Creatively using mount to handle SMB shares for Pure-FTP

 This portion will walk you through mounting SMB shares. I do some things differently for a more complex layout. But in the end it's worth it. I also use a credentials file to protect my share user accounts. Again, get to your server as Root.

Install smbfs so you can mount these network shares:
apt-get install smbfs

Go to the /mnt folder. Some may prefer media, but I like to reserve that for less permanent shares.
cd /mnt

create a folder for each network share

mkdir music
mkdir video
mkdir work

Give ownership of your share folders to the ftpgroup. This shouldn't matter because these folders will end up with the permissions given by the mount settings.

chown -R nobody:ftpgroup .
---Note: The period at the end is intentional

Create credential files to protect mounted accounts. The credential files are sensitive to spaces and line feeds. Just fill it in exactly as below.

nano music.cred

username=shareuser
password=thisisapassword

Save and exit.

nano video.cred

username=videouser
password=morepasswords

etc.

restrict credential files. You need to make it so only the root account can read these files.

chmod 600 *.cred


Now lets permanently mount some of these shares:

nano /etc/fstab

Add the following to the bottom of the file, noperm (no permission checking) on the first line is recommended for any share which the user will upload/write into. ro shares (read only) shouldn't need this.

//worldbook-work/work /mnt/work cifs credentials=/etc/work.cred,rw,uid=65534,gid=2001,noperm 0 0


//worldbook-media/music /mnt/music cifs credentials=/etc/music.cred,ro,uid=65534,gid=2001 0 0


//worldbook-media/video /mnt/video cifs credentials=/etc/video.cred,ro,uid=65534,gid=2001 0 0


# These following lines bind the mounts to our FTP folders.
/mnt/music /var/ftp/media/music none bind 0 0


/mnt/video /var/ftp/media/video none bind 0 0


/mnt/work /var/ftp/work none bind 0 0


/var/ftp/work /var/ftp/workmedia/work none bind 0 0


/var/ftp/media /var/ftp/workmedia/media none rbind,_netdev,noauto 0 0


Because /var/ftp/workmedia/media relies on another nested mount the timing of the mounts prevents the mount from working right away. To solve this I added some lines to rc.local to force mounting again at login.

nano /etc/rc.local

before exit 0 add these lines.

sleep 10


/bin/mount -a -t cifs


sleep 5


/bin/mount /var/ftp/workmedia/media

Exit and Save.
Reboot and go to your var/ftp (or other mount folder) and see if it worked.

You may notice that I bind my  shares into the FTP folders instead of mounting them right there. This is done because my FTP folder is for FTP, but the mount folder is for any purpose. If I decide my FTP server will also serve as a DLNA media server then I have nothing else to do but point the dlna server to my mount folder.

HOWTO: Setup Virtual Users with shared folder access on Pure-FTP in Ubuntu 9.10

This post assumes you have already setup pure FTP and ubuntu server 9.10. If you have not, go read my earlier posts. Start by logging into the server and switching to root.

If you haven't already, make sure pure-ftp supports the database file for virtual users.
ln -s /etc/pure-ftpd/conf/PureDB /etc/pure-ftpd/auth/50pure

Restart your FTP server process or just reboot.

Create an FTP group account and 2 shared accounts for users. Users will get individual virtual accounts.
groupadd -g 2001 ftpgroup

useradd -u 2010 -s /bin/false -d /bin/null -c "pureftp limited access user" -g ftpgroup ftplimited
useradd -u 2011 -s /bin/false -d /bin/null -c "pureftp full access user" -g ftpgroup ftpfull

Create a set of directories for the FTP files and to serve as chroot access points. I create a mess of folders for my purposes. You can read about my goals in an earlier post.
cd /var
mkdir ftp
cd /var/ftp
mkdir dropbox
mkdir work
mkdir media
cd media
mkdir music
mkdir video
cd /var/ftp
mkdir workmedia
cd workmedia
mkdir work
mkdir media
cd /var/ftp
chown -R ftpfull:ftpgroup /var/ftp
chmod -R 755 /var/ftp
chmod 735 /var/ftp/dropbox

Lets add some users:

Joey - dropbox user, SLOW download (he shouldn't need to download anyways.)
pure-pw useradd joey -u ftplimited -g ftpgroup -d /var/ftp/dropbox -t 1
Make up a password for joey at the next prompt.

