source: src/router/proftpd/doc/contrib/mod_exec.html @ 17876

Last change on this file since 17876 was 17876, checked in by BrainSlayer, 18 months ago

update proftp
File size: 23.3 KB
Line 
1<!-- $Id: mod_exec.html,v 1.7 2011/09/02 17:23:12 castaglia Exp $ -->
2<!-- $Source: /cvsroot/proftp/proftpd/doc/contrib/mod_exec.html,v $ -->
3
4<html>
5<head>
6<title>ProFTPD module mod_exec</title>
7</head>
8
9<body bgcolor=white>
10
11<hr><br>
12<center>
13<h2><b>ProFTPD module <code>mod_exec</code></b></h2>
14</center>
15<hr><br>
16
17This module is contained in the <code>mod_exec.c</code> file for
18ProFTPD 1.3.<i>x</i>, found
19<a href="http://www.castaglia.org/proftpd/">here</a>, and is not compiled by
20default.  Installation instructions are discussed
21<a href="#Installation">here</a>.
22
23<p>
24The <code>mod_exec</code> module can be used to execute external programs
25or scripts at various points in the process of handling FTP commands.  By
26conscious design, the core ProFTPD engine does not and will not execute
27external programs.  This is a security decision, as it was decided not to allow
28ProFTPD to serve as a means of compromising a system or disclosing information
29via bugs in external programs or scripts.  Use of this module allows for such
30external programs to be executed, and also opens up the server to the
31mentioned possibilities of compromise or disclosure via those programs.
32
33<p>
34<center>
35  <b>YOU HAVE BEEN WARNED</b><br>
36  <b>USE AT YOUR OWN RISK</b><br>
37</center>
38
39<p>
40Please read the <a href="#Usage">usage</a> section to know the other caveats
41with this module.
42
43<p>
44The most current version of <code>mod_exec</code> is distributed with the
45ProFTPD source code.
46
47<h2>Author</h2>
48<p>
49Please contact TJ Saunders &lt;tj <i>at</i> castaglia.org&gt; with any
50questions, concerns, or suggestions regarding this module.
51
52<h2>Directives</h2>
53<ul>
54  <li><a href="#ExecBeforeCommand">ExecBeforeCommand</a>
55  <li><a href="#ExecEngine">ExecEngine</a>
56  <li><a href="#ExecEnviron">ExecEnviron</a>
57  <li><a href="#ExecLog">ExecLog</a>
58  <li><a href="#ExecOnCommand">ExecOnCommand</a>
59  <li><a href="#ExecOnConnect">ExecOnConnect</a>
60  <li><a href="#ExecOnError">ExecOnError</a>
61  <li><a href="#ExecOnEvent">ExecOnEvent</a>
62  <li><a href="#ExecOnExit">ExecOnExit</a>
63  <li><a href="#ExecOnRestart">ExecOnRestart</a>
64  <li><a href="#ExecOptions">ExecOptions</a>
65  <li><a href="#ExecTimeout">ExecTimeout</a>
66</ul>
67
68<hr>
69<h2><a name="ExecBeforeCommand">ExecBeforeCommand</a></h2>
70<strong>Syntax:</strong> ExecBeforeCommand <em>cmds path [arg1 arg2 ...]</em><br>
71<strong>Default:</strong> None<br>
72<strong>Context:</strong> &quot;server config&quot; <code>&lt;VirtualHost&gt;</code>, <code>&lt;Global&gt;</code>, <code>&lt;Anonymous&gt;</code>, <code>&lt;Directory&gt;</code><br>
73<strong>Module:</strong> mod_exec<br>
74<strong>Compatibility:</strong> 1.2.8 and later
75
76<p>
77The <code>ExecBeforeCommand</code> directive is used to execute the program or
78script at <i>path</i> <b>before</b> the handling of any FTP command listed
79in <i>cmds</i>, where <i>cmds</i> is a comma-delimited list of FTP commands.
80The command groups of the <code>&lt;Limit&gt;</code> directive, such as
81READ, WRITE, and ALL, may also be used.  The program will be executed with
82the privileges of the logged-in user.
83
84<p>
85Any number of arbitrary arguments may be configured to pass to the script.
