authentik/website/integrations/services/proftpd/index.md

title
ProFTPD

Support level: Community

What is ProFTPD

:::note ProFTPD is a high-performance, open-source FTP server software designed for Unix and Linux systems. It supports various features, including IPv6, SSL/TLS encryption, virtual hosting, advanced logging, and supports various authentication methods, including LDAP and MySQL. :::

This integration leverages authentik's LDAP for the identity provider to achieve an SSO experience. See ldap provider generic setup for setting up the LDAP provider.

Preparation

The following placeholders will be used:

• authentik.company is the FQDN of the authentik install.

authentik Configuration

Step 1 - Service account

Create a new user account (or re-use an existing one) for ProFTPD to use for LDAP bind under Directory -> Users -> Create and give the account a name, such as ldapservice.

:::note On default provider settings, the DN of this user will be cn=ldapservice,ou=users,dc=ldap,dc=goauthentik,dc=io :::

This user must be part of a group which allows LDAP search queries. If you don't have a group for that yet, create one (e.g. LDAPServiceUsers) and add the user ldapservice to that group. You can specify that group during the provider creation below.

:::note If you are unfamiliar with LDAP: A bind account is used for authentication against the LDAP server itself - similar to an API key in modern applications. :::

Step 2 - LDAP Provider

In authentik, create a LDAP provider (under Applications/Providers). This is an example for the settings:

• Name : provider-ldap - or choose any
• Bind DN : DC=ldap,DC=goauthentik,DC=io
• Search group : LDAPServiceUsers
• Certificate : authentik Self-signed Certificate

Step 3 - Application

In authentik, create an application (under Resources/Applications) with these settings :

• Name: FTP - or choose any
• Provider: Choose the provider you created in Step 2

Step 4 - Outpost

If not done yet, create an outpost (under Applications/Outposts) of type LDAP that includes the LDAP Application you created in Step 3. You can also use an existing outpost, just make sure to edit it and to also include the just created application in the respective field.

Step 5 - Create a group for restricting access

Optionally, create a new group like ftpusers to scope access to the ftp server.

ProFTPD configuration

Ensure that the ProFTPD LDAP plugin is installed, which may be included in the distribution package proftpd-ldap.

Check that LoadModule mod_ldap.c is not commented out in /etc/proftpd/modules.conf.

Edit your ProFTPD configuration, usually located under /etc/proftpd.conf. You can use the following LDAP configuration as a starting point.

DefaultRoot /your/ftp/storage/dir

<IfModule mod_ldap.c>
    LDAPAuthBinds on
    # Replace this with the server-url:port of your LDAP outpost
    LDAPServer authentik.company:389
    # The LDAP Bind account must be specified here
    LDAPBindDN cn=ldapservice,ou=users,dc=ldap,dc=goauthentik,dc=io PASSWORDOFLDAPSERVICE
    # The second parameter is optional
    #  In this case I am restricting access to the group ftpusers
    #  Instead you could also create bind policies in your created authentik application
    LDAPUsers ou=users,dc=ldap,dc=goauthentik,dc=io (&(objectClass=user)(cn=%u)(memberOf=cn=ftpusers,ou=groups,dc=ldap,dc=goauthentik,dc=io))

    # In this example, I am forcing the permission of all files to the system user/group 1000
    LDAPDefaultUID 1000
    LDAPDefaultGID 1000
    LDAPForceDefaultUID on
    LDAPForceDefaultGID on

    # This way I am making a shared folder, which all ftp users share
    LDAPGenerateHomedir on
    LDAPGenerateHomedirPrefix /your/ftp/storage/dir
    LDAPGenerateHomedirPrefixNoUsername on

    LDAPLog /var/log/mod_ldap.log

    RequireValidShell off

    LDAPAttr uid cn

    LDAPSearchScope subtree
</IfModule>

In this example, every user shares a single folder. If you want to have separate folders for each user, you can adapt the LDAPGenerateHomedirPrefixNoUsername setting.

Additionally, note that each file will have Linux user and group ID 1000. Beforehand, make sure that the respective Linux user exists (usually the first Linux user created receives ID 1000). Check /etc/passwd and create a user if necessary.

If you do not set LDAPForceDefaultUID/LDAPForceDefaultGID, Authentik's uidNumber field will be used. If you do not set LDAPGenerateHomedir, Authentik's homeDirectory field will be used (/home/$username). For more information about default attributes provided by Authentik, refer to the LDAP Provider documentation.

Make sure to read ProFTPD's available LDAP options.

Finally, after adding the configuration, restart ProFTPD.

:::note If login fails, make sure to check the logs of the LDAP plugin: tail -f /var/log/mod_ldap.log. :::