Products Downloads Prices Support Company

Search Manual

SurgeFTP Virtual Domains
Product Links
Download Now
FAQ
Email Support
Manual

Features

SSL/TLS / Security
Performance / Threads
Easy management
Reports
Mirrors
NT Authentication
Authent Modules
Unlimited Virtual Domains
Daily download limits
Kbytes/second limits
Aliases
Remote Admin
Login notices
RFC Compliant
Directory notices
Version History
   


Setting up multiple Domains under one IP.
One Computer, One IP, and several DNS names that point at that IP.

Internet Basics

This is very important to understand:
Information travels over the internet from one IP to another IP, not from one DNS name
to another DNS name. That means, the DNS name associated with an IP is not sent
during the initial connection establishment. All that is inherently known about an internet
connection is the IP addresses of the computers at each end.

DNS Names
DNS (Domain Name Service) is a way of associating a domain name with an IP address. This works by connecting to a DNS server and asking it what the IP address is for a particular DNS name, and it either responds with the correct IP for that name, or with an error message, most usually "unknown host" which happens if you mistype a domain name in a web browser.
The Domain Name Service is a network of computers on the internet that share the list of names and matching IP addresses, this is what all the ISP's register domains with on their users behalf when the user wants their domain. All these DNS computers are almost continuously propergating the information of new domains and old ones that are being deleted.
You might very well ask yourself "How does my computer connect to this service if I don't know the IP of my DNS Server?" The answer is that, when you connect to the internet, part of the connecting stage is where you receive the DNS IP that you are to use, your OS usually does the DNS lookup on a name and attempt the connection, when an application you run needs to make an internet connection.

Configuring SurgeFTP correctly
You only really have one actual domain, so only create one domain in SurgeFTP, and one user class for each "virtual domain" that you want to host.

When aA FTP client opens a connection to the FTP server, all that the server can know about the connection is the IP of the client, and its own IP that accepted the connection, (for multi IP multi domain config this would be how FTP server determines the domain to be, however) at this point the FTP server has to identify itself, usually the Domain name is in the 220 hello string, but you will have to change this to be just an inspecific hello string, so that the user does not get confused about what they are connecting to. (Set Domin Setting "Greetings" to "FTP Server" or something else that is generic).

Anonymous Users:
You can only ever have one anonymous class, there is no way to determine exactly which domain the anonymous user wants to login to. So best thing for anonymous class to have is a single /pub directory, and under that, have the domain name for each domain you are hosting, as a subfolder alias which maps into each of the virtual domains pub directory. (a /pub directory is the traditional location for publicly downloadable material)

e.g. Create or modify the Anonymous User Class:
Say you are hosting Three domains "a.com" "b.com" "c.com"
Their home directories look like this: (home dir, then location of web pages, then location of their /pub directory)
c:\home\a.com\
c:\home\a.com\puplic_html\
c:\home\a.com\pub\
c:\home\b.com\
c:\home\b.com\puplic_html\
c:\home\b.com\pub\
c:\home\c.com\
c:\home\c.com\puplic_html\
c:\home\c.com\pub\

The Anonymous user would have alias mappings like this:

Alias Path
/ c:\home\anonymous
/pub c:\home\anonymous\pub
/pub/a.com c:\home\a.com\pub\
/pub/b.com c:\home\b.com\pub\
/pub/c.com c:\home\c.com\pub\

Real Users:
SurgeFTP (or any FTP server in this scenario) must be clever to be able to give the real users logging in the correct settings so that it will appear they are logging into the correct domain.
We need to wait for the user to identify themself so that we know what domain they belong to. The user will send to the ftp server a username and a password, and this is where the user authentication plays a major part. The user authentication tells us if the login is valid, and it can tell us if the user belongs to any usergroups, and it can tell us where the users home directory is.
If the Authentication tells us what usergroup the user belongs to, we can use this to select a user class that has a matching usergroup, You can use groups like domains, if a user belongs to a particular group, then they belong to a particular domain. (Set User Class Setting "Specific usergroups in this class" to be a comma seperated list of groupnames)
If the Authentication tells us what the users home directory is, SurgeFTP will use that for that user, and use the default user class.You may only require one real user class for this configuration.
If you want to be a little cunning, you can make your users login with the username to be user@domain, that way you can have a user class for each virtual domain, each having a username filter of "*@domain" matching the name of the domain, and the user will be matched up to the user class.(Set User Class Setting "Specific users in this class" to the wildcard domain match.)
If you only have a few user logins, you can create a user class for each of them, and list the users names explicitly for each user class, which makes the user login under those class settings. (Set User Class Setting "Specific users in this class" to be exactly the users login name.)

Real World Example with Problems and fixes:

You want to host a several Domains on one IP. Each Domain on the computer is a customers website. Plus you also want to host some of your home users local homepages. You have decided to use nwauth as your authentication method.

You want to host these domains providing ftp access to a public_html directory and a pub directory.

Domain User Logins Description
a.com 1 customers domain
b.com 1 customers domain
c.com 1 customers domain
local.isp.com 2592 Your ISP Domain where home users have their homepages.

In SurgeFTP GUI setup one "Domain" with four User Classes, then name them so you know which is which.

    

You then setup the logins in the NWAuth database with usernames and groups settings so that you know what domain each login belongs to. Here is a table with the data you would want to put into NWAuth.
The Groups setting uses an identifier to match up the userlogin to a "virtual domain" the identifiying string can be anything as long as it matches the User Class setting called "Specific usergroups in this class".

