Gecko [ www.thearyasamaj.org ]

Name	Size	Permission
ftpasswd.html	14.61 KB	-rw-r--r--
ftpmail.html	8 KB	-rw-r--r--
ftpquota.html	10.9 KB	-rw-r--r--
index.html	9.04 KB	-rw-r--r--
mod_auth_otp.html	16.5 KB	-rw-r--r--
mod_ban.html	22.53 KB	-rw-r--r--
mod_copy.html	4.85 KB	-rw-r--r--
mod_ctrls_admin.html	15.05 KB	-rw-r--r--
mod_deflate.html	6.89 KB	-rw-r--r--
mod_digest.html	12.92 KB	-rw-r--r--
mod_dnsbl.html	6.1 KB	-rw-r--r--
mod_dynmasq.html	3.26 KB	-rw-r--r--
mod_exec.html	23.89 KB	-rw-r--r--
mod_geoip.html	17.06 KB	-rw-r--r--
mod_ifsession.html	11.02 KB	-rw-r--r--
mod_ifversion.html	4.96 KB	-rw-r--r--
mod_ldap.html	32.32 KB	-rw-r--r--
mod_load.html	2.97 KB	-rw-r--r--
mod_log_forensic.html	9.78 KB	-rw-r--r--
mod_qos.html	2.62 KB	-rw-r--r--
mod_quotatab.html	25.02 KB	-rw-r--r--
mod_quotatab_file.html	2.23 KB	-rw-r--r--
mod_quotatab_ldap.html	2.63 KB	-rw-r--r--
mod_quotatab_radius.html	2.08 KB	-rw-r--r--
mod_quotatab_sql.html	10.93 KB	-rw-r--r--
mod_radius.html	22.11 KB	-rw-r--r--
mod_ratio.html	6.99 KB	-rw-r--r--
mod_readme.html	2.69 KB	-rw-r--r--
mod_rewrite.html	30.06 KB	-rw-r--r--
mod_sftp.html	93.71 KB	-rw-r--r--
mod_sftp_pam.html	5.47 KB	-rw-r--r--
mod_sftp_sql.html	5.63 KB	-rw-r--r--
mod_shaper.html	23.28 KB	-rw-r--r--
mod_site_misc.html	5.81 KB	-rw-r--r--
mod_snmp.html	42.38 KB	-rw-r--r--
mod_sql.html	62.81 KB	-rw-r--r--
mod_sql_odbc.html	10.2 KB	-rw-r--r--
mod_sql_passwd.html	24.44 KB	-rw-r--r--
mod_sql_sqlite.html	2.95 KB	-rw-r--r--
mod_statcache.html	8.29 KB	-rw-r--r--
mod_tls.html	85.34 KB	-rw-r--r--
mod_tls_fscache.html	2.73 KB	-rw-r--r--
mod_tls_memcache.html	3.91 KB	-rw-r--r--
mod_tls_redis.html	3.6 KB	-rw-r--r--
mod_tls_shmcache.html	6.78 KB	-rw-r--r--
mod_unique_id.html	3.54 KB	-rw-r--r--
mod_wrap.html	12.38 KB	-rw-r--r--
mod_wrap2.html	24.83 KB	-rw-r--r--
mod_wrap2_file.html	4.69 KB	-rw-r--r--
mod_wrap2_redis.html	5.33 KB	-rw-r--r--
mod_wrap2_sql.html	8.33 KB	-rw-r--r--

Code Editor : mod_geoip.html

<!DOCTYPE html>
<html>
<head>
<title>ProFTPD module mod_geoip</title>
</head>

<hr>
<center>
<h2>ProFTPD module <code>mod_geoip</code></h2>
</center>
<hr>

The <code>mod_geoip</code> module uses the GeoIP library from MaxMind to
look up various geographic information for a connecting client:
<pre>
 <a href="http://www.maxmind.com/app/c">http://www.maxmind.com/app/c</a>
</pre>
This information can be used to set access controls for the server.

This module is contained in the <code>mod_geoip.c</code> file for
ProFTPD 1.3.x, and is not compiled by default. Installation
instructions are discussed <a href="#Installation">here</a>.

The most current version of <code>mod_geoip</code> is distributed with the
ProFTPD source code.

