diff --git a/roles/bootstrap/templates/proftpd/conf.d/global.conf.j2 b/roles/bootstrap/templates/proftpd/conf.d/global.conf.j2 new file mode 100644 index 0000000..0357e94 --- /dev/null +++ b/roles/bootstrap/templates/proftpd/conf.d/global.conf.j2 @@ -0,0 +1,22 @@ + + PassivePorts {{ pasv_ports }} + RequireValidShell off + MaxInstances {{ max_conns }} + {% if allow_symlinks %} + ShowSymlinks on + {% else %} + ShowSymlinks off + {% endif %} + + DisplayLogin WELCOME.msg + DisplayChdir .README.md true + DisplayConnect BANNER.msg + DisplayFileTransfer SUCCESS.msg + + TimeoutNoTransfer 3600 + TimeoutStalled 210 + TimeoutIdle 1400 + + Umask 022 022 + AllowOverwrite on + \ No newline at end of file diff --git a/roles/bootstrap/templates/proftpd/conf.d/vhost@vps1.conf.j2 b/roles/bootstrap/templates/proftpd/conf.d/vhost@vps1.conf.j2 new file mode 100644 index 0000000..c96fa5a --- /dev/null +++ b/roles/bootstrap/templates/proftpd/conf.d/vhost@vps1.conf.j2 @@ -0,0 +1,43 @@ + + ServerName {{ ftp_server_name }} + ServerIdent on "You have arrived at {{ server_name }}!" + ServerAlias {{ hostvars[inventory_hostname].fqdn }} + ServerAlias ftp.{{ hostvars[inventory_hostname].fqdn }} + ServerAlias {{ hostvars[inventory_hostname].fqdn.split('.')[0] }} + ServerLog /var/log/proftpd/{{ hostvars[inventory_hostname].fqdn.split('.')[0] }}.log + Protocols ftps + Port 990 + + # AuthOrder mod_auth_pam.c mod_auth_unix.c* + AuthOrder mod_auth_file.c + AuthUserFile /etc/proftpd/ftpd.passwd + AuthGroupFile /etc/proftpd/ftpd.group + AuthFileOptions SyntaxCheck + + TLSEngine on + TLSLog /var/log/proftpd/tls.log + # @NOTW: "AALv23" means all SSL versions + TLSProtocol SSLv23 + TLSOptions AllowClientRenegotiations + TLSVerifyClient off + TLSRequired on + TLSRenegotiate required off + + TLSECCertificateFile {{ config.proftpd.tls_paths.cert }} + TLSECCertificateKeyFile {{ config.proftpd.tls_paths.privkey }} + TLSCACertificateFile {{ config.proftpd.tls_paths.cert }} + + + UserAlias anon smuggler + + + + DenyAll + + + + AllowAll + + + + \ No newline at end of file diff --git a/roles/bootstrap/templates/proftpd/proftpd.conf.j2 b/roles/bootstrap/templates/proftpd/proftpd.conf.j2 new file mode 100644 index 0000000..5e76991 --- /dev/null +++ b/roles/bootstrap/templates/proftpd/proftpd.conf.j2 @@ -0,0 +1,186 @@ +# +# /etc/proftpd/proftpd.conf -- This is a basic ProFTPD configuration file. +# To really apply changes, reload proftpd after modifications, if +# it runs in daemon mode. It is not required in inetd/xinetd mode. +# + +# Includes DSO modules +Include /etc/proftpd/modules.conf + +# Set off to disable IPv6 support which is annoying on IPv4 only boxes. +UseIPv6 on +# If set on you can experience a longer connection delay in many cases. + + IdentLookups off + + +ServerName "{{ ftp_server_name }}" +# Set to inetd only if you would run proftpd by inetd/xinetd/socket. +# Read README.Debian for more information on proper configuration. +ServerType standalone +DeferWelcome off + +# Disable MultilineRFC2228 per https://github.com/proftpd/proftpd/issues/1085 +# MultilineRFC2228on +DefaultServer on + +DenyFilter \*.