Unless compiled with --enable-run-as-root you must specify a non root user and group for frox to run as. It is strongly recommended that you do this rather than recompiling.
You must specify WorkingDir for frox in the config file. By default it will also chroot to this directory. If you do not wish to run chrooted you must explicitly set DontChroot to "yes" in the config file.
Access to frox is controlled by the access control lists in the config file. These take the format
ACL ACTION CLIENT - SERVER [PORTS]
ACTION
can be one of Deny
or Allow
.
CLIENT
and SERVER
are either a domain name,
a *
, an ip address, or an address/netmask in either
x.x.x.x/y
or x.x.x.x/y.y.y.y
form.
PORTS
is optional. If present it should contain one
or more port numbers or ranges of port numbers, separated by
",". There should be no whitespace within the
PORTS
string. If no ports are specified then ports
are not taken into account in matching that rule.
Acls are checked after the client has connected to frox, but before frox connects to the server. If non-transparent proxying is enabled then the client will enter the username before the acl is checked. The acls are checked in the order they appear in the config file until one matches. If no acls match the connection is denied.
Frox has optional support for a ftp-proxy like command
control program (ccp). This is a a bit of a rip off of the
ftp-proxy system, but someone requested it so it's gone in. To
use this you should compile with --enable-ccp
, and
set CCProgram
to the program to use. This must be
within the chroot jail with any libraries and/or shells it
needs to run.
The ccp will then be called for every command that the client sends. It will not be called for any commands that frox decides to send itself (eg. as part of determining whether a file is suitable for caching). It can make use of the following environment variables:
FROX_CLIENT, FROX_SERVER: Ip addresses of client and server. FROX_SERVERNAME: Server's domain name if known. FROX_SESSION: Unique string for this session. FROX_COMMAND: FTP command just given. FROX_PARAMATER: Argument to that command.With a new connection the ccp will be called with the special
FROX_COMMAND
of +NEW
. The server variables
may subsequently change if a user name is given which contains
a different server to contact.
If the ccp exits with a value of 0 then the command is dealt with as normal. If it exits with 1 then the command is discarded. If it exits with 2 then the session is closed. If the ccp writes a line to stderr then it will be sent to the client over the control connection. If it writes a line to stdout it will be logged by frox. If the ccp returns a value other than 0 it is its responsibility to write a well formed ftp message to the client which tells it what is happening (eg. from a shell script by echo -ne "533 Permission denied\r\n" >&2) . Failure to do this will result in the client and proxy getting out of sync.