Re: Where does pure-ftpd store files when anonymous logs in?

[hw <hw@adminart.net>]

Right.  Anonymous logins are allowed and I have created a system account
'ftp', and it still doesn't work. It keeps asking for a password when
trying to log in as 'anonymous' or 'ftp'.

I have the same on Fedora, and there it does not ask for a password when
trying to log in as 'anonymous', and it just works fine.

This must be some kind of weird Debian issue.  Why does it keep asking
for a password?


On Thu, 2025-07-10 at 05:23 -0400, Jeffrey Walton wrote:
> On Thu, Jul 10, 2025 at 4:49 AM hw <hw@adminart.net> wrote:
> > 
> > On Wed, 2025-07-09 at 20:19 -0400, Greg Wooledge wrote:
> > > On Wed, Jul 09, 2025 at 23:08:05 +0200, hw wrote:
> > > > where does pure-ftpd store files when anonymous logs in?
> > > > 
> > > > Even its man page is missing in Debian.
> > > 
> > > According to packages.debian.org, the package "pure-ftpd" depends on
> > > the package "pure-ftpd-common", and the latter has all the man pages:
> > 
> > # apt-get install pure-ftpd-common
> > [...]
> > pure-ftpd-common is already the newest version (1.0.50-2.1).
> > 
> > Oh, I should have tried 'man pure-ftpd' instead of 'man pure-ftp', I
> > guess.
> > 
> > According to the man page, it would use the home directory of the user
> > 'ftp'.  But that user doesn't exist.  A long time ago, Debian had a
> > policy that packages must work out of the box, so why wasn't the user
> > created?  Has this policy been deprecated, or am I missing something?
> 
> Anonymous logins are not enabled by default (if I recall correctly).
> See the PureFTP FAQ at </usr/share/doc/pure-ftpd/FAQ.gz>. From the
> FAQ:
> 
> <SNIP>
> * Anonymous FTP with virtual users.
> 
> -> I successfully created a virtual user called 'ftp' or 'anonymous', but
> anonymous FTP doesn't work.
> 
> Pure-FTPd never fetch any info from the virtual users backends (puredb,
> MySQL, LDAP, etc) for anonymous sessions. There are three reasons not to do
> so: - Speed: do we need to query a database just to get the anonymous
> user's home directory? We don't need to retrieve any password for anonymous
> sessions.
>      - Consistency: with the virtual hosting mechanism.
> 
> To run an anonymous FTP server you must have a *system* account called
> 'ftp'. Don't give it any valid shell, just a home directory. That home
> directory is the anonymous area.
> </SNIP>