This product includes GeoLite data created by MaxMind, available from
<a href="http://www.maxmind.com/">http://www.maxmind.com/</a>.

<h2>Author</h2>

Please contact TJ Saunders &lt;tj at castaglia.org&gt; with any
questions, concerns, or suggestions regarding this module.

<h2>Directives</h2>
<ul>
 <li><a href="#GeoIPAllowFilter">GeoIPAllowFilter</a>
 <li><a href="#GeoIPDenyFilter">GeoIPDenyFilter</a>
 <li><a href="#GeoIPEngine">GeoIPEngine</a>
 <li><a href="#GeoIPLog">GeoIPLog</a>
 <li><a href="#GeoIPPolicy">GeoIPPolicy</a>
 <li><a href="#GeoIPTable">GeoIPTable</a>
</ul>

<hr>
<h3><a name="GeoIPAllowFilter">GeoIPAllowFilter</a></h3>
Syntax: GeoIPAllowFilter filter1 pattern1 [filter2 pattern2 ...] 
Default: none 
Context: server config, <code>&lt;VirtualHost&gt;</code>, <code>&lt;Global&gt;</code> 
Module: mod_geoip 
Compatibility: 1.3.3rc1 and later

The <code>GeoIPAllowFilter</code> directive is used to configure ACLs based
on the geographic data provided by the GeoIP library.

Multiple <code>GeoIPAllowFilter</code> directives in the configuration are
supported; if any filter matches the connecting client, the connection
will be allowed.

The filter parameter specifies the GeoIP value to which to apply
the configured pattern for matching. The possible filter
values are:
<ul>
 <li><code>AreaCode</code>
 <li><code>ASN</code>
 <li><code>City</code>
 <li><a href="http://www.maxmind.com/en/country_continent"><code>Continent</code></a>
 <li><a href="http://www.maxmind.com/en/iso3166"><code>CountryCode</code></a>
 <li><code>CountryCode3</code>
 <li><code>CountryName</code>
 <li><code>ISP</code>
 <li><code>Latitude</code>
 <li><code>Longitude</code>
 <li><code>NetworkSpeed</code>
 <li><code>Organization</code>
 <li><code>PostalCode</code>
 <li><code>Proxy</code>
 <li><code>RegionCode</code>
 <li><code>RegionName</code>
 <li><code>Timezone</code>
</ul>

The pattern parameter is case-insensitive regular expression 
that will be applied to the specified filter value, if available.

Note that as of <code>proftpd-1.3.6rc3</code> and later, the
<code>GeoIPAllowFilter</code> directive can also take a single
parameter which specifies a SQL query (via <code>mod_sql</code>'s
<a href="mod_sql.html#SQLNamedQuery"><code>SQLNamedQuery</code></a>), which
will be used to retrieve the filter and pattern values to use.

Examples:
<pre>
 # Allow clients with high-speed connections
 GeoIPAllowFilter NetworkSpeed corporate

# Reject clients connecting from North America or South America
 GeoIPDenyFilter Continent (NA|SA)
</pre>
The following more complex configuration demonstrates what can be done using
SQL querires:
<pre>
 &lt;IfModule mod_sql.c&gt;
 ...
 SQLNamedQuery get-geo-allowed SELECT "filter_name, pattern FROM allowed_user_geo WHERE user_name = '%u'"
 SQLNamedQuery get-geo-denied SELECT "filter_name, pattern FROM denied_user_geo WHERE user_name = '%u'"
 &lt;/IfModule&gt;

&lt;IfModule mod_geoip.c&gt;
    GeoIPEngine on

GeoIPAllowFilter sql:/get-geo-allowed
 GeoIPDenyFilter sql:/get-geo-denied
 &lt;/IfModule&gt;
</pre>
The above assumes SQL tables with schema similar to the following (expressed
using SQLite syntax):
<pre>
 CREATE TABLE allowed_user_geo (
 user_name TEXT,
 filter_name TEXT,
 pattern TEXT
 );

CREATE TABLE denied_user_geo (
    user_name TEXT,
    filter_name TEXT,
    pattern TEXT
  );

# Note that we create separate indexes, to allow for multiple rows per user
 CREATE INDEX allowed_user_geo_name_idx ON allowed_user_geo (user_name);
 CREATE INDEX denied_user_geo_name_idx ON denied_user_geo (user_name);
</pre>

<hr>
<h3><a name="GeoIPDenyFilter">GeoIPDenyFilter</a></h3>
Syntax: GeoIPDenyFilter filter1 pattern1 [filter2 pattern2 ...] 
Default: none 
Context: server config, <code>&lt;VirtualHost&gt;</code>, <code>&lt;Global&gt;</code> 
Module: mod_geoip 
Compatibility: 1.3.3rc1 and later

The <code>GeoIPDenyFilter</code> directive is used to configure ACLs based
on the geographic data provided by the GeoIP library.

