FTP

This service will install and configure ProFTPD and manage virtual users.

Warning

For your daily project work, FTP is not required. Access through SSH/SCP is far more superior and secure (see SSH). Use FTP only to transfer files from and to certain directories if the other side does not support SCP.

Users

adds a FTP User
password: crypt password as used in /etc/passwd
uid: Linux system user id of desired user. Lookup on server before adding.
gid: Linux system group id of desired group. Lookup on server before adding.
home: access is restricted to this directory

Configure the ftp::users hash within the Custom JSON Server Level Configuration:

{
  "ftp::users": {
    "alice": {
      "password": "$6$1sLLOf5.$GAZDHYXEjs0MpR5uHBAR5eD00MpUasTgbyIP27PZ8WprL98XeU01N502ogYn1JKrgqEiTXn1/lkFBNZ46zZHY/",
      "uid": "1005",
      "gid": "1005",
      "home": "/home/examplenet/www/webcam/"
    }
  }
}

Tip

The password has to be encrypted. Use the following command to encrypt your desired password: mkpasswd -m sha-512

Tip

Use the “id” command to determine the appropriate uid/gid

Directories

add custom per directory options
see ProFTPD Documentation for Details: http://www.proftpd.org/docs/

Configure the ftp::directories hash within the Custom JSON Server Level Configuration:

{
  "ftp::directories": {
    "/home/examplenet/tmp/": {
      "limit": {
        "WRITE": {
          "DenyAll": null,
          "AllowUser": "alice"
        }
      }
    }
  }
}

will led to this ProFTPD configuration:

<Directory /home/examplenet/tmp/>
    <Limit WRITE>
        DenyAll undef
        AllowUser alice
    </Limit>
</Directory>

TLS Certificates

TLS is enabled and required by default

Warning

You can disable the TLS requirement by setting the ftp::wrapper::proftpd::tlsrequired string to off. As the FTP connection is not encrypted anymore, this option is strongly not recommended. Please contact us to find another solution.

Default Certificate

If not configured otherwise (see below), a self signed certificate bearing the hostname of the server will be created and used for ProFTPD.

Own Certificate

Specify your own certificate with the tls_key and tls_crt options.

Configure the ftp::wrapper::proftpd::tls_crt and ftp::wrapper::proftpd::tls_key strings within the Custom JSON Server Level Configuration:

{
  "ftp::wrapper::proftpd::tls_crt": "-----BEGIN CERTIFICATE-----\nMY-TLS-CERTIFICATE\n",
  "ftp::wrapper::proftpd::tls_key": "-----BEGIN PRIVATE KEY-----\nMY-TLS-KEY"
}

Own Certificate from File

Another option is to use existing certificates already in place on this server, for example one thats used with apache already. Configure the locations with the ftp::wrapper::proftpd::tls_crt_file and ftp::wrapper::proftpd::tls_key_file strings within the Custom JSON Server Level Configuration. For own certificates, you can use the following paths:

{
  "ftp::wrapper::proftpd::tls_crt_file": "/etc/apache2/certs/<websitename>.crt",
  "ftp::wrapper::proftpd::tls_key_file": "/etc/apache2/certs/<websitename>.key"
}

For Let’s Encrypt certificates, you can use the following paths:

{
  "ftp::wrapper::proftpd::tls_crt_file": "/etc/apache2/md/domains/<domain>/pubcert.pem",
  "ftp::wrapper::proftpd::tls_key_file": "/etc/apache2/md/domains/<domain>/privkey.pem"
}

Default Firewall Rule

By default, firewall rules to allow incoming ports 21 (FTP) and 49152-49162 (FTP data) will be added. To disable those default rules, set ftp::wrapper::proftpd::nftables to false within the Custom JSON Server Level Configuration:

{
  "ftp::wrapper::proftpd::nftables": false
}

Note

Please make sure to allow access for our internal monitoring system manually (IPv4: 185.17.70.112, IPv6: 2a04:503:0:1008::112)