1b12c90f32
* update awx-tower to RHAAP Signed-off-by: Jens Langhammer <jens@goauthentik.io> * migrate to new quotation Signed-off-by: Jens Langhammer <jens@goauthentik.io> * update all Signed-off-by: Jens Langhammer <jens@goauthentik.io> --------- Signed-off-by: Jens Langhammer <jens@goauthentik.io>
117 lines
4.9 KiB
Markdown
117 lines
4.9 KiB
Markdown
---
|
|
title: ProFTPD
|
|
---
|
|
|
|
<span class="badge badge--secondary">Support level: Community</span>
|
|
|
|
## What is ProFTPD
|
|
|
|
> ProFTPD is a high-performance, extremely configurable, and most of all a secure FTP server, featuring Apache-like configuration and blazing performance.
|
|
>
|
|
> -- From http://www.proftpd.org
|
|
|
|
This integration leverages authentik's LDAP for the identity provider to achieve an SSO experience. See [ldap provider generic setup](../../../docs/providers/ldap/generic_setup) for setting up the LDAP provider.
|
|
|
|
## Preparation
|
|
|
|
The following placeholders will be used:
|
|
|
|
- `authentik.company` is the FQDN of the authentik install.
|
|
|
|
## authentik Configuration
|
|
|
|
### Step 1 - Service account
|
|
|
|
Create a new user account _(or re-use an existing one)_ for ProFTPD to use for LDAP bind under _Directory_ -> _Users_ -> _Create_ and give the account a name, such as `ldapservice`.
|
|
|
|
:::note
|
|
On default provider settings, the DN of this user will be `cn=ldapservice,ou=users,dc=ldap,dc=goauthentik,dc=io`
|
|
:::
|
|
|
|
This user must be part of a group which allows LDAP search queries. If you don't have a group for that yet, create one (e.g. `LDAPServiceUsers`) and add the user `ldapservice` to that group. You can specify that group during the provider creation below.
|
|
|
|
:::note
|
|
_If you are unfamiliar with LDAP_: A bind account is used for authentication against the LDAP server itself - similar to an API key in modern applications.
|
|
:::
|
|
|
|
### Step 2 - LDAP Provider
|
|
|
|
In authentik, create a LDAP provider (under _Applications/Providers_). This is an example for the settings:
|
|
|
|
- Name : `provider-ldap` - or choose any
|
|
- Bind DN : `DC=ldap,DC=goauthentik,DC=io`
|
|
- Search group : `LDAPServiceUsers`
|
|
- Certificate : `authentik Self-signed Certificate`
|
|
|
|
### Step 3 - Application
|
|
|
|
In authentik, create an application (under _Resources/Applications_) with these settings :
|
|
|
|
- Name: `FTP` - or choose any
|
|
- Provider: Choose the provider you created in _Step 2_
|
|
|
|
### Step 4 - Outpost
|
|
|
|
If not done yet, create an outpost (under _Applications/Outposts_) of type `LDAP` that includes the LDAP Application you created in _Step 3_. You can also use an existing outpost, just make sure to edit it and to also include the just created application in the respective field.
|
|
|
|
### Step 5 - Create a group for restricting access
|
|
|
|
_Optionally_, create a new group like `ftpusers` to scope access to the ftp server.
|
|
|
|
## ProFTPD configuration
|
|
|
|
Ensure that the ProFTPD LDAP plugin is installed, which may be included in the distribution package `proftpd-ldap`.
|
|
|
|
Check that `LoadModule mod_ldap.c` is not commented out in `/etc/proftpd/modules.conf`.
|
|
|
|
Edit your ProFTPD configuration, usually located under `/etc/proftpd.conf`. You can use the following LDAP configuration as a starting point.
|
|
|
|
```bash
|
|
DefaultRoot /your/ftp/storage/dir
|
|
|
|
<IfModule mod_ldap.c>
|
|
LDAPAuthBinds on
|
|
# Replace this with the server-url:port of your LDAP outpost
|
|
LDAPServer authentik.company:389
|
|
# The LDAP Bind account must be specified here
|
|
LDAPBindDN cn=ldapservice,ou=users,dc=ldap,dc=goauthentik,dc=io PASSWORDOFLDAPSERVICE
|
|
# The second parameter is optional
|
|
# In this case I am restricting access to the group ftpusers
|
|
# Instead you could also create bind policies in your created authentik application
|
|
LDAPUsers ou=users,dc=ldap,dc=goauthentik,dc=io (&(objectClass=user)(cn=%u)(memberOf=cn=ftpusers,ou=groups,dc=ldap,dc=goauthentik,dc=io))
|
|
|
|
# In this example, I am forcing the permission of all files to the system user/group 1000
|
|
LDAPDefaultUID 1000
|
|
LDAPDefaultGID 1000
|
|
LDAPForceDefaultUID on
|
|
LDAPForceDefaultGID on
|
|
|
|
# This way I am making a shared folder, which all ftp users share
|
|
LDAPGenerateHomedir on
|
|
LDAPGenerateHomedirPrefix /your/ftp/storage/dir
|
|
LDAPGenerateHomedirPrefixNoUsername on
|
|
|
|
LDAPLog /var/log/mod_ldap.log
|
|
|
|
RequireValidShell off
|
|
|
|
LDAPAttr uid cn
|
|
|
|
LDAPSearchScope subtree
|
|
</IfModule>
|
|
```
|
|
|
|
In this example, every user shares a single folder. If you want to have separate folders for each user, you can adapt the `LDAPGenerateHomedirPrefixNoUsername` setting.
|
|
|
|
Additionally, note that each file will have Linux user and group ID `1000`. Beforehand, make sure that the respective Linux user exists (usually the first Linux user created receives ID `1000`). Check `/etc/passwd` and create a user if necessary.
|
|
|
|
If you do not set `LDAPForceDefaultUID`/`LDAPForceDefaultGID`, Authentik's `uidNumber` field will be used. If you do not set `LDAPGenerateHomedir`, Authentik's `homeDirectory` field will be used (`/home/$username`). For more information about default attributes provided by Authentik, refer to the [LDAP Provider documentation](../../../docs/providers/ldap).
|
|
|
|
Make sure to read ProFTPD's [available LDAP options](http://www.proftpd.org/docs/contrib/mod_ldap.html).
|
|
|
|
Finally, after adding the configuration, restart ProFTPD.
|
|
|
|
:::note
|
|
If login fails, make sure to check the logs of the LDAP plugin: `tail -f /var/log/mod_ldap.log`.
|
|
:::
|