Source: vsftpd Version: 3.0.5-0.3 Severity: normal Tags: upstream X-Debbugs-Cc: [email protected]
Dear Maintainer, Problem: The vsftpd.conf man page in Debian (package vsftpd 3.0.5-0.3) states that both "max_clients" and "max_per_ip" have a default value of "0 (unlimited)". However, according to the source code in "tunables.c", the compiled-in defaults are actually 2000 for "max_clients" and 50 for "max_per_ip". [ man 5 vsftpd.conf ] > max_clients > If vsftpd is in standalone mode, this is the maximum number of > clients which may be connected. Any additional clients connect‐ > ing will get an error message. > > Default: 0 (unlimited) > max_per_ip > If vsftpd is in standalone mode, this is the maximum number of > clients which may be connected from the same source internet ad‐ > dress. A client will get an error message if they go over this > limit. > > Default: 0 (unlimited) Details: In the source file "tunables.c", these lines define the built-in defaults: > tunable_max_clients = 2000; > tunable_max_per_ip = 50; Historical reference: According to the upstream changelog (vsftpd-2.2.0pre2), the defaults were explicitly changed to 2000 / 50: security.appspot.com/vsftpd/Changelog.txt https://security.appspot.com/vsftpd/Changelog.txt > (vsftpd-2.2.0pre2) > - Revert listen to be "NO" by default and also set max_per_ip / max_clients > to 2000 / 50 as a default. Thanks to Solar. (As copied from https://bugs.launchpad.net/ubuntu/+source/vsftpd/+bug/2130941) Cheers, Lukas