86In addition, the &quot;cookies&quot; supported by the <code>ExecEnviron</code>
87directive may also be used in the script argument list.
88
89<p>
90<b>Important</b>: use of <code>DefaultRoot</code> will cause complications
91(to be elaborated upon soon).
92
93<p>
94Example:
95<pre>
96  ExecBeforeCommand RETR /path/to/ftp-prep --file %f
97</pre>
98
99<p>
100See Also:
101  <a href="#ExecEnviron">ExecEnviron</a>,
102  <a href="#ExecOnCommand">ExecOnCommand</a>,
103  <a href="#ExecOnConnect">ExecOnConnect</a>,
104  <a href="#ExecOnError">ExecOnError</a>,
105  <a href="#ExecOnExit">ExecOnExit</a>,
106  <a href="#ExecOnRestart">ExecOnRestart</a>,
107  <a href="http://www.proftpd.org/docs/directives/linked/config_ref_Limit.html">&lt;Limit&gt;</a>
108
109<p>
110<hr>
111<h2><a name="ExecEngine">ExecEngine</a></h2>
112<strong>Syntax:</strong> ExecEngine <em>on|off</em><br>
113<strong>Default:</strong> None<br>
114<strong>Context:</strong> &quot;server config&quot;, <code>&lt;VirtualHost&gt;</code>, <code>&lt;Global&gt;</code><br>
115<strong>Module:</strong> mod_exec<br>
116<strong>Compatibility:</strong> 1.2.5rc2 and later
117
118<p>
119The <code>ExecEngine</code> directive enables or disables the module's
120runtime exec engine.  If it is set to <em>off</em> this module will not
121manipulate environment variables or execute external scripts.  Use this
122directive to disable the module instead of commenting out all
123<code>mod_exec</code> directives.
124
125<p>
126<hr>
127<h2><a name="ExecEnviron">ExecEnviron</a></h2>
128<strong>Syntax:</strong> ExecEnviron <em>key value</em><br>
129<strong>Default:</strong> None<br>
130<strong>Context:</strong> &quot;server config&quot;, <code>&lt;VirtualHost&gt;</code>, <code>&lt;Global&gt;</code><br>
131<strong>Module:</strong> mod_exec<br>
132<strong>Compatibility:</strong> 1.2.5rc2 and later
133
134<p>
135The <code>ExecEnviron</code> directive is used to set the environment variables
136in the environment created for the script to be executed.  The current
137environment is not passed directly to the script; this is to prevent unwanted
138information leakage.  The given <i>key</i> parameter will be uppercased,
139to follow the convention for environment variable keys.
140
141<p>
142The <i>value</i> parameter may be any arbitrary string which may contain
143any of the following &quot;cookies&quot;, which will be substituted with the
144corresponding value before the script is executed:
145<ul>
146  <li><b>%A</b> - Anonymous login password
147  <li><b>%a</b> - client's IP address
148  <li><b>%C</b> - current working directory
149  <li><b>%c</b> - connection class
150  <li><b>%F</b> - transfered file as seen by client
151  <li><b>%f</b> - full transfered file path
152  <li><b>%g</b> - name of primary group of local user
153  <li><b>%h</b> - client's DNS name
154  <li><b>%m</b> - FTP command (e.g. RETR, STOR, etc)
155  <li><b>%r</b> - full FTP command
156  <li><b>%U</b> - original username sent by client
157  <li><b>%u</b> - name of local user
158  <li><b>%v</b> - name of server handling session
159  <li><b>%w</b> - RNFR path ("whence" a rename comes, <i>i.e.</i> the source path)
160</ul>
161The <i>value</i> parameter may be also be &quot;-&quot;, which indicates that
162the current value of the environment variable of name <i>key</i> should be
163used (<i>e.g.</i> PATH).  If there is no environment of name <i>key</i> when
164&quot;-&quot; is used, it will be created with a blank string as the value.
