Linux Server Security, Second Edition

This is the Title of the Book, eMatter Edition

Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.

FTP Security

|

373

ports. Unlike Apache, however, ProFTPD does not support multiple virtual servers

listening on the same combination of IP address and port.

This is due to limitations of the FTP protocol. Whereas HTTP 1.1 requests contain

the hostname of the server being queried (i.e., the actual URL entered by the user),

FTP requests do not. For this reason, you must differentiate your ProFTPD virtual

servers by IP address (by assigning IP aliases if your system has fewer Ethernet inter-

faces than virtual hosts) or by listening port. The latter approach is seldom feasible

for anonymous FTP, since users generally expect FTP servers to be listening on TCP

21. (But this is no big deal: under Linux, it’s very easy to assign multiple IP addresses

to a single interface.)

Base-server and global settings

On to some actual configuration. The logical things to start with are base-server set-

tings and global settings. These are not synonymous: base-server (or “primary-

server”) settings apply to FTP connections to your server’s primary IP address,

whereas global settings apply both to the base server and to all its virtual servers.

You might be tempted in some cases to assume that base-server settings are inher-

ited by virtual servers, but resist this temptation, as they usually aren’t. With ...