DHCP_NOIPV4LL[0]="yes"

INET_IFACE="ppp0"                                               
DHCP="no"                                                       
DHCP_SERVER=`sed -rn 's/^nameserver ([0-9.]+).*$/\1/;T;p;q' /etc/resolv.conf`
if [ -n "$DHCP_SERVER" ]; then                                               
        echo "Found DHCP_SERVER=$DHCP_SERVER"                                
        DHCP="yes"                                                           
        sed -ri "/^\s*forwarders \{$/{; N; s/(\n\s*)([0-9.]{7,16})/\1$DHCP_SERVER/; }" /etc/named.conf
fi                                                                                                    
PPPOE_PMTU="no"                                                                                       
LAN_IP="192.168.1.1"                                                                                  
LAN_IP_RANGE="192.168.1.0/24"                                                                         
LAN_IFACE="eth1"                                                                                      
LO_IFACE="lo"                                                                                         
LO_IP="127.0.0.1"                                                                                     
IPTABLES="/usr/sbin/iptables"                                                                         
MOD_INIT=""                                                                                           
for MOD in ip_conntrack ip_tables iptable_filter iptable_mangle iptable_nat ipt_LOG     ipt_limit ipt_MASQUERADE
do                                                                                                              
        /sbin/lsmod | grep -q "$MOD"                                                                            
        if [ $? != 0 ]; then                                                                                    
                echo "load $MOD"                                                                                
                if [ -z "MOD_INIT" ]; then                                                                      
                        /sbin/depmod -a                                                                         
                        MOD_INIT="yes"                                                                          
                fi                                                                                              
                /sbin/modprobe $MOD                                                                             
        fi                                                                                                      
done                                                                                                            
echo "1" > /proc/sys/net/ipv4/ip_forward                                                                        
$IPTABLES -P INPUT DROP                                                                                         
$IPTABLES -P OUTPUT DROP                                                                                        
$IPTABLES -P FORWARD DROP                                                                                       
$IPTABLES -N bad_tcp_packets                                                                                    
$IPTABLES -N allowed                                                                                            
$IPTABLES -N tcp_packets                                                                                        
$IPTABLES -N udp_packets                                                                                        
$IPTABLES -N icmp_packets                                                                                       
$IPTABLES -A bad_tcp_packets -p tcp --tcp-flags SYN,ACK SYN,ACK \                                               
-m state --state NEW -j REJECT --reject-with tcp-reset                                                          
$IPTABLES -A bad_tcp_packets -p tcp ! --syn -m state --state NEW -j LOG \                                       
--log-prefix "New not syn:"                                                                                     
$IPTABLES -A bad_tcp_packets -p tcp ! --syn -m state --state NEW -j DROP                                        
$IPTABLES -A allowed -p TCP --syn -j ACCEPT
$IPTABLES -A allowed -p TCP -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A allowed -p TCP -j DROP
$IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 21 -j allowed
$IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 22 -j allowed
$IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 80 -j allowed
$IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 113 -j allowed
$IPTABLES -A udp_packets -p UDP -s 0/0 --source-port 53 -j ACCEPT
if [ $DHCP == "yes" ] ; then
        $IPTABLES -A udp_packets -p UDP -s $DHCP_SERVER --sport 67 \
        --dport 68 -j ACCEPT
fi
$IPTABLES -A icmp_packets -p ICMP -s 0/0 --icmp-type 8 -j ACCEPT
$IPTABLES -A icmp_packets -p ICMP -s 0/0 --icmp-type 11 -j ACCEPT
$IPTABLES -A INPUT -p tcp -j bad_tcp_packets
$IPTABLES -A INPUT -p ALL -i $LAN_IFACE -s $LAN_IP_RANGE -j ACCEPT
$IPTABLES -A INPUT -p ALL -i $LO_IFACE -j ACCEPT
$IPTABLES -A INPUT -p UDP -i $LAN_IFACE --dport 67 --sport 68 -j ACCEPT
$IPTABLES -A INPUT -p ALL -i $INET_IFACE -m state --state ESTABLISHED,RELATED \
-j ACCEPT
$IPTABLES -A INPUT -p TCP -i $INET_IFACE -j tcp_packets
$IPTABLES -A INPUT -p UDP -i $INET_IFACE -j udp_packets
$IPTABLES -A INPUT -p ICMP -i $INET_IFACE -j icmp_packets
$IPTABLES -A INPUT -m limit --limit 3/minute --limit-burst 3 -j LOG \
--log-level DEBUG --log-prefix "IPT INPUT packet died: "
$IPTABLES -A FORWARD -p tcp -j bad_tcp_packets
$IPTABLES -A FORWARD -i $LAN_IFACE -j ACCEPT
$IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A FORWARD -m limit --limit 3/minute --limit-burst 3 -j LOG \
--log-level DEBUG --log-prefix "IPT FORWARD packet died: "
$IPTABLES -A OUTPUT -p tcp -j bad_tcp_packets
$IPTABLES -A OUTPUT -p ALL -s $LO_IP -j ACCEPT
$IPTABLES -A OUTPUT -p ALL -s $LAN_IP -j ACCEPT
$IPTABLES -A OUTPUT -p ALL -o $INET_IFACE -j ACCEPT
$IPTABLES -A OUTPUT -m limit --limit 3/minute --limit-burst 3 -j LOG \
--log-level DEBUG --log-prefix "IPT OUTPUT packet died: "
if [ $PPPOE_PMTU == "yes" ] ; then
        $IPTABLES -t nat -A POSTROUTING -p tcp --tcp-flags SYN,RST SYN \
        -j TCPMSS --clamp-mss-to-pmtu
fi
$IPTABLES -t nat -A POSTROUTING -o $INET_IFACE -j MASQUERADE