165
166<p>
167<hr>
168<h2><a name="ExecLog">ExecLog</a></h2>
169<strong>Syntax:</strong> ExecLog <em>file|&quot;none&quot;</em><br>
170<strong>Default:</strong> None<br>
171<strong>Context:</strong> &quot;server config&quot;, <code>&lt;VirtualHost&gt;</code>, <code>&lt;Global&gt;</code><br>
172<strong>Module:</strong> mod_exec<br>
173<strong>Compatibility:</strong> 1.2.5rc2 and later
174
175<p>
176The <code>ExecLog</code> directive is used to a specify a log file for
177<code>mod_exec</code> reporting and debugging, and can be done a per-server
178basis.  The <em>file</em> parameter must be the full path to the file to use for
179logging.  Note that this path must <b>not</b> be to a world-writeable
180directory and, unless <code>AllowLogSymlinks</code> is explicitly set to
181<em>on</em> (generally a bad idea), the path must <b>not</b> be a symbolic
182link.
183
184<p>
185If <em>file</em> is &quot;none&quot;, no logging will be done at all; this
186setting can be used to override an <code>ExecLog</code> setting inherited from
187a <code>&lt;Global&gt;</code> context.
188
189<p>
190<hr>
191<h2><a name="ExecOnCommand">ExecOnCommand</a></h2>
192<strong>Syntax:</strong> ExecOnCommand <em>cmds path [arg1 arg2 ...]</em><br>
193<strong>Default:</strong> None<br>
194<strong>Context:</strong> &quot;server config&quot; <code>&lt;VirtualHost&gt;</code>, <code>&lt;Global&gt;</code>, <code>&lt;Anonymous&gt;</code>, <code>&lt;Directory&gt;</code><br>
195<strong>Module:</strong> mod_exec<br>
196<strong>Compatibility:</strong> 1.2.5rc2 and later
197
198<p>
199The <code>ExecOnCommand</code> directive is used to execute the program or
200script at <i>path</i> <b>after</b> the successful completion of any FTP command
201listed in <i>cmds</i>, where <i>cmds</i> is a comma-delimited list of FTP
202commands.  The command groups of the <code>&lt;Limit&gt;</code> directive,
203such as READ, WRITE, and ALL, may also be used.  The program will be executed
204with the privileges of the logged-in user.
205
206<p>
207Any number of arbitrary arguments may be configured to pass to the script.
208In addition, the &quot;cookies&quot; supported by the <code>ExecEnviron</code>
209directive may also be used in the script argument list.
210
211<p>
212<b>Important</b>: use of <code>DefaultRoot</code> will cause complications
213(to be elaborated upon soon).
214
215<p>
216Example:
217<pre>
218  ExecOnCommand APPE,STOR /path/to/ftp-email-script --user %u --file %f
219</pre>
220
221<p>
222See Also:
223  <a href="#ExecBeforeCommand">ExecBeforeCommand</a>,
224  <a href="#ExecEnviron">ExecEnviron</a>,
225  <a href="#ExecOnConnect">ExecOnConnect</a>,
226  <a href="#ExecOnError">ExecOnError</a>,
227  <a href="#ExecOnExit">ExecOnExit</a>,
228  <A href="#ExecOnRestart">ExecOnRestart</a>,
229  <a href="http://www.proftpd.org/docs/directives/linked/config_ref_Limit.html">&lt;Limit&gt;</a>
230
231<p>
232<hr>
233<h2><a name="ExecOnConnect">ExecOnConnect</a></h2>
234<strong>Syntax:</strong> ExecOnConnect <em>path [arg1 arg2 ...]</em><br>
235<strong>Default:</strong> None<br>
236<strong>Context:</strong> &quot;server config&quot; <code>&lt;VirtualHost&gt;</code>, <code>&lt;Global&gt;</code>, <code>&lt;Anonymous&gt;</code>, <code>&lt;Directory&gt;</code><br>
237<strong>Module:</strong> mod_exec<br>
238<strong>Compatibility:</strong> 1.2.5rc2 and later
239
240<p>
241The <code>ExecOnConnect</code> directive is used to execute the program or
242script at <i>path</i> whenever a client connects to the server.  The program
243will be executed with the privileges of the contacted server, which are
244set via the <code>User</code>/<code>Group</code> directives.
245
246<p>
247Any number of arbitrary arguments may be configured to pass to the script.