User Login Password Groups
a.com hdmfdg a.com
b.com oivaesf b.com
c.com oahfkfk c.com
aaron bcxmn local
abbey xdyn local
bob hgdbfg local
ablogs xhnd local
gblogs zsrqqc local
peterp rnhgfh local
james zergy local
john setdgh local
... ... ...

To enter the data into the NWAuth you could output the table data into a batch file in the format

nwauth set $User $Password groups="$Groups"

(one line for each user)
In the GUI you need to set the Usergroups for each User Group to be one of the four user groups. Also you need to set the login home directories, for this setup I would reccoment that you change the default mappings for the three domains (a.com, b.com, c.com) from the defaults:

Alias Path
/ ~

To (one for each matching domain):

Alias Path
/ c:\domains\a.com

Alias Path
/ c:\domains\b.com

Alias Path
/ c:\domains\c.com

And set the local.isp.com aliases to this (the defaults)

Alias Path
/ ~

and set the setting "Root path for users (~ translation uses this)" to "c:\local\home"

This would mean that the local.isp.com user named "aaron" would login to the location "c:\local\home\aaron"

Once this is set correctly you can attempt to login. If you are unable to login use these steps to find the problem.

1. Check that the "groups" setting is called "groups" for the logins, if it is called "group" it will not work, everyone will log into the default domain (if i has no usergroups setting) or no domain (login fails).

2. Set SurgeFTP Global setting "Logging Level" to "debug". attempt to login

sslftp aaron:bcxmn@127.0.0.1
Connected to 127.0.0.1
starting SSL/TLS
secure protocol TLSv1 used.
Channel open, login Failed!
sslftp>

Hmm, whats this problem? aaron cant login? Click on the Log button at the top of SurgeFTP GUI, type in "aaron" and click search.

22 13:38:28.26:dbg:2496: start (USER aaron) 10
22 13:38:28.26:Info:2496: <-- USER aaron
22 13:38:28.26:dbg:2496: Got command user aaron
22 13:38:28.26:Info:2496: --> 331 Password required for aaron.
22 13:38:28.27:Info:2496: Spawned login error (-ERR aaron password wrong or not a valid user)
22 13:38:28.27:dbg:2496: user_login_generic(local.isp.com,aaron,******,0) -ERR aaron password wrong or not a valid user
22 13:38:28.27:Info:2496: User Lookup failed aaron -ERR aaron password wrong or not a valid user
22 13:38:29.27:Info:2496: --> 530 Login incorrect aaron -ERR aaron password wrong or not a valid user
22 13:40:19.49:dbg:2476: Form content (domainid=&fname=surgeftp.log&find=aaron&last=8k&cmd_log=Search+Now)

After the "331 Password required for aaron." response we see that "Spawned login error (-ERR aaron password wrong or not a valid user) ". The Spawned login error means that the error is from an external authentication module, nwauth in this case. The error indicates that username or password does not exist.

Click on the users tab at the top of the GUI. Type in "aaron" in the Username field and click "Lookup".

User (aaron) not found in database for this domain. (-ERR aaron not found )

This means that user name aaron was not found, you need to enter it in the database, type in his username, password and the group he belongs to "local" in this case, and then click on "Save New User" not the save button.

Password Updated
+OK aaron added to database

All is good, try logging in again

sslftp aaron:bcxmn@127.0.0.1
220 FTP Server
234 Enabling SSL
starting SSL/TLS
secure protocol TLSv1 used.
331 Password required for aaron.
230 User aaron logged in.
Successful "aaron" login
sslftp> pwd
257 "/" is current directory.
sslftp> ls -l
200 PORT command successful.
550 File or Directory does not exist (\)
550 File or Directory does not exist (\) 550 File or Directory does not exist (\)
sslftp>

Hmmm, whats wrong here? I think maybe the path may not be set up correctly for his user group. Let make the paths print out when aaron connects, go to User Class "local.isp.com" and scroll down to Banner. Type in "%virtual_paths%" and click save. Enter this for all other user classes if it does not already exist (dont forget to click save!)

Try logging in again:

sslftp aaron:bcxmn@127.0.0.1
Progress Indicator On
Connected to 127.0.0.1
220 FTP Server
234 Enabling SSL
starting SSL/TLS
secure protocol TLSv1 used.
331 Password required for aaron.
230-  Alias                Real path                      Access
230-  /                    \home\aaron                    read+write
230 User aaron logged in.
Successful "aaron" login
sslftp> pwd
257 "/" is current directory.
sslftp> ls -l
200 PORT command successful.
150 Opening ASCII mode data connection for file list. (\)
226 Transfer complete. can't list: No such file or directory
sslftp>

Hmmm, whats wrong? the users home directory is not being set correctly (\home\aaron). This is the default users home location if no setting is srt, so go check that setting. In this case it was empty so I went and set it to "c:\local\home\" which is what it is supposed to be.

sslftp aaron:bcxmn@127.0.0.1
Progress Indicator On
Connected to 127.0.0.1
220 FTP Server
234 Enabling SSL
starting SSL/TLS
secure protocol TLSv1 used.
331 Password required for aaron.
230- Alias Real path Access
230- / c:\local\home\aaron read+write
230 User aaron logged in.
Successful "aaron" login
sslftp> pwd
257 "/" is current directory.
sslftp> ls -l
200 PORT command successful.
150 Opening ASCII mode data connection for file list. (\)
226 Transfer complete.
-rwxrwxrwx 1 owner group 5 Aug 22 13:59 yes.txt
sslftp>

The file yes.txt is what I personally went and put in the location c:\local\home\aaron\yes.txt so that I could see that the login was going to the correct location. It is all set up correctly for this domain now. Time to relax with a cuppa tea and a scone :-)