# Default Net::FTPServer configuration file.
# Normally this file resides in /etc/ftpd.conf, although you
# can override this by supplying a `-C filename' argument on
# the command line for ftpd.
#
# $Id: ftpd.conf,v 1.11 2000/08/21 15:16:51 rich Exp $

#----------------------------------------------------------------------
# Server configuration.

# Run with debugging. Equivalent to the command line -d option.
#
# Default: 0
#
# debug: 1

# Port number on which the FTP server listens when running in
# daemon mode (see the ``daemon mode'' option below).
#
# Default: ftp/tcp service port
#
# port: 8021

# Run as a daemon. If set, the FTP server will open a listening
# socket on its default port number, accept new connections and
# fork off a new process to handle each connection. If not set
# (the default), the FTP server will handle a single connection
# on stdin/stdout, which is suitable for use from inetd.
#
# The equivalent command line options are -s and -S.
#
# Default: 0
#
# daemon mode: 1

# Run in the background. If set, the FTP server will fork into
# the background before running.
#
# The equivalent command line option is -S.
#
# Default: 0
#
# run in background: 1

# Maintainer's email address.
#
# Default: root@<<hostname>>
#
# maintainer email: bob@example.com

# Timeout on control connection. If a command has not been
# received after this many seconds, the server drops the
# connection. You may set this to zero to disable timeouts
# completely (although this is not recommended).
#
# Default: 900 (seconds)
#
# timeout: 600

# Resource limits. These limits are applied to each child
# process and are important in avoiding denial of service (DoS)
# attacks against the FTP server.
#
# Resource            Default       Unit
# limit memory           8192       KBytes     Amount of memory per child
# limit nr processes        5       (none)     Number of processes
# limit nr files           20       (none)     Number of open files
#
# limit memory:       16384
# limit nr processes:    10
# limit nr files:        40

# Resolve addresses. If set, attempt to do a reverse lookup on
# client addresses for logging purposes. If you set this then
# some clients may experience long delays when they try to
# connect. Not recommended on high load servers.
#
# Default: 0
#
# resolve addresses: 1

# Require resolved addresses. If set, client addresses must validly resolve
# otherwise clients will not be able to connect. If you set this
# then some clients cannot connect, even though it is probably the
# fault of their ISP.
#
# Default: 0
#
# require resolved addresses: 1

# Greeting type. The greeting is printed before the user has logged in.
# Possible greeting types are:
#    full     Full greeting, including hostname and version number.
#    brief    Hostname only.
#    terse    Nothing
#    text     Display greeting from ``greeting text'' option.
# The SITE VERSION command can also reveal the version number. You
# may need to turn this off by setting ``allow site version command: 0''
# below.
#
# Default: full
#
# greeting type: text

# Greeting text. If the greeting type is set to ``text'' then this
# contains the text to display.
#
# Default: none
#
# greeting text: Hello. I'll be your server today.

# Welcome type. The welcome is printed after a user has logged in.
# Possible welcome types are:
#    normal   Normal welcome message: ``Welcome <<username>>.''
#    text     Take the welcome message from ``welcome text'' option.
#    file     Take the welcome message from ``welcome file'' file.
#
# Default: normal
#
# welcome type: text

# If ``welcome type'' is set to text, then this contains the text
# to be printed after a user has logged in.
#
# You may use the following % escape sequences within the welcome
# text to substitute for internal variables:
#
# %C  current working directory
# %E  maintainer's email address (from ``maintainer email'' setting above)
# %G  time in GMT
# %R  remote hostname or IP address if ``resolve addresses'' is not set
# %L  local hostname
# %m  user's home directory (see ``home directory'' below)
# %T  local time
# %U  username given when logging in
# %u  currently a synonym for %U, but in future will be determined
#     from RFC931 authentication, like wu-ftpd
# %%  just an ordinary `%'
#
# Default: none
#
# welcome text: Welcome to this FTP server.

