Next Previous Contents

6. Security

6.1 User, Group and Chroot

Unless compiled with --enable-run-as-root you must specify a non root user and group for frox to run as. It is strongly recommended that you do this rather than recompiling.

You must specify WorkingDir for frox in the config file. By default it will also chroot to this directory. If you do not wish to run chrooted you must explicitly set DontChroot to "yes" in the config file.

6.2 Access control lists

Access to frox is controlled by the access control lists in the config file. These take the format

        ACL ACTION CLIENT - SERVER [PORTS]
        
ACTION can be one of Deny or Allow. CLIENT and SERVER are either a domain name, a *, an ip address, or an address/netmask in either x.x.x.x/y or x.x.x.x/y.y.y.y form. PORTS is optional. If present it should contain one or more port numbers or ranges of port numbers, separated by ",". There should be no whitespace within the PORTS string. If no ports are specified then ports are not taken into account in matching that rule.

Acls are checked after the client has connected to frox, but before frox connects to the server. If non-transparent proxying is enabled then the client will enter the username before the acl is checked. The acls are checked in the order they appear in the config file until one matches. If no acls match the connection is denied.

6.3 Command Control Program

Frox has optional support for a ftp-proxy like command control program (ccp). This is a a bit of a rip off of the ftp-proxy system, but someone requested it so it's gone in. To use this you should compile with --enable-ccp, and set CCProgram to the program to use. This must be within the chroot jail with any libraries and/or shells it needs to run.

The ccp will then be called for every command that the client sends. It will not be called for any commands that frox decides to send itself (eg. as part of determining whether a file is suitable for caching). It can make use of the following environment variables:

        FROX_CLIENT, FROX_SERVER: Ip addresses of client and server.
        FROX_SERVERNAME:          Server's domain name if known.
        FROX_SESSION:             Unique string for this session.
        FROX_COMMAND:             FTP command just given.
        FROX_PARAMATER:           Argument to that command.
        
With a new connection the ccp will be called with the special FROX_COMMAND of +NEW. The server variables may subsequently change if a user name is given which contains a different server to contact.

If the ccp exits with a value of 0 then the command is dealt with as normal. If it exits with 1 then the command is discarded. If it exits with 2 then the session is closed. If the ccp writes a line to stderr then it will be sent to the client over the control connection. If it writes a line to stdout it will be logged by frox. If the ccp returns a value other than 0 it is its responsibility to write a well formed ftp message to the client which tells it what is happening (eg. from a shell script by echo -ne "533 Permission denied\r\n" >&2) . Failure to do this will result in the client and proxy getting out of sync.


Next Previous Contents