Linux Server Security, Second Edition

This is the Title of the Book, eMatter Edition

Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.

378

|

Chapter 11: Securing File Services

In short, the MaxClientsPerHost directive assumes that legitimate users will tend

to have unique IP addresses. If you anticipate this not being the case, set this

directive to a relatively high number (say,

50) or leave it unset for no limit at all.

Umask 022

As with the umask command in user shells, this directive specifies hits in the file

permissions that cannot be set. The umask you set with this directive applies to

any file or directory created by a logged-in FTP user. You probably don’t need to

set this if you don’t have any writable FTP directories, but then again, it can’t

hurt (assuming, of course, you set a restrictive umask such as

022).

User, Group

When specified in a server section (either base server or a <Virtual> block), these

directives set the username and group name, respectively, under which the dae-

mon should run, except when performing privileged functions such as binding

to TCP Port 21 at startup (when ProFTPD must be root, it will temporarily

become root). If you declare no

User or Group directives, by default ProFTPD will

always run as root, which is dangerous. In most cases, it makes sense to declare

them in a

<Global> block and additionally in <Anonymous> configuration blocks

(see Example 11-6).

Anonymous FTP setup

Now that ...