248In addition, the &quot;cookies&quot; supported by the <code>ExecEnviron</code>
249directive may also be used in the script argument list.
250
251<p>
252Example:
253<pre>
254  ExecOnConnect /path/to/ftp-logger --ip %a --dns %h
255</pre>
256
257<p>
258See Also:
259  <a href="#ExecBeforeCommand">ExecBeforeCommand</a>,
260  <a href="#ExecEnviron">ExecEnviron</a>,
261  <a href="#ExecOnCommand">ExecOnCommand</a>,
262  <a href="#ExecOnError">ExecOnError</a>,
263  <a href="#ExecOnExit">ExecOnExit</a>,
264  <a href="#ExecOnRestart">ExecOnRestart</a>
265
266<p>
267<hr>
268<h2><a name="ExecOnError">ExecOnError</a></h2>
269<strong>Syntax:</strong> ExecOnError <em>cmds path [arg1 arg2 ...]</em><br>
270<strong>Default:</strong> None<br>
271<strong>Context:</strong> &quot;server config&quot; <code>&lt;VirtualHost&gt;</code>, <code>&lt;Global&gt;</code>, <code>&lt;Anonymous&gt;</code>, <code>&lt;Directory&gt;</code><br>
272<strong>Module:</strong> mod_exec<br>
273<strong>Compatibility:</strong> 1.2.5rc2 and later
274
275<p>
276The <code>ExecOnError</code> directive is used to execute the program or
277script at <i>path</i> if an error occurs while processing any FTP command listed
278in <i>cmds</i>, where <i>cmds</i> is a comma-delimited list of FTP commands.
279The command groups of the <code>&lt;Limit&gt;</code> directive, such as
280READ, WRITE, and ALL, may also be used.  The program will be executed with
281the privileges of the logged-in user.
282
283<p>
284Any number of arbitrary arguments may be configured to pass to the script.
285In addition, the &quot;cookies&quot; supported by the <code>ExecEnviron</code>
286directive may also be used in the script argument list.
287
288<p>
289<b>Important</b>: use of <code>DefaultRoot</code> will cause complications
290(to be elaborated upon soon).
291
292<p>
293Example:
294<pre>
295  ExecOnError APPE,STOR /path/to/ftp-cleanup-script --user %u --file %f
296</pre>
297
298See Also:
299  <a href="#ExecBeforeCommand">ExecBeforeCommand</a>,
300  <a href="#ExecEnviron">ExecEnviron</a>,
301  <a href="#ExecOnCommand">ExecOnCommand</a>,
302  <a href="#ExecOnConnect">ExecOnConnect</a>,
303  <a href="#ExecOnExit">ExecOnExit</a>,
304  <a href="#ExecOnRestart">ExecOnRestart</a>,
305  <a href="http://www.proftpd.org/docs/directives/linked/config_ref_Limit.html">&lt;Limit&gt;</a>
306
307<p>
308<hr>
309<h2><a name="ExecOnEvent">ExecOnEvent</a></h2>
310<strong>Syntax:</strong> ExecOnEvent <em>event[*] path [arg1 arg2 ...]</em><br>
311<strong>Default:</strong> None<br>
312<strong>Context:</strong> &quot;server config&quot;<br>
313<strong>Module:</strong> mod_exec<br>
314<strong>Compatibility:</strong> 1.2.10rc1 and later
315
316<p>
317The <code>ExecOnEvent</code> directive is used to execute the program or
318script at <i>path</i> when the given <em>event</em> occurs.  The program will
319be executed with the privileges of the server (set via the <code>User</code>
320and <code>Group</code> directives in the <code>proftpd.conf</code>file),
321unless the <em>event</em> name is followed by a &quot;*&quot;, in which case
322the program will be executed with root privileges.  <b>Note</b>: this
323feature should be used <b>very carefully</b>.  It allows scripts to
324modify things like firewall rules, but should be used <b>only</b> for
325such sensitive tasks.
326
327<p>
328Any number of arbitrary arguments may be configured to pass to the script.
329In addition, the &quot;cookies&quot; supported by the <code>ExecEnviron</code>
330directive may also be used in the script argument list.