aranei@aranei:~$ sed -r 's/\s*#.*//; /^\s*$/d' /etc/proftpd.conf
ServerName                      "LISM station"
ServerType                      standalone
DefaultServer                   on
UseIPv6                         off
Port                            21
Umask                           022
DefaultRoot                     ~
MaxInstances                    30
User                            nobody
Group                           nogroup
SystemLog                       /var/log/proftpd.log
TransferLog                     /var/log/xferlog
<Directory /*>
        AllowOverwrite          on
</Directory>

$ cat /etc/ftpusers
ftp
root
uucp
news

#!/bin/sh                               

FTPD="/usr/sbin/proftpd"
FTPD_OPTIONS=""

function ftpd_start()
{
        echo "$FTPD starting..."
        $FTPD $FTPD_OPTIONS
}

function ftpd_stop()
{
        echo "$FTPD stopping..."
        FTPD_PID=`ps uax|sed -rn 's~^(\S+\s+)([0-9]+)\s+(\S+\s+){8}(proftpd:\s+.*)$~\2~p'`
        if [ -z "$FTPD_PID" ]; then
                echo "$FTPD not runing."
        else
                echo "PID=$FTPD_PID"
                kill $FTPD_PID
        fi
}

case $1 in
        start)
                ftpd_start
                ;;
        stop)
                ftpd_stop
                ;;
        restart)
                ftpd_stop
                sleep 1
                ftpd_start
                ;;
        status)
                ps uax|sed -rn 's~^(\S+\s+)([0-9]+)\s+(\S+\s+){8}(proftpd:\s+.*)$~&~p'
                ;;
        *)
                echo "Usage: "`basename $0`" start|stop|restart|status."
                ;;
esac

if [ -x /etc/rc.d/rc.proftpd ]; then
        /etc/rc.d/rc.proftpd start
fi

aranei@aranei:~$ lftp
lftp :~> open -u aranei localhost
Пароль:
lftp aranei@localhost:~> ls
-rwxr-xr-x   1 aranei   users       58265 Sep  8 23:06 htop-0.8-i486-1ant.tgz
-rwxr-xr-x   1 aranei   users        1222 Sep  9 00:07 lang.sh
-rwxr-xr-x   1 aranei   users         213 Sep  9 00:06 rc.font
-rwxr-xr-x   1 aranei   users         658 Sep  9 00:06 rc.keymap
drwxr-xr-x   8 aranei   users        4096 Sep  9 00:01 slackware
-rw-r--r--   1 0        0              45 Sep  8 23:11 welcome.msg
lftp aranei@localhost:/> exit

doc@bx:~$ lftp]lftp :~> open -u aranei aranei
lftp aranei@aranei:~> ls
-rwxr-xr-x   1 aranei   users       58265 Sep  8 23:06 htop-0.8-i486-1ant.tgz
-rwxr-xr-x   1 aranei   users        1222 Sep  9 00:07 lang.sh
-rwxr-xr-x   1 aranei   users         213 Sep  9 00:06 rc.font
-rwxr-xr-x   1 aranei   users         658 Sep  9 00:06 rc.keymap
drwxr-xr-x   8 aranei   users        4096 Sep  9 00:01 slackware
-rw-r--r--   1 0        0              45 Sep  8 23:11 welcome.msg
lftp aranei@aranei:/>

machine aranei
login aranei
password мой_пароль