158 lines
6.9 KiB
YAML
158 lines
6.9 KiB
YAML
# SPDX-License-Identifier: MIT-0
|
|
---
|
|
# handlers file for bootstrap
|
|
- name: Configure ProFTPd server
|
|
listen: proftpd
|
|
become: true
|
|
block:
|
|
- name: Create ProFTPd non-web user subdirectories
|
|
when: "'ftps' in item[0]['services'] and not 'caddy' in item[1]['services'] and not 'httpd' in item[1]['services'] and not 'www-data' in item[1]['services'] and not 'http' in item[1]['services'] and not 'https' in item[1]['services']"
|
|
ansible.builtin.file:
|
|
# follow: true
|
|
force: true
|
|
owner: "{{ item[0]['username'] }}"
|
|
group: "{{ item[0]['group'] | default(item[0]['username']) }}"
|
|
path: "{{ item[0]['home'] | default('/home/' ~ item[0]['username']) }}/{{ item[1]['username'] }}"
|
|
state: directory
|
|
loop: "{{ hostvars[inventory_hostname]['users'].values() | product(config['proftpd']['vusers'].values()) }}"
|
|
- name: Create ProFTPd FTP public directory for anonymous logins
|
|
when: "'ftps' in item.value['services']"
|
|
ansible.builtin.file:
|
|
# follow: true
|
|
force: true
|
|
owner: "{{ item.value['username'] }}"
|
|
group: "{{ item.value['group'] | default(item.value['username']) }}"
|
|
path: "{{ item.value['home'] | default('/home/' ~ item.value['username']) }}/public"
|
|
state: directory
|
|
loop: "{{ lookup('ansible.builtin.dict', hostvars[inventory_hostname]['users']) }}"
|
|
- name: Configure ProFTPd main control server
|
|
ansible.builtin.template:
|
|
backup: true
|
|
comment_end_string: "#}"
|
|
comment_start_string: "{#"
|
|
dest: /etc/proftpd/proftpd.conf
|
|
follow: true
|
|
force: true
|
|
group: root
|
|
owner: root
|
|
src: proftpd/proftpd.conf.j2
|
|
validate: proftpd --configtest
|
|
vars:
|
|
ftp_server_name: init
|
|
max_conns: 30
|
|
- name: Configure ProFTPd global settings
|
|
ansible.builtin.template:
|
|
backup: true
|
|
comment_end_string: "#}"
|
|
comment_start_string: "{#"
|
|
dest: /etc/proftpd/conf.d/global.conf
|
|
follow: true
|
|
force: true
|
|
group: root
|
|
owner: root
|
|
src: proftpd/conf.d/global.conf.j2
|
|
validate: proftpd --configtest
|
|
vars:
|
|
pasv_ports: "49152 65534"
|
|
allow_symlinks: false
|
|
- name: Add virtual users to ProFTPd
|
|
block:
|
|
- name: Create virtual user authentication files
|
|
ansible.builtin.file:
|
|
force: true
|
|
group: root
|
|
mode: "0640"
|
|
owner: root
|
|
path: "{{ item.value }}"
|
|
state: touch
|
|
loop: "{{ lookup('ansible.builtin.dict', config['proftpd']['auth_filepaths']) }}"
|
|
- name: Create the virtual users
|
|
when: "not 'caddy' in item.value['services'] and not 'httpd' in item.value['services'] and not 'www-data' in item.value['services'] and not 'http' in item.value['services'] and not 'https' in item.value['services']"
|
|
ansible.builtin.command:
|
|
argv:
|
|
- ftpasswd
|
|
- --passwd
|
|
- "--name={{ item.value['username'] }}"
|
|
- "--uid=$(id -u {{ item.value['id_of'] }})"
|
|
- "--gid=$(id -g {{ item.value['gid_of'] }})"
|
|
- "--home={{ hostvars[inventory_hostname]['users']['ftp']['home'] | default('/srv/ftp') }}/{{ item.value['username'] }}"
|
|
- --shell=/sbin/nologin
|
|
- --file={{ config['proftpd']['auth_filepaths']['users_path'] }}
