From abdf14eb923e9d5cb19515edecb8095f8618735e Mon Sep 17 00:00:00 2001 From: Roy Li Date: Fri, 6 Dec 2013 16:34:16 +0800 Subject: [PATCH] proftpd: use /bin/false as the login shell and add home-dir Use /bin/false as the login shell, just like what Ubuntu does, otherwise there might be secure issue; add /var/lib/ftp as user ftp home-dir. (From meta-openembedded rev: ac3a5d430139e3be08718770e4439032ad3091eb) Signed-off-by: Roy Li Signed-off-by: Joe MacDonald Signed-off-by: Patrick Ohly --- .../files/close-RequireValidShell-check.patch | 27 ++++++++++++++++++++++ .../recipes-daemons/proftpd/proftpd_1.3.4b.bb | 4 +++- 2 files changed, 30 insertions(+), 1 deletion(-) create mode 100644 meta-openembedded/meta-networking/recipes-daemons/proftpd/files/close-RequireValidShell-check.patch diff --git a/meta-openembedded/meta-networking/recipes-daemons/proftpd/files/close-RequireValidShell-check.patch b/meta-openembedded/meta-networking/recipes-daemons/proftpd/files/close-RequireValidShell-check.patch new file mode 100644 index 0000000..c64535c --- /dev/null +++ b/meta-openembedded/meta-networking/recipes-daemons/proftpd/files/close-RequireValidShell-check.patch @@ -0,0 +1,27 @@ +close RequireValidShell check + +Upstream-Status: Inappropriate [configuration] + +close RequireValidShell check since we like to make /bin/false as shell +for ftp user + +Signed-off-by: Roy Li +--- + sample-configurations/basic.conf | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/sample-configurations/basic.conf b/sample-configurations/basic.conf +index 314eb79..abcb284 100644 +--- a/sample-configurations/basic.conf ++++ b/sample-configurations/basic.conf +@@ -53,6 +53,7 @@ AllowOverwrite on + # We want clients to be able to login with "anonymous" as well as "ftp" + UserAlias anonymous ftp + ++ RequireValidShell off + # Limit the maximum number of anonymous logins + MaxClients 10 + +-- +1.7.10.4 + diff --git a/meta-openembedded/meta-networking/recipes-daemons/proftpd/proftpd_1.3.4b.bb b/meta-openembedded/meta-networking/recipes-daemons/proftpd/proftpd_1.3.4b.bb index 6537b77..eb502d6 100644 --- a/meta-openembedded/meta-networking/recipes-daemons/proftpd/proftpd_1.3.4b.bb +++ b/meta-openembedded/meta-networking/recipes-daemons/proftpd/proftpd_1.3.4b.bb @@ -13,6 +13,7 @@ SRC_URI = "ftp://ftp.proftpd.org/distrib/source/${BPN}-${PV}.tar.gz \ file://proftpd-basic.init \ file://default \ file://move-pidfile-to-var-run.patch \ + file://close-RequireValidShell-check.patch \ " SRC_URI[md5sum] = "0871e0b93c9c3c88ca950b6d9a04aed2" @@ -62,6 +63,7 @@ INITSCRIPT_PARAM = "defaults 85 15" USERADD_PACKAGES = "${PN}" GROUPADD_PARAM_${PN} = "--system ${FTPGROUP}" -USERADD_PARAM_${PN} = "--system -g ${FTPGROUP} ${FTPUSER}" +USERADD_PARAM_${PN} = "--system -g ${FTPGROUP} --home-dir /var/lib/${FTPUSER} --no-create-home \ + --shell /bin/false ${FTPUSER}" FILES_${PN} += "/home/${FTPUSER}" -- 2.7.4