trAvis - MANAGER

Edit File: mod_ifsession.html

<html>
<head>
<title>ProFTPD module mod_ifsession</title>
</head>

<hr>
<center>
<h2>ProFTPD module <code>mod_ifsession</code></h2>
</center>
<hr>

The purpose of <code>mod_ifsession</code> is to provide a flexible way of
specifying that certain configuration directives only apply to certain sessions,
based on credentials such as connection class, user, or group membership.

For class-based qualifications, <code>mod_ifsession</code> will apply 
configuration directives to the current session as soon as the client has
connected to the server; for user- and group-based qualifications,
<code>mod_ifsession</code> applies configuration directives to the current
session, if applicable, only after the client has successfully authenticated.
This means that <code>mod_ifsession</code> cannot change the effect of some
user- and group-qualified configuration directives, particularly those that
influence the session prior to authentication. These directives include:
<pre>
 AccessDenyMsg
 AccessGrantMsg
 AnonRequirePassword
 &lt;Anonymous&gt;
 AuthGroupFile
 AuthUserFile
 CreateHome
 DefaultChdir
 DefaultRoot
 DefaultTransferMode
 DisplayConnect
 ExtendedLog
 MaxInstances
 RequireValidShell
 RootLogin
 ServerIdent
 ServerName
 ShowSymlinks
 TransferLog
 UseFtpUsers
 WtmpLog
</pre>
and the directives from the <code>mod_auth_pam</code> module. All of these
can set on based on class qualifications, however.

While the above list of configuration directives is daunting, there are
still valid uses for this module, e.g. configuring
<code>&lt;Directory&gt;</code> and/or <code>&lt;Limit&gt;</code> for certain
sessions, <code>Filter</code> directives, transfer rates, maximum file sizes,
etc. Plus, some of the above directives (e.g. <code>DefaultChdir</code>,
<code>DefaultRoot</code>) already have their own configurable restrictions
(group expressions in the case of <code>DefaultChdir</code> and
<code>DefaultRoot</code>), so all is not entirely lost.

This module is contained in the <code>contrib/mod_ifsession.c</code> file for
ProFTPD 1.2.x/1.3.x, and is not compiled by default.
Installation instructions are discussed <a href="#Installation">here</a>.

The most current version of <code>mod_ifsession</code> is distributed with
the ProFTPD source.

<h2>Author</h2>

Please contact TJ Saunders &lt;tj at castaglia.org&gt; with any
questions, concerns, or suggestions regarding this module.

<h2>Directives</h2>
<ul>
 <li><a href="#IfAuthenticated">&lt;IfAuthenticated&gt;</a>
 <li><a href="#IfClass">&lt;IfClass&gt;</a>
 <li><a href="#IfGroup">&lt;IfGroup&gt;</a>
 <li><a href="#IfUser">&lt;IfUser&gt;</a>
</ul>

<hr>
<h2><a name="IfAuthenticated">&lt;IfAuthenticated&gt;</a></h2>
Syntax: &lt;IfAuthenticated&gt; 
Default: None 
Context: server config, <code>&lt;VirtualHost&gt;</code>, <code>&lt;Global&gt;</code> 
Module: mod_ifsession 
Compatibility: 1.3.5rc1 and later

The <code>&lt;IfAuthenticated&gt;</code> context should contain any
configuration directives that should be in effect for any sessions where
the client has successfully authenticated.

Examples:
<pre>
 # Only configure SQL logging for authenticated users, to avoid cluttering
 # database tables with fail login data
 &lt;IfAuthenticated&gt;
 SQLLog ...
 &lt;/IfAuthenticated&gt;
</pre>

See also: <a href="#IfGroup">&lt;IfGroup&gt;</a>, <a href="#IfUser">&lt;IfUser&gt;</a>

<hr>
<h2><a name="IfClass">&lt;IfClass&gt;</a></h2>
Syntax: &lt;IfClass [&quot;AND&quot;|&quot;OR&quot;] class-expression|&quot;regex&quot; regexp&gt; 
Default: None 
Context: server config, <code>&lt;VirtualHost&gt;</code>, <code>&lt;Global&gt;</code> 
Module: mod_ifsession 
Compatibility: 1.2.8rc1 and later

The <code>&lt;IfClass&gt;</code> context should contain any configuration
directives that should be in effect for any sessions that match the
class-expression. <code>Classes</code> must be enabled for this
context to work properly; the connecting client must be in any of the classes
listed in the expression for the directives contained to be applied. Note
that <code>!</code> notation in front of a class name in the expression is
supported.

The given class-expression may optionally be prefixed
with either the &quot;AND&quot; or &quot;OR&quot; keywords, which affect how
the expression is evaluated: if &quot;AND&quot; is used, then all
portions of the expression must evaluate to TRUE for the configuration context
to be applied to the current session; if &quot;OR&quot; is used, then any
portion of the expression must be TRUE for the context to be applied. The
default setting for <code>&lt;IfClass&gt;</code> is &quot;OR&quot;.

If the &quot;regex&quot; keyword is used, the regexp should be a
regular expression to match class names.

