ProFTPD module mod_procfs

## ProFTPD module `mod_procfs`

The `mod_procfs` module affects the visibility and usage of the `/proc` filesystem directory.

This module is contained in the `mod_procfs` file for ProFTPD 1.3.x, and is not compiled by default. Installation instructions are discussed here. More examples of `mod_procfs` usage can be found here.

The most current version of `mod_procfs` can be found at:

      https://github.com/Castaglia/proftpd-mod_procfs

## Author

Please contact TJ Saunders <tj at castaglia.org> with any questions, concerns, or suggestions regarding this module.

## Directives

- ProcfsEngine
- ProcfsLog

## ProcfsEngine

Syntax: ProcfsEngine on|off
Default: on
Context: "server config", `<VirtualHost>`, `<Global>`
Module: mod_procfs
Compatibility: 1.3.1rc1 and later

The `ProcfsEngine` directive enables or disables the module's hiding of the `/proc` filesystem. When enabled, `mod_procfs` works to prevent access to the `/proc` filesystem, returning "No such file or directory" errors for such access attempts.

Note that `ProcfsEngine` is automatically enabled if the module detects, on startup, that the `/proc` filesystem is present. If the `/proc` filesystem is not present on startup, then `ProcfsEngine` is automatically disabled. Explicitly setting this directive overrides the automatic behavior.

## ProcfsLog

Syntax: ProcfsLog file
Default: None
Context: server config, `<VirtualHost>`, `<Global>`
Module: mod_procfs
Compatibility: 1.3.1rc1 and later

The `ProcfsLog` directive is used to a specify a log file for `mod_procfs` reporting and debugging, and can be done a per-server basis. The file parameter must be the full path to the file to use for logging. Note that this path must not be to a world-writeable directory and, unless `AllowLogSymlinks` is explicitly set to on (generally a bad idea), the path must not be a symbolic link.

If file is "none", no logging will be done at all; this setting can be used to override a `ProcfsLog` setting inherited from a `<Global>` context.

## Installation

To install `mod_procfs`, copy the `mod_procfs.c` file into:

      proftpd-dir/contrib/

after unpacking the latest proftpd-1.3.x source code. For including `mod_procfs` as a statically linked module:

      ./configure --with-modules=mod_procfs

To build `mod_procfs` as a DSO module:

      ./configure --enable-dso --with-shared=mod_procfs

Then follow the usual steps:

      make
      make install

For those with an existing ProFTPD installation, you can use the `prxs` tool to add `mod_procfs`, as a DSO module, to your existing server:

      # prxs -c -i -d mod_procfs.c

## Usage

The `mod_procfs` module works by using the ProFTPD FSIO API to intercept all `stat(2)` and `lstat(2)` system calls; if the paths being checked reference the `/proc` filesystem, those system calls will fail with a "No such file or directory" error.

Example configuration:

      <IfModule mod_procfs.c>
        ProcfsEngine on
        ProcfsLog /var/log/proftpd/procfs.log
      </IfModule>

Logging
The `mod_procfs` module supports different forms of logging. The main module logging is done via the `ProcfsLog` directive. For debugging purposes, the module also uses trace logging, via the module-specific channels:

- procfs

Thus for trace logging, to aid in debugging, you would use the following in your `proftpd.conf`:

      TraceLog /path/to/proftpd-trace.log
      Trace fsio:20 procfs:20

This trace logging can generate large files; it is intended for debugging use only, and should be removed from any production configuration.

© Copyright 2026 TJ Saunders
All Rights Reserved