Pam - Dropbox admin, normal download, but slow upload
pure-pw useradd pam -u ftpfull -g ftpgroup -d /var/ftp/dropbox -t 200 -T 1

Mr. Smith - Work user, normal download speed, unlimited upload
pure-pw useradd smith -u ftpfull -g ftpgroup -d /var/ftp/work -t 250

Dave - Media user, normal download speed, unlimited upload
pure-pw useradd dave -u ftplimited -g ftpgroup -d /var/ftp/media -t 250

ME. No speed limits.
pure-pw useradd john -u ftpfull -g ftpgroup -d /var/ftp/workmedia


After adding/modifying users you must issue this command to commit them.
pure-pw mkdb


Some other helpful commands:
List all user accounts
pure-pw list
Show a particular account details
pure-pw show dave
List all active users
pure-ftpwho
Reset User Password
pure-pw passwd dave
Delete User
pure-pw userdel dave
Modify User (give Dave an upload speed limit of 20)

pure-pw usermod dave -T 20

You should be able to log in as any user. However since we have not mounted the shares, no files will be visible. Some users should be able to upload files, but delete these temporary files before mounting your shares.
Next I'll go through my mounting techniques. I use binding too to simplify mounting.

HOWTO: Setup Pure-FTP on Ubuntu 9.10 with passive NAT support.

Please read my earlier posts on what I'm trying to accomplish. They will guide you to setup an Ubuntu 9.10 Server and give you an idea of my conventions. This is assuming you are using Ubuntu Server 9.10. Other flavors of linux may behave differently. The majority of my guidance on this came from ubuntu howto. My real work came from putting the other pieces together to meet my particular needs. Namely, the other 5 posts in the series.

Login and use sudo su again

apt-get install pure-ftpd

Now you should be able to connect to your FTP on port 21 at the server IP using your username and password. we are not ready to connect from the outside yet.

Setup all the pure-ftp settings. These setting files for pure-ftp work differently than what the pure documentation indicates. This may just be an Ubuntu thing. In the end, these files are 'translated' into command line switches.
Each line simply writes a value into the file. You can do the same by opening the file with nano and typing the value on the first line. Some setting files already exist and they should remain as they also contain important settings.

cd /etc/pure-ftpd/conf

Security Related Settings:

echo 99 > MaxDiskUsage
You can lower this but keep some setting here or someone could crash your server by filling the disk.

echo no > PAMAuthentication

echo 20 > MaxClientsNumber
You can change this but don't get too high. Be realistic with your bandwidth and server power.

echo 4 > MaxClientsPerIP

echo yes > ChrootEveryone

echo yes > NoChmod

echo yes > ProhibitDotFilesRead

echo yes > ProhibitDotFilesWrite

Network Settings:

echo 183.22.182.3 > ForcePassiveIP
Your external IP. Assuming you are behind a NAT Router.

echo ,3421 > Bind
A port for your FTP server. 21 is the standard but I change mine to keep them guessing. The comma is intentional.

echo 60000 60100 > PassivePortRange
For NAT forwarding issues you need to set this. Make sure your range supports 2x MaxClientsNumber. This and the Bind setting will be used on your router. write them down.

Misc Setting:

echo yes > BrokenClientsCompatibility


Finally restart your FTP server:
/etc/init.d/pure-ftpd restart

Here is my output from the command above.

Restarting ftp server: Running: /usr/sbin/pure-ftpd -l puredb:/etc/pure-ftpd/pureftpd.pdb -x -O clf:/var/log/pure-ftpd/transfer.log -u 1000 -S ,3421 -c 20 -k 99 -C 4 -P 183.22.182.3 -X -b -8 UTF-8 -Y 1 -A -E -R -p 60000:60100 -B

You can now go into your router and forward the main port (3421) and the passive port range (60000-60100) to your server IP (192.168.1.99).

