Ftp – chroot in proftpd

Check out the DefaultRoot configuration parameter. With that you can modify the directory to which the user is restricted.

You have two options:

• Set DefaultRoot to the homedir and create/modify an user so that it's home-directory is /var/www/html/
• Set DefaultRoot to /var/www/html/

Do you have the appropriate /etc/pam.d file for proftpd to tell it to use LDAP?

The directory /usr/share/doc/libpam-ldap/examples/pam.d/ has examples. Normally you can just copy them all over to /etc/pam.d/

However on squeeze you have to change all occurances of "pam_unix_" to "pam_unix" because all /lib/security/pam_unix_ files are gone and it now is just /lib/security/pam_unix.so. If you don't make these changes and log out you can't log back in, neither log in through the console or anything. You'll have to boot a rescue CD and change them that way.

So, for example in /usr/share/doc/libpam-ldap/examples/pam.d/ssh change:

auth       required     /lib/security/pam_unix_auth.so try_first_pass
account    required     /lib/security/pam_unix_acct.so
session    required     /lib/security/pam_unix_session.so

to:

auth       required     /lib/security/pam_unix.so try_first_pass
account    required     /lib/security/pam_unix.so
session    required     /lib/security/pam_unix.so

The file for ftp (/usr/share/doc/libpam-ldap/examples/pam.d/ftp) looks like this:

#%PAM-1.0
auth       required /lib/security/pam_listfile.so item=user sense=deny file=/etc/ftpusers onerr=succeed
auth       required /lib/security/pam_shells.so
auth       sufficient   /lib/security/pam_ldap.so
auth       required /lib/security/pam_pwdb.so shadow nullok
account    sufficient   /lib/security/pam_ldap.so
account    required /lib/security/pam_pwdb.so
#session   sufficient   /lib/security/pam_ldap.so
session    required /lib/security/pam_pwdb.so