Multiple <code>GeoIPDenyFilter</code> directives in the configuration are
supported; if any filter matches the connecting client, the connection
will be rejected.

Note that as of <code>proftpd-1.3.6rc3</code> and later, the
<code>GeoIPDenyFilter</code> directive can also take a single
parameter which specifies a SQL query (via <code>mod_sql</code>'s
<a href="mod_sql.html#SQLNamedQuery"><code>SQLNamedQuery</code></a>), which
will be used to retrieve the filter and pattern values to use.

See <a href="#GeoIPAllowFilter"><code>GeoIPAllowFilter</code></a> for
a description of the directive syntax and parameters.

<hr>
<h3><a name="GeoIPEngine">GeoIPEngine</a></h3>
Syntax: GeoIPEngine on|off 
Default: off 
Context: server config, <code>&lt;VirtualHost&gt;</code>, <code>&lt;Global&gt;</code> 
Module: mod_geoip 
Compatibility: 1.3.3rc1 and later

The <code>GeoIPEngine</code> directive enables or disables the module's
lookup of geographic information for a connecting client, and subsequent
enforcement of any configured ACLs.

<hr>
<h3><a name="GeoIPLog">GeoIPLog</a></h3>
Syntax: GeoIPLog file|"none" 
Default: None 
Context: server config, <code>&lt;VirtualHost&gt;</code>, <code>&lt;Global&gt;</code> 
Module: mod_geoip 
Compatibility: 1.3.3rc1 and later

The <code>GeoIPLog</code> directive is used to specify a log file for
<code>mod_geoip</code>'s reporting on a per-server basis. The file
parameter given must be the full path to the file to use for logging.

Note that this path must not be to a world-writable directory and,
unless <code>AllowLogSymlinks</code> is explicitly set to on
(generally a bad idea), the path must not be a symbolic link.

<hr>
<h3><a name="GeoIPPolicy">GeoIPPolicy</a></h3>
Syntax: GeoIPPolicy "allow,deny"|"deny,allow" 
Default: GeoIPPolicy allow,deny 
Context: server config, <code>&lt;VirtualHost&gt;</code>, <code>&lt;Global&gt;</code> 
Module: mod_geoip 
Compatibility: 1.3.5rc1 and later

The <code>GeoIPPolicy</code> directive determines whether the
<code>mod_geoip</code> module will allow a connection by default or not.

If <code>GeoIPPolicy</code> is configured using "allow,deny" (which
is the default setting), then the <code>mod_geoip</code> module will allow the
connection, unless the connecting client is rejected by any
<a href="#GeoIPDenyFilter"><code>GeoIPDenyFilter</code></a> rules.

If <code>GeoIPPolicy</code> is configured using "deny,allow", then
the <code>mod_geoip</code> module will reject any connection,
unless the connecting client matches any configured
<a href="#GeoIPAllowFilter"><code>GeoIPAllowFilter</code></a> rules.

<hr>
<h3><a name="GeoIPTable">GeoIPTable</a></h3>
Syntax: GeoIPTable path [flags] 
Default: None 
Context: server config, <code>&lt;VirtualHost&gt;</code>, <code>&lt;Global&gt;</code> 
Module: mod_geoip 
Compatibility: 1.3.3rc1 and later

The <code>GeoIPTable</code> directive is used to a GeoIP database file
for use by the GeoIP library. The path parameter given must be the
full path to the database file.

If no <code>GeoIPTable</code> directive is configured, then the GeoIP library
will use the default GeoIP Country database file installed with the library.
Otherwise, only the database files configured via <code>GeoIPTable</code>
directives will be used.