331
332<p>
333Presently only two specific events are supported: <code>MaxConnectionRate</code>
334and <code>MaxInstances</code>.  These events happen when ever the limit
335configured by these configuration directives is reached.
336
337<p>
338This directive may be used several times to configure multiple programs
339to be invoked when <em>event</em> occurs.
340
341<p>
342<b>Important</b>: use of <code>DefaultRoot</code> will cause complications
343(to be elaborated upon soon).
344
345<p>
346Example:
347<pre>
348  ExecOnEvent MaxConnectionRate* /path/to/ftp-firewall-script --ip %a
349</pre>
350
351See Also:
352  <a href="#ExecBeforeCommand">ExecBeforeCommand</a>,
353  <a href="#ExecEnviron">ExecEnviron</a>,
354  <a href="#ExecOnCommand">ExecOnCommand</a>,
355  <a href="#ExecOnConnect">ExecOnConnect</a>,
356  <a href="#ExecOnExit">ExecOnExit</a>,
357  <a href="#ExecOnRestart">ExecOnRestart</a>
358
359<p>
360<hr>
361<h2><a name="ExecOnExit">ExecOnExit</a></h2>
362<strong>Syntax:</strong> ExecOnExit <em>path [arg1 arg2 ...]</em><br>
363<strong>Default:</strong> None<br>
364<strong>Context:</strong> &quot;server config&quot; <code>&lt;VirtualHost&gt;</code>, <code>&lt;Global&gt;</code>, <code>&lt;Anonymous&gt;</code>, <code>&lt;Directory&gt;</code><br>
365<strong>Module:</strong> mod_exec<br>
366<strong>Compatibility:</strong> 1.2.8 and later
367
368<p>
369The <code>ExecOnExit</code> directive is used to execute the program or
370script at <i>path</i> whenever a client disconnects to the server.  The program
371will be executed with the privileges of the contacted server, which are
372set via the <code>User</code>/<code>Group</code> directives.
373
374<p>
375Any number of arbitrary arguments may be configured to pass to the script.
376In addition, the &quot;cookies&quot; supported by the <code>ExecEnviron</code>
377directive may also be used in the script argument list.
378
379<p>
380Example:
381<pre>
382  ExecOnExit /path/to/ftp-logger --ip %a --dns %h
383</pre>
384
385<p>
386See Also:
387  <a href="#ExecBeforeCommand">ExecBeforeCommand</a>,
388  <a href="#ExecEnviron">ExecEnviron</a>,
389  <a href="#ExecOnCommand">ExecOnCommand</a>,
390  <a href="#ExecOnConnect">ExecOnConnect</a>,
391  <a href="#ExecOnError">ExecOnError</a>,
392  <a href="#ExecOnRestart">ExecOnRestart</a>
393
394<p>
395<hr>
396<h2><a name="ExecOnRestart">ExecOnRestart</a></h2>
397<strong>Syntax:</strong> ExecOnRestart <em>path [arg1 arg2 ...]</em><br>
398<strong>Default:</strong> None<br>
399<strong>Context:</strong> &quot;server config&quot; <code>&lt;VirtualHost&gt;</code>, <code>&lt;Global&gt;</code>, <code>&lt;Anonymous&gt;</code>, <code>&lt;Directory&gt;</code><br>
400<strong>Module:</strong> mod_exec<br>
401<strong>Compatibility:</strong> 1.2.5rc2 and later
402
403<p>
404The <code>ExecOnRestart</code> directive is used to execute the program or
405script at <i>path</i> whenever the server receives a <code>SIGHUP</code>
406signal.  The program will be executed with the privileges of the contacted
407server, which are set via the <code>User</code>/<code>Group</code> directives.
408
409<p>
410Any number of arbitrary arguments may be configured to pass to the script.
411In addition, the &quot;cookies&quot; supported by the <code>ExecEnviron</code>
412directive may also be used in the script argument list.
