At IX Web Hosting, and all of the other Ecommerce Inc. brands, mod_wrap2 has been installed on all webservers. The joy of this module is to provide you with allow and deny access lists for all ftp accounts. It will make it possible as a user to define what IP addresses can, and the best part which cannot, your account through FTP.
How Does It Work?
During the login process, your ftp daemon looks for two specific files, ftp.allow and ftp.deny. After reviewing those two files, the system will check to see if the IP address trying to connect to the server at that moment is on the approved access list. If the IP address is not allowed to login into the server, they will receive warm and loving 503 error.
530 User ‘username’ denied by access rules
Right now you are thinking, “What if I lock myself out?” Something to remember, the ip address 127.0.0.1 is ALWAYS allowed, meaning access from webshell within your IX Web Hosting control panel will always be permitted.
What If I choose not to use FTP Allow and Deny
If you have not created any allow.ftp or deny.ftp files within your home directory, then the ftp behaviour of your account is not changed. No really if you do not want to use, it your site will still work correctly.
Quick words of Wisdom
The files ftp.allow and ftp.deny *MUST* be created in the home directory of the user, as it is seen by the ftp daemon:
-
for the main ftp login, this directory is: /hsphere/local/home/username/
-
for the ftp sub-users, this directory is /hsphere/local/home/username/some/path/set/by/customer/ (if the relative path set by customer is /some/path/set/by/customer)
Also, if 2 different users have the same home directory, the ftp.allow and ftp.deny contents will affect BOTH users.
If the ftp main user has strict rules defined that only allow certain IPs to connect, but a ftp subuser doesn’t have any rules defined, the ftp sub-user will be allowed to connect from anywhere. Vice-versa is also true.
Both ftp.deny and ftp.allow files *MUST* end with an empty line.
Both ftp.deny and ftp.allow should have read permissions for owner&group&others.
Hint from the Pros
If you do not know your IP address, you can obtain by visiting the site, What is my IP address. Also remember many Internet Providers are assigning what is call a dynamic IP address to many of their clients. If you are given a Dynamic IP it is highly recommended to whitelist your C-Class subnet. Here is a quick example
Your IP address i 88.182.14.24, so you would want to whitelist 88.182.14.
Examples of the Files
Here are the two files you would upload into your home directory if you plan to use allow.ftp and deny.ftp on your hosting server. When you upload these files to your account, make sure they are saved as allow.ftp and deny.ftp not allow.ftp.txt
FTP Allow and Deny