Multiple <code>GeoIPTable</code> directives can be used to configure
multiple different GeoIP database files for use at the same time.

The possible flags values supported are:
<ul>
 <li><code>Standard</code>
 
 Reads the database from the filesystem; uses the least memory but causes
 database to be read for each connection.
 </li>

<li><code>MemoryCache</code>
 
 Loads the database into memory; faster performance but uses the most
 memory. Tables configured with <code>MemoryCache</code> are loaded
 into the parent process memory, avoiding the need to read them for
 each connection.
 </li>

<li><code>CheckCache</code>
 
 Causes the GeoIP library to check for database updates. If the database
 has been updated, the library will automatically reload the file and/or
 memory cache.
 </li>

<li><code>IndexCache</code>
 
 Loads just the most frequently accessed index portion of the database
 into memory, resulting in faster lookups than <code>Standard</code> but
 less memory usage than <code>MemoryCache</code>. This can be useful
 for larger databases such as GeoIP Organization and GeoIP City.
 </li>

<li><code>MMapCache</code>
 
 Loads the database into <code>mmap</code> shared memory.
 </li>

<li><code>UTF8</code>
 
 Tells the GeoIP library to return UTF8 strings for the data obtained
 from this database file. By default, the GeoIP library uses ISO-8859-1
 encoded strings.
 </li>
</ul>
Multiple different flags can be configured.

Examples:
<pre>
 GeoIPTable /path/to/GeoIP.dat MemoryCache CheckCache
 GeoIPTable /path/to/GeoISP.dat Standard
 GeoIPTable /path/to/GeoIPCity.dat IndexCache
</pre>

<hr>
<h2><a name="Installation">Installation</a></h2>
The <code>mod_geoip</code> module requires that the GeoIP library be installed.
For including <code>mod_geoip</code> as a staticly linked module:
<pre>
 $ ./configure --with-modules=mod_geoip
</pre>
Alternatively, <code>mod_geoip</code> could be built as a DSO module:
<pre>
 $ ./configure --with-shared=mod_geoip
</pre>
Then follow the usual steps:
<pre>
 $ make
 $ make install
</pre>
You may need to specify the location of the GeoIP header and library files in
your <code>configure</code> command, e.g.:
<pre>
 $ ./configure --with-modules=mod_geoip \
 --with-includes=/usr/local/geoip/include \
 --with-libraries=/usr/local/geoip/lib
</pre>

Alternatively, if your <code>proftpd</code> was compiled with DSO support, you
can use the <code>prxs</code> tool to build <code>mod_geoip</code> as a shared
module:
<pre>
 $ prxs -c -i -d mod_geoip.c
</pre>

<hr>
<h2><a name="Usage">Usage</a></h2>

Access Controls 
If any <code>GeoIPAllowFilter</code> or <code>GeoIPDenyFilter</code>
directives are configured, the <code>mod_geoip</code> module applies them
against the geographic information retrieved from the GeoIP library. First
any <code>GeoIPAllowFilter</code>s are checked. If any of these
filters matches the connecting client's information, the connection is allowed.
Next, any <code>GeoIPDenyFilter</code>s are checked. If any of these
filters matches the connecting client's information, the connection is closed.
Otherwise, the connection is allowed.

This means that if you wanted to reject connections from the US except
for connections from California, you might use something like this:
<pre>
 # Deny all connections from the US
 GeoIPDenyFilter CountryCode US

# But allow connections from California
 GeoIPAllowFilter RegionCode CA
</pre>

Environment Variables 
The <code>mod_geoip</code> module will set the following environment
variables whenever a client connects, assuming that the appropriate
GeoIP tables have been configured and the values are known for the connecting
client:
<ul>
 <li><code>GEOIP_AREA_CODE</code>
 <li><code>GEOIP_ASN</code>
 <li><code>GEOIP_CITY</code>
 <li><code>GEOIP_CONTINENT_CODE</code>
 <li><code>GEOIP_COUNTRY_CODE</code> (two-letter country code)
 <li><code>GEOIP_COUNTRY_CODE3</code> (three-letter country code)
 <li><code>GEOIP_COUNTRY_NAME</code>
 <li><code>GEOIP_ISP</code>
 <li><code>GEOIP_LATITUDE</code>
 <li><code>GEOIP_LONGITUDE</code>
 <li><code>GEOIP_NETSPEED</code>
 <li><code>GEOIP_ORGANIZATION</code>
 <li><code>GEOIP_POSTAL_CODE</code>
 <li><code>GEOIP_PROXY</code>
 <li><code>GEOIP_REGION</code>
 <li><code>GEOIP_REGION_NAME</code>
 <li><code>GEOIP_TIMEZONE</code>
</ul>
These values are also available in the <code>session.notes</code> table,
under keys of the names above.