Test your system from outside of your network if possible.

In the next post I will show you how to setup some virtual users with shared folder access.

HOWTO: Set up a versatile FTP server with Pure-FTP and Ubuntu 9.10 Server

Over the next several posts I am going to give you the steps I used to setup my Pure FTP server. I have some requirements that others may have and I feel you could benefit from parts of it too. Here are the broad details with hypothetical names and purposes to make explaining the situation easier.

I have two network shared devices called worldbook-work and worldbook-media. I will refer to these as work and media respectively. Work is used by my company as an information store. Users will need to read and write to it. Media has two separate shares on it. One for music and one for videos. I have this to allow family access remotely. There is no need to write to this remotely so the share account on the device only allows reading as another layer of security. Finally I need to support a dropbox for a photography group I am in. The photographers will drop their pictures off and the administrator will log in, download the pictures and put them on another website, the administrator will delete the files once retrieved. Photographers should not be able to see or modify another photographer's files. I am just using local server disk for this since the files are transitory and the original photographer can send another copy if a problem arises.
Work users will need full access to work. Family will need read access to media. I will need full access to work and read access to media. and I have users who need to use the dropbox as described above. All while most shares are over a SMB mount.

Here are the coming posts to show you what I did.

• Setting up Ubuntu Server with Static IP, network device aliases, and SSH support.
• Setting up Pure-FTP server with Passive NAT support, and proper security precautions
• Setting up a directory structure with permissions and virtual users with bandwidth control
• Setting up mounts with credential files for added security and binding to share mounts amoung many folders.
• Setting up TLS security to enable encrypted FTP. Referred to as FTPS.

To do/desires:

• Force TLS for all users except dropbox users.
• send an email after a file is sent to dropbox, but no other share
• (Not possible without a separate server process from what I can tell.)
• Refine directory management and permissions. Perhaps have a virtual layer of permissions on top of existing directory permissions.
• (Not possible without a software change. Though it should be possible to code with dot files in folders.)
• Allow each virtual user to have a virtual private folder.
• (I have no clue or even a suggestion for this)

Check out the coming posts in this series to see the way I solved this task.

FTP Server with Ubuntu 9.10 Server

I still use FTP. Mostly because all the other methods I looked at (WebDAV, SFTP, and Web Based file server) were all missing one thing or another that I feel I need. I have the following types of needs:

• I need a ftp location that a user can upload into, but not download or see. (Drop box)
• I need someone else with the ability to download and delete files from that dropbox
• I need an group that can read/write one particular folder (shared workspace)
• Another group that can access that same shared workspace while also giving access to another folder with read only permissions (Library).
• I need a group that can access the same Library folder mentioned above. But not access the shared workspace.

I had other types of configurations which I decided I could drop from the requirements for now just to make my life easier.
Other requirements:

• Minimal configuring, management, trouble shooting for individual users
• per user bandwidth control, 
• nat support, 
• simple client instructions/requirements, 
• and for most of the shared files to come from a SMB NAS.

I have used a windows FTP server for over 5 years to achieve all of the above. The windows FTP server I preferred was called bulletproof or G6 depending on how far you go back. It is actually an excellent server that I recommend to anyone in the windows world. Here are some of the features that I used:

• Virtual Users (A user list managed by the FTP server instead of the OS)
• Virtual Groups
• Per User/Group bandwidth throttling
• Easy user setup by just picking their group.
• Chrooted Users (Keep the user from getting to the rest of your file system)
• Virtual Links and Link traversing
• Virtual Folder Permission control
• Nearly all folders on a network NAS device (Buffalo Terrastations)
• NAT Traversal/Passive FTP
• Non Standard Port
• etc.

In the next FTP posting I'm going to show how I came close enough to these features in Ubuntu 9.10 Server to eliminate another windows machine using Pure-FTP. Surprisingly there wasn't just one hurdle for accomplishing this, but nearly every feature had to be painfully worked out. On the plus side I have more features than I had before and I have better options to manage the server.