413
414<p>
415Example:
416<pre>
417  ExecOnRestart /path/to/ftp-counter-reset
418</pre>
419
420See Also:
421  <a href="#ExecBeforeCommand">ExecBeforeCommand</a>,
422  <a href="#ExecEnviron">ExecEnviron</a>,
423  <a href="#ExecOnCommand">ExecOnCommand</a>,
424  <a href="#ExecOnConnect">ExecOnConnect</a>,
425  <a href="#ExecOnError">ExecOnError</a>,
426  <a href="#ExecOnExit">ExecOnExit</a>
427
428<p>
429<hr>
430<h2><a name="ExecOptions">ExecOptions</a></h2>
431<strong>Syntax:</strong> ExecOptions <em>opt1 ...</em><br>
432<strong>Default:</strong> None<br>
433<strong>Context:</strong> &quot;server config&quot; <code>&lt;VirtualHost&gt;</code>, <code>&lt;Global&gt;</code><br>
434<strong>Module:</strong> mod_exec<br>
435<strong>Compatibility:</strong> 1.2.9rc2 and later
436
437<p>
438The <code>ExecOptions</code> directive is used to configure various optional
439behavior of <code>mod_exec</code>.
440
441<p>
442Example:
443<pre>
444  ExecOptions logStderr sendStdout
445</pre>
446
447<p>
448The currently implemented options are:
449<ul>
450  <li><code>logStderr</code><br>
451    <p>When executing commands, <code>mod_exec</code> usually ignore any
452    <code>stderr</code> output of the command.  If this option is enabled,
453    <code>mod_exec</code> will monitor for and log any <code>stderr</code>
454    from the executed command to the <code>ExecLog</code>.
455
456  <p>
457  <li><code>logStdout</code><br>
458    <p>When executing commands, <code>mod_exec</code> usually ignore any
459    <code>stdout</code> output of the command.  If this option is enabled,
460    <code>mod_exec</code> will monitor for and log any <code>stdout</code>
461    from the executed command to the <code>ExecLog</code>.
462
463  <p>
464  <li><code>sendStdout</code><br>
465    <p>If this option is enabled, <code>mod_exec</code> will attempt to
466    send any <code>stdout</code> output from the executed command to the
467    connected client.  Note that this only works for commands that are
468    executed via <code>ExecOnCommand</code> or <code>ExecOnConnect</code>.
469    <p>
470    <b>Note</b> this this option should <b>not</b> be used for SSH2/SFTP/SCP
471    sessions, as it will only cause connection problems for SSH2/SFTP/SCP
472    clients.
473
474  <p>
475  <li><code>useStdin</code><br>
476    <p>If this option is enabled, <code>mod_exec</code> will <b>not</b>
477    send arguments to the command being executed using the command line;
478    instead, those arguments will written to the <code>stdin</code> stream.
479    Each command-line argument will be written as a newline-terminated
480    string to <code>stdin</code>; the end of arguments is indicated by
481    writing the period ('.') character on a line by itself (again, terminated
482    with a newline).
483
484    <p>
485    For example, a Perl script reading its arguments from <code>stdin</code>
486    would use something like:
487<pre>
488    while (my $line = &lt;STDIN&gt;) {
489      chomp($line);
490
491      if ($line eq ".") {
492        last;
493      }
494
495      # Handle $line appropriately here
496    }
497</pre>
498    The advantange of using this <code>useStdin</code> option is that some
499    systems have tools (<i>e.g.</i> <code>ps</code>) which will show the
500    command-line arguments to commands being executed.  For the security
501    conscious, using <code>stdin</code> to pass arguments is less visible
502    to other users of the system.
503</ul>
504
505<p>
506<hr>
507<h2><a name="ExecTimeout">ExecTimeout</a></h2>
508<strong>Syntax:</strong> ExecTimeout <em>seconds</em><br>
509<strong>Default:</strong> None<br>
510<strong>Context:</strong> &quot;server config&quot; <code>&lt;VirtualHost&gt;</code>, <code>&lt;Global&gt;</code><br>
511<strong>Module:</strong> mod_exec<br>
512<strong>Compatibility:</strong> 1.2.9rc2 and later
513
514<p>
515The <code>ExecTimeout</code> directive is used to set a limit on how long
516the executed commands can run.  Processes that exceed the configured timeout
517will first be sent SIGTERM, to allow them to cleanly shutdown.  If the process
518is still around, it will then be sent SIGKILL, which cannot be ignored. A
519value of zero configures an infinite timeout (not recommended).