# If ``welcome type'' is set to file, then this contains the file
# to be printed after a user has logged in.
#
# You may use any of the % escape sequences defined in ``welcome text''
# above.
#
# Default: none
#
# welcome file: /etc/motd

# Home directory. This is the home directory where we put the
# user once they have logged in. This only applies to non-anonymous
# logins. Anonymous logins are always placed in "/", which is at the
# root of their chrooted environment.
#
# You may use an absolute path here, or else one of the following
# special forms:
#
# %m   Use home directory from password file or from NSS.
# %U   Username.
# %%   A single % character.
#
# For example, to force a user to start in ~/anon-ftp when they
# log in, set this to ``%m/anon-ftp''.
#
# Note that setting the home directory does not perform a chroot.
# Use the ``root directory'' setting below to jail users into a
# particular directory.
#
# Home directories are _relative_ to the current root directory.
#
# Default: %m
#
# home directory: %m/anon-ftp
# home directory: /

# Root directory. Immediately after logging in, perform a chroot
# into the named directory. This only applies to non-anonymous
# logins, and furthermore it only applies if you a non-database
# VFS installed. Database VFSes typically cannot perform chroot
# (or, to be more accurate, they have a different concept of
# chroot - typically assigning each user their own completely
# separate namespace).
#
# You may use %m and %U as above.
#
# For example, to jail a user under ~/anon-ftp after login, do:
#
#   home directory: /
#   root directory: %m/anon-ftp
#
# Notice that the home directory is _relative_ to the current
# root directory.
#
# Default: (none)
#
# root directory: %m/anon-ftp

# Local addresses. If you wish the FTP server (in daemon mode) to
# only bind to a particular local interface, then give its address
# here.
#
# Default: none
#
# local address: 127.0.0.1

# Allow anonymous access. If set, then allow anonymous access through
# the ``ftp'' and ``anonymous'' accounts.
#
# Default: 0
#
allow anonymous: 1

# Validate email addresses. Normally when logging in anonymously,
# you are asked to enter your email address as a password. These options
# can be used to check and enforce email addresses in this field (to
# some extent, at least -- you obviously can't force someone to
# enter a true email address).

# The ``anonymous password check'' option may be set to ``rfc822'',
# ``no browser'', ``trivial'' or ``none''. If set to ``rfc822'' then
# the user must enter a valid RFC 822 email address as password. If
# set to ``no browser'' then a valid RFC 822 email address must be
# entered, and various common browser email addresses like
# ``mozilla@'' and ``IE<ver>User@'' are refused. If set to ``trivial''
# then we just check that the address contains an @ char. If set to
# ``none'', then we do no checking. The default is ``none''.
#
# If the ``anonymous password enforce'' option is set and the
# password fails the check above, then the user will not be allowed
# to log in. The default is 0 (unset).
#
# These options only have effect when ``allow anonymous'' is set.
#
# anonymous password check: rfc822
# anonymous password enforce: 1

# Allow proxy FTP. If this is set, then the FTP server can be told to
# actively connect to addresses and ports on any machine in the world.
# This is not such a great idea, but required if you follow the RFC
# very closely. If not set (the default), the FTP server will only
# connect back to the client machine.
#
# Default: 0
#
# allow proxy ftp: 1

# Allow the FTP server to connect back to ports < 1024. This is rarely
# useful and could pose a serious security hole in some circumstances.
#
# Default: 0
#
# allow connect low port: 1

# Maximum number of login attempts before we drop the connection
# and issue a warning in the logs. Wu-ftpd defaults this to 5.
#
# Default: 3
#
# max login attempts: 5

# Use PAM for authentication. Required on systems such as Red Hat Linux
# and Solaris which use PAM for authentication rather than the normal
# /etc/passwd mechanisms. You will need to have the Authen-PAM Perl
# module installed for this to work.
#
# Default: 0
#
pam authentication: 1

