required to make glftpd to work
# port = 21 # setting the port here is optional
# log_type = FILE /var/log/glftpd.log # if you want to have xinet to create logs
# bind = <computer-hostame/ip if you want to have glftp on specific ip>
# only_from = <remove to allow all ips to connect or specify who can connect by ip or ip range>
# server = /usr/sbin/tcpd # setting tcpd here is optional
# if you do not want to add anything to /etc/services you can use
# type = UNLISTED
# port = 1337
disable = no
flags = REUSE NAMEINARGS
socket_type = stream
protocol = tcp
wait = no
user = root
server_args = /path/to/glftpd/bin/glftpd -X -l -i -o -r /path/to/glftpd.conf -s /path/to/glftpd/bin/glstrings.bin -e
}
Templates
These templates must be created by manually editing the conf and not by site command option!!
You can check the settings by issuing:
site user default.user site group default.group
Group template
Edit and modify as per need:
vim glftpd/ftp-data/groups/default.group
# Default groupfile # SLOTS: SLOTS, LEECH SLOTS, ALLOTMENT SLOTS, MAX. ALLOTMENT SIZE SLOTS -1 0 0 0 # GROUPNFO: GROUPINFO GROUPNFO # SIMUL: # of simultaneous users SIMULT 0
User template
Edit and modify as per need:
vim glftpd/ftp-data/groups/default.user
| Username: default.user Created: UNKNOWN | 200- | Added by: Expires: Never | 200- | Time On Today: 00:00 Last seen: Wed Dec 31 19:00:00 1969| 200- | Flags: 3 Idle time: 3000 | 200- | Ratio: 1:2 Credits: 0.0 MB | 200- | Total Logins: 0 Current Logins: 0 | 200- | Max Logins: 2 From same IP: 2 | 200- | Max Sim Uploads: Unlimited Max Sim Downloads: 1 | 200- | Max Upload Speed: 0.0 K/s Max Download Speed: 0.0 K/s | 200- | Times Nuked: 0 Bytes Nuked: 0 MB | 200- | Weekly Allotment: 0 MB Messages Waiting: N | 200- | Time Limit: 0 minutes. (0 = Unlimited) | 200- | Tagline: default.template | 200- | Groups: | 200- | Priv Groups: | 200- +-----------------------------------------------------------------------+ 200- | IP0: IP1: | 200- | IP2: IP3: | 200- | IP4: IP5: | 200- | IP6: IP7: | 200- | IP8: IP9: | 200- +=======================================================================+
Accounts
On site command: Site groups
You will get a similar output like the one below
Group account
200- #users Group Abbr. Group Description 200 200 audio tones of mp3 200 pics my files 200 wallpapers backgrounds 200- ------------------------------------------------------- 200- 200- nfo Readme.files 200- files opensource 200- uploads uploads.folder 200- private classifed 200- pictures pictures 200- user1 user1 200 docs word.documents 200- videos youtube 200- subs subtitles 200- user2 user2 200- 200- A '*' denotes a private group. Type SITE CHGRP to add 200- or remove users from these groups. 200- 200 0 user groups, 4 privileged groups.
User account
The default.user template will result in something like this on 'site command'.
site user default.user
| Username: default.user Created: UNKNOWN | 200- | Added by: Expires: Never | 200- | Time On Today: 00:00 Last seen: Wed Dec 31 19:00:00 1969| 200- | Flags: 3 Idle time: 3000 | 200- | Ratio: 1:2 Credits: 0.0 MB | 200- | Total Logins: 0 Current Logins: 0 | 200- | Max Logins: 2 From same IP: 2 | 200- | Max Sim Uploads: Unlimited Max Sim Downloads: 1 | 200- | Max Upload Speed: 0.0 K/s Max Download Speed: 0.0 K/s | 200- | Times Nuked: 0 Bytes Nuked: 0 MB | 200- | Weekly Allotment: 0 MB Messages Waiting: N | 200- | Time Limit: 0 minutes. (0 = Unlimited) | 200- | Tagline: default.template | 200- | Groups: | 200- | Priv Groups: | 200- +-----------------------------------------------------------------------+ 200- | IP0: IP1: | 200- | IP2: IP3: | 200- | IP4: IP5: | 200- | IP6: IP7: | 200- | IP8: IP9: | 200- +=======================================================================+
Commands and options
Changing user settings by 'site change user <name>', you will get a similar output like the one below
User options
ftp> site CHANGE <name> 200- Valid fields & descriptions: 200- 200- ratio [0-9] The user's ratio 200- sratio [Str] [0-9] User's section ratio 200- max_dlspeed [Str] User's max download speed in KiloBytes/sec 200- max_ulspeed [Str] User's max upload speed in KiloBytes/sec 200- max_sim_down [Num] User's max simultaneous downloads 200- max_sim_up [Num] User's max simultaneous uploads 200- wkly_allotment [Num,Num] Section,Weekly credit allotment 200- idle_time [Str] The user's default idle time 200- tagline [Str] The user's tagline 200- comment [Str] The user's comment 200- num_logins [Num] [Num] Max concurrent connections [ from same IP ] (0=unlimited) 200- time_limit [Str] User's time limit 200- timeframe [0-23 0-23] The hours between which the user can log in 200- credits [Kb] User's Credits (use SITE GIVE to ADD) 200- flags [Str] User's Flags 200- homedir [Str] User's Home Directory 200- startup_dir [Str] User's Start-up Directory 200- expires [Date] Date after which a user expires (yyyy-mm-dd} 200 Command Successful.