*/ + +# Use this to jail all users in their homes +DefaultRoot ~ + +# Users require a valid shell listed in /etc/shells to login. +# Use this directive to release that constrain. +# RequireValidShell off + +# Port 21 is the standard FTP port. +Port 21 + +# If your host was NATted, this option is useful in order to +# allow passive tranfers to work. You have to use your public +# address and opening the passive ports used on your firewall as well. +# MasqueradeAddress 1.2.3.4 + +# This is useful for masquerading address with dynamic IPs: +# refresh any configured MasqueradeAddress directives every 8 hours +# +# DynMasqRefresh 28800 +# + +# Set the user and group that the server normally runs at. +User proftpd +Group nogroup + +# Uncomment this if you are using NIS or LDAP via NSS to retrieve passwords: +# PersistentPasswd off + +# This is required to use both PAM-based authentication and local passwords +# AuthOrder mod_auth_pam.c* mod_auth_unix.c + +# Be warned: use of this directive impacts CPU average load! +# Uncomment this if you like to see progress and transfer rate with ftpwho +# in downloads. That is not needed for uploads rates. +# +# UseSendFile off + +TransferLog /var/log/proftpd/transfer.log +SystemLog /var/log/proftpd/connection.log + +# Logging onto /var/log/lastlog is enabled but set to off by default +#UseLastlog on + +# In order to keep log file dates consistent after chroot, use timezone info +# from /etc/localtime. If this is not set, and proftpd is configured to +# chroot (e.g. DefaultRoot or ), it will use the non-daylight +# savings timezone regardless of whether DST is in effect. +#SetEnv TZ :/etc/localtime + + + QuotaEngine off + + + + Ratios off + + + +# Delay engine reduces impact of the so-called Timing Attack described in +# http://www.securityfocus.com/bid/11430/discuss +# It is on by default. + + DelayEngine on + + + + ControlsEngine off + ControlsMaxClients 2 + ControlsLog /var/log/proftpd/controls.log + ControlsInterval 5 + ControlsSocket /var/run/proftpd/proftpd.sock + + + + AdminControlsEngine off + + +# +# Alternative authentication frameworks +# +#Include /etc/proftpd/ldap.conf +#Include /etc/proftpd/sql.conf + +# +# This is used for FTPS connections +# +#Include /etc/proftpd/tls.conf + +# +# This is used for SFTP connections +# +#Include /etc/proftpd/sftp.conf + +# +# This is used for other add-on modules +# +#Include /etc/proftpd/dnsbl.conf +#Include /etc/proftpd/geoip.conf +#Include /etc/proftpd/snmp.conf + +# +# Useful to keep VirtualHost/VirtualRoot directives separated +# +#Include /etc/proftpd/virtuals.conf + +# A basic anonymous configuration, no upload directories. + +# +# User ftp +# Group nogroup +# # We want clients to be able to login with "anonymous" as well as "ftp" +# UserAlias anonymous ftp +# # Cosmetic changes, all files belongs to ftp user +# DirFakeUser on ftp +# DirFakeGroup on ftp +# +# RequireValidShell off +# +# # Limit the maximum number of anonymous logins +# MaxClients 10 +# +# # We want 'welcome.msg' displayed at login, and '.message' displayed +# # in each newly chdired directory. +# DisplayLogin welcome.msg +# DisplayChdir .message +# +# # Limit WRITE everywhere in the anonymous chroot +# +# +# DenyAll +# +# +# +# # Uncomment this if you're brave. +# # +# # # Umask 022 is a good standard umask to prevent new files and dirs +# # # (second parm) from being group and world writable. +# # Umask 022 022 +# # +# # DenyAll +# # +# # +# # AllowAll +# # +# # +# +# + + + DenyAll + + +# Include other custom configuration files +# !! Please note, that this statement will read /all/ file from this subdir, +# i.e. backup files created by your editor, too !!! +# Eventually create file patterns like this: /etc/proftpd/conf.d/*.conf +# +Include /etc/proftpd/conf.d/ \ No newline at end of file