/*
 * In order proftpd to work correctly you should execute proftpd
 * either from inetd or in standalone mode with non-zero UID.
 * In the example below this is 70. This UID is kept until 
 * authorization process is finished. After that, proftpd changes
 * its UID and _drops_ all capabilities leaving only CAP_NET_BIND_SERVICE
 * that is needed to bind TCP/IP port 20 required by FTP protocol
 * in passive mode transfer.
 *
 * WARNING:
 * YOU SHOULD NOT EXECUTE YOUR PROFTPD AS FTP USER IF YOU HAVE ANONYMOUS
 * FTP ACCESS.
 * PROFTPD MUST CHANGE ITS UID IN ORDER TO DROP ITS CAPABILITIES !!
 */

/usr/sbin/proftpd {
	uid proftpd
	gid proftpd
	groups no
	
	chkchroot yes
	chksetuid yes		// it's a good idea to restrict set*uid
	clrenv yes
	rootdir default

	cap set empty
	cap effective set {
		bind		// Only for standalone mode
		chroot
		setuid setgid
		dacrs		// kernel up to 2.2.16 is broken
				// use ,,dac'' instead for these kernels
				// This is for PAM authorization
	}
	
	bindtcp 21		// Only for standalone mode
	
	uidcap effective set {
		bind		// Needed to bind tcp port 20
	}

	exec deny all		// proftpd doesn't need external programs
}

/usr/sbin/proftpd {
	bindtcp 20		// This is O.K. since proftpd started by
				// non-privileged user does not have
				// CAP_NET_BIND_SERVICE capability at all
}