Shell commands
On site command: Site help
You will get a similar output like the one below
200- --=--------------------- Available SITE commands ---------------------=-- 200- TAGLINE: Change Your Tagline 200- WKUP: Show Weektop Uploaders 200- WKDN: Show Weektop Downloaders 200- ALUP: Show Alltime Uploaders 200- ALDN: Show Alltime Downloaders 200- GPWK: Show Weektop Groups 200- GPMONTHUP: Show Month Top Groups 200- GPAL: Show Alltime Top Groups 200- GPWD: Show Weektop Group Downloaders 200- GPMONTHDN: Show Month Top Group Downloaders 200- GPAD: Show Alltime Top Group Downloaders 200- DAYUP: Today's Top Uploaders 200- DAYDN: Today's Top Downloaders 200- MONTHUP: Show MonthTop Uploaders 200- MONTHDN: Show MonthTop Downloaders 200- TRAFFIC: Show Site Traffic 200- REQUEST: Make a Request 200- REQFILLED: Mark a Request as Filled 200- WELCOME: Show Welcome Message 200- RULES: Show Site Rules 200- USER: Show Users On Site (Type username to see users stats) 200- NUKES: Show Nukes 200- UNNUKES: Show UnNukes 200- DUPE: Search Dupe Database 200- TIME: Show Local Time 200- NEW: Show Recent Dirs 200- GROUP: Join/Leave Groups 200- ONEL: Add/View Onliners 200- MSG: Send a Message 200- WHO: See who's online 200- COLOR: Toggle Color 200- SEEN: See when a user was last on 200- LASTON: Display stats of last users online 200- SEARCH: Locate a DIR on the site. 200- PASSWD: Change Password 200- VERS: Show Daemon Version 200- STAT: Show Statline 200- IDLE: Show Minimum and Maximum Idle Timeout 200- GINFO: Detailed nfo of Groups 200- USERS: List Users on Site 200- DELIP: SITE DELIP <yourownusername> # (delete your own IP's) 200- NUKE: Nuke Program (site nuke <dir> <rate> <reason>) 200- UNNUKE: UnNuke Program (site unnuke <dir> <Opt: reason>) 200- UNDUPE: Delete Dupe (site undupe <filename>) 200- ADDIP: Add IP To a User 200- DELIP: Delete an IP From a User 200- ADDUSER: Add User 200- DELUSER: Delete User 200- READD: Readd Deleted User 200- CHANGE: Change Field For a User 200- GADDUSER: Add User and put him in a group 200- RENUSER: Rename User 200- CHPASS: Change Another User's Password 200- KICK: Kick a user 200- KILL: Kill a pid 200- SWHO: Alternative who 200- GRPADD: Add group 200- GRPDEL: Delete group 200- GRPNFO: Change Group nfo 200- GRPREN: Rename group 200- GRP: Show extended group info 200- CHGRP: Change a user's group 200- GRPCHANGE: Change group settings 200- CHGADMIN: Change the gadmin(s) for a group 200- LOGINS: Login Log 200- SYSLOG: Syslog Log of User Changes 200- UPDATE: Update DirLog Database 200- PURGE: Purge Deleted Users 200 Use "SITE HELP <command>" for syntax help. 200- ADDIP: Add IP To a User 200- DELIP: Delete an IP From a User 200- ADDUSER: Add User 200- DELUSER: Delete User 200- READD: Readd Deleted User 200- CHANGE: Change Field For a User 200- GADDUSER: Add User and put him in a group 200- RENUSER: Rename User 200- CHPASS: Change Another User's Password 200- KICK: Kick a user 200- KILL: Kill a pid 200- SWHO: Alternative who 200- GRPADD: Add group 200- GRPDEL: Delete group 200- GRPNFO: Change Group nfo 200- GRPREN: Rename group 200- GRP: Show extended group info 200- CHGRP: Change a user's group 200- GRPCHANGE: Change group settings 200- CHGADMIN: Change the gadmin(s) for a group 200- LOGINS: Login Log 200- SYSLOG: Syslog Log of User Changes 200- UPDATE: Update DirLog Database 200- PURGE: Purge Deleted Users 200 Use "SITE HELP <command>" for syntax help.