# If PAM authentication is enabled, then this is the PAM application
# name. I have used ``ftp'' as the default which is the same name
# that wu-ftpd chooses.
#
# Default: ftp
#
# pam application name: ftpd

#----------------------------------------------------------------------
# Access control rules.
# 
# Access control rules are all specified as short snippets of
# Perl script. This allows the maximum configurability -- you
# can express just about any rules you want -- but at the price
# of learning a little Perl.
#
# You can use the following variables from the Perl:
#
# $hostname      Resolved hostname of the client [1]
# $ip            IP address of the client
# $user          User name [2]
# $user_is_anonymous  True if the user is an anonymous user [2]
# $pathname      Full pathname of the file being affected [2]
# $filename      Filename of the file being affected [2,3]
# $dirname       Directory name containing file being affected [2]
# $type          'A' for ASCII, 'B' for binary, 'L8' for local 8-bit
# $form          Always 'N'
# $mode          Always 'S'
# $stru          Always 'F'
#
# Notes:
#
# [1] May be undefined, particularly if ``resolve addresses'' is not set.
# [2] Not available in ``access control rule'' since the user has not
#     logged in at this point.
# [3] Not available for ``list directory rule''.

# Access control rule. The FTP server will not accept any connections
# from a site unless this rule succeeds. Note that only ``$hostname''
# and ``$ip'' are available to this rule, and unless ``resolve addresses''
# and ``require resolved addresses'' are both set ``$hostname'' may
# be undefined.
#
# Default: 1
#
# Examples:
#
#   (a) Deny connections from *.badguys.com:
#
#       access control rule: defined ($hostname) && \
#                            $hostname !~ /\.badguys\.com$/
#
#   (b) Only allow connections from local network 10.0.0.0/24:
#
#       access control rule: $ip =~ /^10\./
#
# access control rule: ...

# User access control rule. After the user logs in successfully,
# this rule is then called to determine if the user may be permitted
# access.
#
# Default: 1
#
# Examples:
#
#   (a) Only allow ``rich'' to log in from 10.x.x.x network:
#
#       user access control rule: $user ne "rich" || \
#                                 $ip =~ /^10\./
#
#   (b) Only allow anonymous users to log in if they come from
#       hosts with resolving hostnames (``resolve addresses'' must
#       also be set):
#
#       user access control rule: !$user_is_anonymous || defined ($hostname)
#
#   (c) Don't allow user ``jeff'' to log in at all:
#
#       user access control rule: $user ne "jeff"
#
# user access control rule: ...

# Retrieve rule. This rule controls who may retrieve (download) files.
#
# Default: 1
#
# Examples:
#
#   (a) Don't allow anyone to retrieve ``/etc/*'' or any file anywhere
#       called ``.htaccess'':
#
#       retrieve rule: $dirname !~ m|^/etc/| && $filename ne ".htaccess"
#
#   (b) Only allow anonymous users to retrieve files from under the
#       ``/pub'' directory.
#
#       retrieve rule: !$user_is_anonymous || $dirname =~ m|^/pub/|
#
retrieve rule: $pathname ne "/etc/passwd" && $filename ne ".htaccess"

# Store rule. This rule controls who may store (upload) files.
#
# Default: 1
#
# Examples:
#
#   (a) Only allow users to upload files to the ``/incoming'' directory.
#
#       store rule: $dirname =~ m|^/incoming/|
#
#   (b) Disable file upload.
#
#       store rule: 0
#
store rule: !$user_is_anonymous || $dirname =~ m|^/incoming/|

# Delete rule. This rule controls who may delete files or rmdir directories.
#
# Default: 1
#
# delete rule: 0

# List rule. This rule controls who may list out the contents of a
# directory.
#
# Default: 1
#
# list rule: $dirname =~ m|^/pub/|

# Mkdir rule. This rule controls who may create a subdirectory.
#
# Default: 1
#
# mkdir rule: 0

#----------------------------------------------------------------------
# Customize internal commands.