Example Configuration

<pre>
 &lt;IfModule mod_geoip.c&gt;
 GeoIPEngine on
 GeoIPLog /path/to/ftpd/geoip.log

# Load GeoLite city database into memory on server startup, and use
    # UTF8-encoded city names
    GeoIPTable /path/to/GeoLiteCity.dat MemoryCache UTF8

# Add your GeoIPAllowFilter/GeoIPDenyFilter rules here
 &lt;/IfModule&gt;
</pre>

Logging 
The <code>mod_geoip</code> module supports different forms of logging. The
main module logging is done via the <code>GeoIPLog</code> directive.
For debugging purposes, the module also uses <a href="../howto/Tracing.html">trace logging</a>, via the module-specific log channels:
<ul>
 <li>geoip
</ul>
Thus for trace logging, to aid in debugging, you would use the following in
your <code>proftpd.conf</code>:
<pre>
 TraceLog /path/to/ftpd/trace.log
 Trace geoip:20
</pre>
The geographic information retrieved from the GeoIP library for the
connecting client is logged using this "geoip" trace log channel. This trace
logging can generate large files; it is intended for debugging
use only, and should be removed from any production configuration.

Suggested Future Features 
The following lists the features I hope to add to <code>mod_geoip</code>,
according to need, demand, inclination, and time:
<ul>
 <li>Configure a message to be sent to rejected clients
 <li>Support requiring all <code>GeoIPAllowFilter</code>/<code>GeoIPDenyFilter</code> to apply, in addition to any
</ul>

<a name="FAQ">
Frequently Asked Questions

<a name="GeoIPWhitelist">
Question: How I can whitelist specific clients from
<code>mod_geoip</code>'s checking? 
Answer: You should be able to easily do this using
<a href="http://www.proftpd.org/docs/howto/Classes.html">classes</a> and the
<code>mod_ifsession</code> module. For example:
<pre>
 &lt;Class geoip-whitelist&gt;
 From 1.2.3.4
 &lt;/Class&gt;

&lt;IfModule mod_geoip.c&gt;
 # Add the normal mod_geoip directives here except <code>GeoIPEngine</code>
 &lt;/IfModule&gt;

&lt;IfClass geoip-whitelist&gt;
    # Disable mod_geoip for the whitelisted clients
    GeoIPEngine off
  &lt;/IfClass&gt;

&lt;IfClass !geoip-whitelist&gt;
 # Enable mod_geoip for all non-whitelisted clients
 GeoIPEngine on
 &lt;/IfClass&gt;
</pre>

<a name="GeoIPMultipleRules">
Question: How I can require that a connection match
multiple rules, e.g. both a <code>RegionCode</code> and a
<code>CountryCode</code>? 
Answer: In a given <code>GeoIPAllowFilter</code> or
<code>GeoIPDenyFilter</code>, you can configure a list of
filters/patterns. And all of these filters must be matched,
in order for that <code>GeoIPAllowFilter</code> or <code>GeoIPDenyFilter</code>
to be matched. Thus you can use:
<pre>
 # Deny all connections, unless they are explicitly allowed
 GeoIPPolicy deny,allow

# Allow only connections from TX, US
 GeoIPAllowFilter RegionCode TX CountryCode US
</pre>

<a name="GeoIPIPv6">
Question: Does <code>mod_geoip</code> support IPv6? 
Answer: Yes, assuming that the IPv6
MaxMind tables are configured via <code>GeoIPTable</code>. You can find
the free IPv6 country and city "legacy" files; see this MaxMind <a href="https://www.maxmind.com/en/ipv6-information-and-faq">IPv6 FAQ</a> for details.

</body>
</html>

${this.title}

Code Editor : mod_geoip.html