Examples:
<pre>
 # Give friends, and local users, better transfer rates
 &lt;IfClass local, friends&gt;
 TransferRate RETR 8192
 &lt;/IfClass&gt;

TransferRate RETR 4096
</pre>

See also: <a href="#IfGroup">&lt;IfGroup&gt;</a>, <a href="#IfUser">&lt;IfUser&gt;</a>

<hr>
<h2><a name="IfGroup">&lt;IfGroup&gt;</a></h2>
Syntax: &lt;IfGroup [&quot;AND&quot;|&quot;OR&quot;] group-expression|&quot;regex&quot; regexp&gt; 
Default: None 
Context: server config, <code>&lt;VirtualHost&gt;</code>, <code>&lt;Global&gt;</code> 
Module: mod_ifsession 
Compatibility: 1.2.8rc1 and later

The <code>&lt;IfGroup&gt;</code> context should contain any configuration
directives that should be in effect for any sessions that match the
group-AND-expression. The authenticated user must be in all of
the groups listed in the expression for the directives contained to be
applied. Note that <code>!</code> notation in front of a group name in the
expression is supported.

The given group-expression may optionally be prefixed
with either the &quot;AND&quot; or &quot;OR&quot; keywords, which affect how
the expression is evaluated: if &quot;AND&quot; is used, then all
portions of the expression must evaluate to TRUE for the configuration context
to be applied to the current session; if &quot;OR&quot; is used, then any
portion of the expression must be TRUE for the context to be applied. The
default setting for <code>&lt;IfGroup&gt;</code> is &quot;AND&quot;.

If the &quot;regex&quot; keyword is used, the regexp should be a
regular expression to match group names.

Example:
<pre>
 # Only members of group webusers can upload/download HTML files
 &lt;IfGroup !webusers&gt;
 PathDenyFilter \.htm$|\.html$
 &lt;/IfGroup&gt;
</pre>

See also: <a href="#IfClass">&lt;IfClass&gt;</a>, <a href="#IfUser">&lt;IfUser&gt;</a>

<hr>
<h2><a name="IfUser">&lt;IfUser&gt;</a></h2>
Syntax: &lt;IfUser [&quot;AND&quot;|&quot;OR&quot;] user-expression|&quot;regex&quot; regexp&gt; 
Default: None 
Context: server config, <code>&lt;VirtualHost&gt;</code>, <code>&lt;Global&gt;</code> 
Module: mod_ifsession 
Compatibility: 1.2.8rc1 and later

The <code>&lt;IfUser&gt;</code> context should contain any configuration
directives that should be in effect for any sessions that match the
user-OR-expression. The authenticated user must be one of the users
listed in the expression for the directives contained to be applied. Note
that <code>!</code> notation in front of a user name in the expression is
supported.

The given user-expression may optionally be prefixed
with either the &quot;AND&quot; or &quot;OR&quot; keywords, which affect how
the expression is evaluated: if &quot;AND&quot; is used, then all
portions of the expression must evaluate to TRUE for the configuration context
to be applied to the current session; if &quot;OR&quot; is used, then any
portion of the expression must be TRUE for the context to be applied. The
default setting for <code>&lt;IfUser&gt;</code> is &quot;OR&quot;.

If the &quot;regex&quot; keyword is used, the regexp should be a
regular expression to match user names.

Example:
<pre>
 # Alter the view of files for everyone except the admin
 &lt;IfUser !ftpadm&gt;
 &lt;Directory /&gt;
 DirFakeUser on ~
 DirFakeGroup on ~
 DirFakeMode 0440
 &lt;/Directory&gt;
 &lt;/IfUser&gt;

# Impose a PathDenyFilter on ftp users
 &lt;IfUser regex ^ftp&gt;
 PathDenyFilter \.conf$
 &lt;/IfUser&gt;
</pre>

See also: <a href="#IfClass">&lt;IfClass&gt;</a>, <a href="#IfGroup">&lt;IfGroup&gt;</a>

<hr>
<h2><a name="Usage">Usage</a></h2>

As a Shared Module 
If your <code>proftpd</code> is compiled with <code>mod_ifsession</code>
as a shared module, then you must make sure that
<code>mod_ifsession</code> is loaded last:
<pre>
 &lt;IfModule mod_dso.c&gt;
 LoadModule mod_sql.c
 LoadModule mod_sql_mysql.c
 LoadModule mod_tls.c
 LoadModule mod_rewrite.c
 LoadModule mod_ifsession.c
 &lt;/IfModule&gt;
</pre>
Failure to ensure that <code>mod_ifsession</code> is loaded last will mean
that the per-user/group/class functionality will not work as you expect.

Todo 
Expressions, AND vs OR

<hr>
<h2><a name="Installation">Installation</a></h2>
To install <code>mod_ifsession</code>, copy the <code>mod_ifsession.c</code>
file into:
<pre>
 proftpd-dir/contrib/
</pre>
after unpacking the latest proftpd-1.3.x source code. Then follow the
usual steps for using third-party modules in proftpd:
<pre>
 ./configure --with-modules=mod_ifsession
 make
 make install
</pre>
Note that <code>mod_ifsession</code> should be the last module
in the <code>--with-modules</code> list, if multiple modules are listed.
This makes sure that <code>mod_ifsession</code>'s changes will be seen
properly by other modules.

To build <code>mod_ifsession</code> as a DSO module:
<pre>
 ./configure --enable-dso --with-shared=mod_ifsession
</pre>
Then follow the usual steps:
<pre>
 make 
 make install
</pre>

Alternatively, if your proftpd was compiled with DSO support, you can
use the <code>prxs</code> tool to build <code>mod_ifsession</code> as a shared
module:
<pre>
 prxs -c -i -d mod_ifsession.c
</pre>

<hr>

Author: $Author: castaglia $ 
Last Updated: $Date: 2013-08-14 21:40:17 $

<hr>

<hr>

</body>
</html>