diff --git a/website/integrations/services/proftpd/index.md b/website/integrations/services/proftpd/index.md new file mode 100644 index 000000000..870793095 --- /dev/null +++ b/website/integrations/services/proftpd/index.md @@ -0,0 +1,116 @@ +--- +title: ProFTPD +--- + +Support level: Community + +## What is ProFTPD + +:::note +ProFTPD is a high-performance, open-source FTP server software designed for Unix and Linux systems. It supports various features, including IPv6, SSL/TLS encryption, virtual hosting, advanced logging, and supports various authentication methods, including LDAP and MySQL. +::: + +This integration leverages authentik's LDAP for the identity provider to achieve an SSO experience. See [ldap provider generic setup](../../../docs/providers/ldap/generic_setup) for setting up the LDAP provider. + +## Preparation + +The following placeholders will be used: + +- `authentik.company` is the FQDN of the authentik install. + +## authentik Configuration + +### Step 1 - Service account + +Create a new user account _(or re-use an existing one)_ for ProFTPD to use for LDAP bind under _Directory_ -> _Users_ -> _Create_ and give the account a name, such as `ldapservice`. + +:::note +On default provider settings, the DN of this user will be `cn=ldapservice,ou=users,dc=ldap,dc=goauthentik,dc=io` +::: + +This user must be part of a group which allows LDAP search queries. If you don't have a group for that yet, create one (e.g. `LDAPServiceUsers`) and add the user `ldapservice` to that group. You can specify that group during the provider creation below. + +:::note +_If you are unfamiliar with LDAP_: A bind account is used for authentication against the LDAP server itself - similar to an API key in modern applications. +::: + +### Step 2 - LDAP Provider + +In authentik, create a LDAP provider (under _Applications/Providers_). This is an example for the settings: + +- Name : `provider-ldap` - or choose any +- Bind DN : `DC=ldap,DC=goauthentik,DC=io` +- Search group : `LDAPServiceUsers` +- Certificate : `authentik Self-signed Certificate` + +### Step 3 - Application + +In authentik, create an application (under _Resources/Applications_) with these settings : + +- Name: `FTP` - or choose any +- Provider: Choose the provider you created in _Step 2_ + +### Step 4 - Outpost + +If not done yet, create an outpost (under _Applications/Outposts_) of type `LDAP` that includes the LDAP Application you created in _Step 3_. You can also use an existing outpost, just make sure to edit it and to also include the just created application in the respective field. + +### Step 5 - Create a group for restricting access + +_Optionally_, create a new group like `ftpusers` to scope access to the ftp server. + +## ProFTPD configuration + +Ensure that the ProFTPD LDAP plugin is installed, which may be included in the distribution package `proftpd-ldap`. + +Check that `LoadModule mod_ldap.c` is not commented out in `/etc/proftpd/modules.conf`. + +Edit your ProFTPD configuration, usually located under `/etc/proftpd.conf`. You can use the following LDAP configuration as a starting point. + +```bash +DefaultRoot /your/ftp/storage/dir + + + LDAPAuthBinds on + # Replace this with the server-url:port of your LDAP outpost + LDAPServer authentik.company:389 + # The LDAP Bind account must be specified here + LDAPBindDN cn=ldapservice,ou=users,dc=ldap,dc=goauthentik,dc=io PASSWORDOFLDAPSERVICE + # The second parameter is optional + # In this case I am restricting access to the group ftpusers + # Instead you could also create bind policys in your created authentik application + LDAPUsers ou=users,dc=ldap,dc=goauthentik,dc=io (&(objectClass=user)(cn=%u)(memberOf=cn=ftpusers,ou=groups,dc=ldap,dc=goauthentik,dc=io)) + + # In this example, I am forcing the permission of all files to the system user/group 1000 + LDAPDefaultUID 1000 + LDAPDefaultGID 1000 + LDAPForceDefaultUID on + LDAPForceDefaultGID on + + # This way I am making a shared folder, which all ftp users share + LDAPGenerateHomedir on + LDAPGenerateHomedirPrefix /your/ftp/storage/dir + LDAPGenerateHomedirPrefixNoUsername on + + LDAPLog /var/log/mod_ldap.log + + RequireValidShell off + + LDAPAttr uid cn + + LDAPSearchScope subtree + +``` + +In this example, every user shares a single folder. If you want to have separate folders for each user, you can adapt the `LDAPGenerateHomedirPrefixNoUsername` setting. + +Additionally, note that each file will have Linux user and group ID `1000`. Beforehand, make sure that the respective Linux user exists (usually the first Linux user created receives ID `1000`). Check `/etc/passwd` and create a user if necessary. + +If you do not set `LDAPForceDefaultUID`/`LDAPForceDefaultGID`, Authentik's `uidNumber` field will be used. If you do not set `LDAPGenerateHomedir`, Authentik's `homeDirectory` field will be used (`/home/$username`). For more information about default attributes provided by Authentik, refer to the [LDAP Provider documentation](../../../docs/providers/ldap). + +Make sure to read ProFTPD's [available LDAP options](http://www.proftpd.org/docs/contrib/mod_ldap.html). + +Finally, after adding the configuration, restart ProFTPD. + +:::note +If login fails, make sure to check the logs of the LDAP plugin: `tail -f /var/log/mod_ldap.log`. +::: diff --git a/website/sidebarsIntegrations.js b/website/sidebarsIntegrations.js index d8419904d..4d3a9ad9b 100644 --- a/website/sidebarsIntegrations.js +++ b/website/sidebarsIntegrations.js @@ -71,6 +71,7 @@ module.exports = { "services/pgadmin/index", "services/phpipam/index", "services/powerdns-admin/index", + "services/proftpd/index", "services/qnap-nas/index", "services/skyhigh/index", "services/snipe-it/index",