|
|
- --stdin
|
|
stdin: "{{ item.value['password'] }}"
|
|
loop: "{{ lookup('ansible.builtin.dict', config['proftpd']['vusers']) }}"
|
|
- name: Create the virtual groups of virtual users
|
|
when: "not 'caddy' in item.value['services'] and not 'httpd' in item.value['services'] and not 'www-data' in item.value['services'] and not 'http' in item.value['services'] and not 'https' in item.value['services']"
|
|
ansible.builtin.command:
|
|
argv:
|
|
- ftpasswd
|
|
- --group
|
|
- "--name={{ item.value['username'] }}"
|
|
- "--gid=$(id -g {{ item.value['gid_of'] }})"
|
|
- "--member={{ item.value['username'] }}"
|
|
- --file={{ config['proftpd']['auth_filepaths']['groups_path'] }}
|
|
loop: "{{ lookup('ansible.builtin.dict', config['proftpd']['vusers']) }}"
|
|
# @TODO create tasks in block integrating LDAP users to ProFTPd
|
|
# - name: Integrate LDAP users into ProFTPd
|
|
- name: Create ProFTPd FTPS virtual host
|
|
ansible.builtin.template:
|
|
backup: true
|
|
comment_end_string: "#}"
|
|
comment_start_string: "{#"
|
|
dest: "/etc/proftpd/conf.d/{{ config['proftpd']['name'].lowercase() }}.conf"
|
|
follow: true
|
|
force: true
|
|
group: root
|
|
owner: root
|
|
src: "proftpd/conf.d/vhost@vps1-{{ hostvars[inventory_hostname].fqdn }}.conf.j2"
|
|
validate: proftpd --configtest
|
|
vars:
|
|
ftp_server_name: "{{ config['proftpd']['name'].uppercase() }}'s Archive'"
|
|
allowed_users: "{{ ','.join(list(map(lambda u: u['username'], filter(lambda u: not 'http' in u['services'] and not 'https' in u['services'] and not 'httpd' in u['services'] and not 'caddy' in u['services'] and not 'www-data' in u['services'], config['proftpd']['vusers'].values())))) }}"
|
|
anon_root: "{{ map(lambda u: u['home'], filter(lambda u: 'ftps' in u['services'] or 'proftpd' in u['services'], hostvars[inventory_hostname]['users'].values())) | list | random }}/public"
|
|
anon_user: "{{ config['proftpd']['vusers']['smuggler']['username'] }}"
|
|
- name: Set ProFTPd jail in fail2ban
|
|
block:
|
|
- name: Create fail2ban system configuration directory
|
|
ansible.builtin.file:
|
|
force: false
|
|
group: root
|
|
mode: "0755"
|
|
owner: root
|
|
path: /etc/fail2ban
|
|
state: directory
|
|
- name: Create fail2ban filters system configuration directory
|
|
ansible.builtin.file:
|
|
force: false
|
|
group: root
|
|
mode: "0755"
|
|
owner: root
|
|
path: /etc/fail2ban/filter.d
|
|
state: directory
|
|
- name: Create fail2ban filter system configuration
|
|
ansible.builtin.copy:
|
|
backup: true
|
|
dest: /etc/fail2ban/filter.d/custom_proftpd.conf
|
|
force: true
|
|
group: root
|
|
owner: root
|
|
src: fail2ban/filter.d/custom_proftpd.conf
|
|
# validate: string
|
|
- name: Create fail2ban jails system configuration directory
|
|
ansible.builtin.file:
|
|
force: false
|
|
group: root
|
|
mode: "0755"
|
|
owner: root
|
|
path: /etc/fail2ban/jail.d
|
|
state: directory
|
|
- name: Create fail2ban jail system configuration
|
|
ansible.builtin.copy:
|
|
backup: true
|
|
dest: /etc/fail2ban/jail.d/proftpd.local
|
|
force: true
|
|
group: root
|
|
owner: root
|
|
src: fail2ban/jail.d/proftpd.local
|
|
# validate: string
|