Search code examples
mysqlauthenticationproftpd

UID & GID for ProFTPd with MySQL auth mod

Good day to you all!

I have a Ubuntu 18.04 LTS server with MySQL 8.0 and ProFTPD 1.3.5e Server.

I used these instructions to set up MySQL authentication for ProFTPd.

https://medium.com/@nico26deo/how-to-set-up-proftpd-with-a-mysql-backend-on-ubuntu-c6f23a638caf

And it works great!

The article above sets up the first user "test" with a UID of 5500 and a GID of 5500. It says that the FTP user directory should be created and chowned to 5500:5500. All very nice.

What it does not say is what to do when the second and third and successive users come along. It is easy to create new users in the database with an INSERT query but should the UID and GID be unique to the new ftp user? If so, is there an easy way to get MySQL to AUTO_INCREMENT the new values above 5500 and 5500 respectively?

Obviously, outside of that query, I will need an auxiliary process that creates the directory and chowns it to the correct UID and GID in the database. My thoughts is as follows:

  1. INSERT the new ftp user name, password, homedir into the database. This would include what ever UID and GIU need to be inserted.
  2. Create a beanstalkd task to create homedir for the new ftp user and pass the ftp user name used in the SELECT query.
  3. The FTP server would check beanstalkd and find out it has a task to perform.
  4. The FTP server would query the db for the details associated with the new ftp user. (e.g. homedir, UID,GID,etc)
  5. The FTP server would create the new user's homedir and chown it to the UID and GID in the database.

So to make my questions crystal clear:

  1. Should the UID and GID be unique to the new ftp user?
  2. And if so, in the context of ProFTPD auth from MySQL, is there an easy way to get MySQL to AUTO_INCREMENT the new values starting at 5500 and 5500 respectively?

Thanks!

Solution

  • For auto-incrementing using MySQL, you can define the UID and GID columns, in your users table, as using the AUTO_INCREMENT MySQL keyword.

    In general, it is best to have separate UID and GID values for your users. This helps ensure that filesystem access/permissions to those files are unique/separate. If you re-used the same UID/GID for all your users, it is like having one user with multiple working passwords -- to the filesystem, all the files and directories would be owned by, and accessible to, the same user, regardless of how they logged in. A mistaken configuration would allow one user to access another user's files, because to the filesystem (which only cares about UIDs/GIDs, not names), they are all the same.

    As for creating the home directories, this can be automated/done in ProFTPD itself, using its CreateHome configuration directive.

    Hope this helps!