# Change directory message file. If set, then the first time (per
# session) that a user goes into a directory which contains a file
# matching this name, that file will be displayed.
#
# The file may contain any of the % escape sequences available.
# See ``welcome text'' documentation above.
#
# Default: (none)
#
chdir message file: .message

# Allow the rename (RNFR/RNTO) command to overwrite files. If unset,
# then we try to test whether the rename command would overwrite a
# file and disallow it. However there are some race conditions with
# this test.
#
# Default: 1
#
# allow rename to overwrite: 0

# Allow the store commands (STOR/STOU/APPE) to overwrite files. If unset,
# then we try to test whether the store command would overwrite a
# file and disallow it. However there are some race conditions with
# this test.
#
# Default: 1
#
# allow store to overwrite: 0

#----------------------------------------------------------------------
# Directory aliases, cdpath, etc.

# Define an alias <name> for directory <dir>. For example, the command
# ``alias: mirror /pub/mirror'' would allow the user to access the
# ``/pub/mirror'' directory directly just by using ``cd mirror''.
#
# Aliases only apply to the cd (CWD) command. The ``cd foo'' command checks
# for directories in the following order:
#
#   foo in the current directory
#   an alias called foo
#   foo in each directory in the cdpath (see ``cdpath'' command below)
#
# You may list an many aliases as you want.
#
# Alias names cannot contain slashes (/).
#
# Although alias dirs may start without a slash (/), this is unwise and
# it's better that they always start with a slash (/) char.
#
# alias: <name> <dir>

# Define a search path which is used when changing directories. For
# example, the command ``cdpath: /pub/mirror /pub/sites'' would allow
# the user to access the ``/pub/mirror/ftp.cpan.org'' directory
# directly by just typing ``cd ftp.cpan.org''.
#
# The ``cd foo'' command checks for directories in the following order:
#
#   foo in the current directory
#   an alias called foo (see ``alias'' command above)
#   foo in each directory in the cdpath
#
# cdpath: <dir1> [<dir2> [<dir3> ...]]

#----------------------------------------------------------------------
# SITE commands.

# SITE VERSION command. If set, then the SITE VERSION command reveals
# the current Net::FTPServer version string. If unset, then the command
# is disabled.
#
# Default: 1
#
# allow site version command: 0

# SITE EXEC command. If set, then the SITE EXEC command allows arbitrary
# commands to be executed on the server as the current user. If unset,
# then this command is disabled. The default is disabled for obvious
# security reasons.
#
# Default: 0
#
# allow site exec command: 1

#----------------------------------------------------------------------
# Rarely-used configuration options.

# Socket type for contacting syslog. This is the argument to
# the Sys::Syslog::setlogsock function.
#
# Default: unix
#
# log socket type: inet

# Length of the listen queue when running in daemon mode.
#
# Default: 10
#
# listen queue: 20

# Set TCP window. See RFC 2415 "Simulation Studies of Increased
# Initial TCP Window Size". This setting only affects the data
# socket. It's not likely that you will need to or should change
# this setting from the system-specific default.
#
# Default: (system-specific TCP window size)
#
# tcp window: 4380

# Set TCP keepalive.
#
# Default: (system-specific keepalive setting)
#
# tcp keepalive: 1

# Command filter. If set, then all commands are checked against
# this regular expression before being executed. If a command
# doesn't match the filter, then the command connection is
# immediately dropped. This is equivalent to the "AllowFilter"
# command in ProFTPD. Remember to include ^...$ around the filter.
#
# Default: (no filter)
#
# command filter: ^[A-Za-z0-9 /]+$

# Go slow. If set, then the FTP will sleep for this many seconds
# before beginning to process each command. This command would be
# a lot more useful if you could apply it only to particular
# classes of connection.
#
# Default: 0
#
# command wait: 5