Crontab
Edit crontab:
vim /etc/crontab
'reset' bin every night at midnight
0 0 * * * /.../path/to/glftpd/bin/reset -r /.../path/to/glftpd/glftpd.conf >/.../path/to/ftp-data/logs/reset.log 2>&1
SSL
See cryptography certificates for more options on how to create a server key.
glftpd comes with script to help generate cryptography certificates and inside glftpd install directory you will find a file called create_server_key.sh. execute it.
- Create certificate
./create_server_key.sh create_server_key.sh v1.0 by Slask&HoE Usage: ./create_server_key.sh [rsa] info info - can be any word, and it should inform the client about the server he is logging in (for example servername) rsa - if you don't specify this then DSA key will be created certificate is for 900 days and is self-signed
And it is done. After this you need to place the new cryptography certificates in the proper and pre-chosen glftpd.conf directory.
- Editing create_server_key.sh
This is purely optional and not needed by the default. Only useful if you wish to change the encryption bit quality and or other specifications.
vim create_server_key.sh
#!/bin/sh
ssldirs="$OPENSSLDIR /usr /usr/local/openssl /usr/lib/openssl /usr/local/ssl /usr/ssl
/usr/share /usr/lib /usr/lib/ssl /usr/pkg /opt /opt/ssl"
opensslbin=`which openssl`
if [ -z $opensslbin ]; then
for x in `echo $ssldirs`; do
if [ -f $x/bin/openssl ]; then
opensslbin=$x/bin/openssl
fi
done
if [ -z $opensslbin ]; then
echo "Sorry openssl binary not found !"
exit 1
fi
fi
echo "create_server_key.sh v1.0 by Slask&HoE"
if [ -z "$1" ] ; then
echo "Usage: ./create_server_key.sh [rsa] info"
echo "info - can be any word, and it should inform the client"
echo " about the server he is logging in (for example servername)"
echo "rsa - if you dont specify this then DSA key will be created"
echo "certificate is for 900 days and is self-signed"
exit 1
fi
if [ -z "$2" ] ; then
type=dsa
servbase=$1
base=ftpd-dsa
$opensslbin rand -out gunk 4096
$opensslbin dsaparam -rand gunk -out $base.dsaparam 4096
$opensslbin dhparam -rand gunk -out $base.dh 4096
option=$base.dsaparam
rm -f gunk
else
type=$1
servbase=$2
base=ftpd-$1
option=4096
fi
$opensslbin gen$type -out $base.key $option
$opensslbin req -new -x509 -days 900 -key $base.key -out $base.crt 2>/dev/null << EOF
.
.
.
.
.
$servbase
.
EOF
cat $base.key $base.crt > $base.pem
if [ $type = "dsa" ] ; then
cat $base.dh >> $base.pem
fi
rm -f $base.key $base.crt $base.dh $base.dsaparam
echo
echo $base.pem created.
echo "Copy the file to some safe place and tell glftpd where to find it with *_CERT_FILE glftpd.conf option."
- Making create_server_key.sh
Copy the above code and place it inside a text file.
vim create_server_key.sh
Save, exit and turn it into executable.
chmod +x create_server_key.sh ./create_server_key.sh
Links
- Official network and #channel: Efnet #glftpd & #glhelp
- Glftpd repository
- Backup mirror
- Official Documentation
- HOW-TO GLFTPD 2.01 - Configurations (gentoo linux forums)
- GLFTPD 2.0.1 + TLS -> Failed TLS negotiation
- glFTPD Addons
- Glftpd dns domain resolving
- HOW-TO INSTALL GLFTPD 2.01 & Update to 2.01.1 (psxc-beta) (gentoo linux forums)
- Glftpd on wikipedia