520
521<p>
522<hr>
523<h2><a name="Usage">Usage</a></h2>
524Example configuration:
525<pre>
526  &lt;IfModule mod_exec.c&gt;
527    ExecEngine on
528    ExecLog /var/log/ftpd/exec.log
529    ExecOnConnect /path/to/script
530  &lt;/IfModule&gt;
531</pre>
532
533<p>
534This module will not work properly for <code>&lt;Anonymous&gt;</code> logins,
535or for logins that are affected by <code>DefaultRoot</code>.  These directives
536use the <code>chroot(2)</code> system call, which wreaks havoc when it
537comes to scripts.  The path to script/shell interpreters often assume a certain
538location that is no longer valid within a chroot.  In addition, most modern
539operating systems use dynamically loaded libraries (<code>.so</code>
540libraries) for many binaries, including script/shell interpreters.  The
541location of these libraries, when they come to be loaded, are also assumed;
542those assumptions break within a chroot.  Perl, in particular, is so
543wrought with filesystem location assumptions that it's almost impossible
544to get a Perl script to work within a chroot, short of installing Perl
545itself into the chroot environment.
546
547<p>
548In short, this module is probably not what you want.  And, try as I might,
549I cannot convince users that this module is not what they want.  Therefore,
550I'll let you try to use this module yourself, and you can prove to yourself
551that it probably won't do what you want.
552
553<p>
554As an alternative to <code>mod_exec</code> for executing arbitrary
555scripts/commands based on FTP command issued, file uploaded/downloaded,
556<i>etc</i>, I recommend using a logging FIFO-based approach, similar to
557what is illustrated <a href="../howto/Logging.html">here</a>.  This approach
558allows for any script you wish, and is not subject to the restrictions of a
559chroot, meaning that you can use <code>DefaultRoot</code> and still have
560arbitrary scripts executed.  If requested, I can provide help in writing a
561FIFO reader to execute the necessary scripts.
562
563<p>
564<hr>
565<h2><a name="Installation">Installation</a></h2>
566To install <code>mod_exec</code>, copy the <code>mod_exec.c</code> file into
567<pre>
568  <i>proftpd-dir</i>/contrib/
569</pre>
570after unpacking the latest proftpd-1.3.<i>x</i> source code.  Then follow the
571usual steps for using third-party modules in proftpd:
572<pre>
573  ./configure --with-modules=mod_exec
574  make
575  make install
576</pre>
577
578<p>
579Alternatively, if your proftpd was compiled with DSO support, you can
580use the <code>prxs</code> tool to build <code>mod_exec</code> as a shared
581module:
582<pre>
583  prxs -c -i -d mod_exec.c
584</pre>
585
586<p><a name="FAQ"></a>
587<b>Frequently Asked Questions</b><br>
588<font color=red>Question</font>: Why do <code>%U/%u</code> not work properly with <code>ExecOnConnect</code>?<br>
589<font color=blue>Answer</font>: Both <code>%U</code> and <code>%u</code> will
590be empty on <code>ExecOnConnect</code> because, at that point, the client has
591done a TCP connect to the server, but has not sent any sort of information
592(including user name).  Which means that <code>mod_exec</code> does not have
593a user name to use at connect time.
594
595<p>
596One way to work around this limitation is to use a different trigger,
597<i>e.g.</i>:
598<pre>
599  ExecOnCommand PASS ...
600</pre>
601By the time the client sends the <code>USER</code> and <code>PASS</code>
602commands, the server will have the necessary user information to populate
603the <code>%U/%u</code> variables.
604
605<p>
606<hr><br>
607
608Author: <i>$Author: castaglia $</i><br>
609Last Updated: <i>$Date: 2011/09/02 17:23:12 $</i><br>
610
611<br><hr>
612
613<font size=2><b><i>
614&copy; Copyright 2000-2011 TJ Saunders<br>
615 All Rights Reserved<br>
616</i></b></font>
617
618<hr><br>
619
620</body>
621</html>
622
Note: See TracBrowser for help on using the repository browser.