Proftpd connexion limitation rule by user

Question

We are currently defining in the Global scope of our ProFTPd server the following lines:

# Allow max 3 unauthenticated connections by IP
MaxConnectionsPerHost 3 "Sorry, you may not connect more than (%m) times."
# Allow max 3 authenticated connections by IP
MaxClientsPerHost 3 "Sorry, the maximum number clients (%m) from your    host are already connected."
# Allow max 10 connection by user
###### MaxClientsPerUser 10 "Sorry, there is already (%m) other connection for this account."

It works as attended but we would like to allow some specific (not all) authenticated users (or IPs as drawback), to open more connections than the ones specified upper.

Is that possible with ProFTPd ?

Yes -> any help would be appreciated.

No -> Is there any other Production grade free FTP server like PureFTP or vsftpd maybe, that fit these requirement ?

Castaglia · Accepted Answer · 2016-09-09T18:10:16.817

Yes, this is possible, using the mod_ifsession's <IfUser> and <IfClass> sections.

Using the <IfUser> section, you would define user-specific sections, like so:

<IfUser user1, user2, user3>
  # Special users get special treatment
  MaxConnectionsPerHost 30
  MaxClientsPerHost 30
  MaxClientsPerUser 100
<IfUser>

<IfUser AND !user1, !user2, !user3>
  # All other users get the normal treatment
  MaxConnectionsPerHost 3
  MaxClientsPerHost 3
  MaxClientsPerUser 10
</IfUser>

If you have many users, you might also consider using groups rather than individual user names, and the <IfGroup> section.

For restrictions by IP address/range, I would recommend using ProFTPD's classes. With classes, and the <IfClass> section from mod_ifsession, you can do something like this:

<Class special-ips>
  From 1.2.3.4
  From a.b.c.d
</Class

<IfClass special-ips>
  # Clients from the special class get special treatment
  MaxConnectionsPerHost 30
  MaxClientsPerHost 30
  MaxClientsPerUser 100
</IfClass>

<IfClass !special-ips>
  # All other clients get the normal treatment
  MaxConnectionsPerHost 3
  MaxClientsPerHost 3
  MaxClientsPerUser 10
</IfClass>

Note that it is a very good idea to define both the "matching" rules and the "not matching" rules.

The ProFTPD Connection ACLS howto also covers this topic, and mentions other modules (e.g. mod_wrap2, mod_geoip) which can also help in this area.

Hope this helps!

Proftpd connexion limitation rule by user

1 Answers1