smeserver/smeserver-proftpd
6
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

* Sat Feb 15 2025 Jean-Philippe Pialasse <jpp@koozali.org> 11.0.0-7.sme

Browse Source 
- disable anonymous by default [SME: 931]
- add passive port [SME: 12454]
- TLSv1.3 filtered out as not supported by 1.3.6 branch [SME: 12925]
- fix wrong group defined for ibays [SME: 7914]
- drop runit for full systemd service unit [SME: 12874]
This commit is contained in:
Jean-Philippe Pialasse 2025-02-16 02:09:38 -05:00
parent 3cbe389a9e
commit 4be10f2b17
19 changed files with 81 additions and 90 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
README.md
View File

@ -3,7 +3,7 @@
SMEServer Koozali developed git repo for smeserver-proftpd smeserver
## Wiki
<br />https://wiki.koozali.org/
<br />https://wiki.koozali.org/ftp
## Bugzilla
Show list of outstanding bugs:
@ -18,8 +18,23 @@ And a list of outstanding Legacy bugs: (e-smith-proftpd) [here](https://bugs.koo
## Description
<br />*This description has been generated by an LLM AI system and cannot be relied on to be fully correct.*
*Once it has been checked, then this comment will be deleted*
<br />
smeserver-Proftpd is an open source software package that allows users to easily set up an FTP server on their Linux or Unix-based system. It is a part of the smeserver software family, which consists of a number of professional tools for system administrators. The package provides a secure and reliable way to transfer files over the internet. It provides a wide range of features, such as virtual hosting, bandwidth throttling, file transfer logging, and support for stand-alone or inetd/xinetd operations. It is a powerful and versatile tool, and is ideal for those who want to manage and share files from their own web server.
## Configuration
db show ftp
- CipherSuite= $modSSL{CipherSuite} || $smeCiphers;
- DisableAnonymous=yes (was no as default before SME11)
- LoginAccess=private
- TCPPorts=49200:49999
- TCPPort=21
- TLSEnable=on
- TLSRequired=on
- TLSVerifyClient=off
- access=private
- status=disabled
db accounts
- ibay{'DisableAnonymous'}=no
- ibay{'UserAccess'}
- ibay{'PublicAccess'}= 'none';
- user{ChrootDir'}|| $ftp{'ChrootDir'} || disabled;

9
createlinks
View File

@ -2,8 +2,6 @@
use esmith::Build::CreateLinks qw(:all);
safe_symlink("proftpd", "root/var/service/ftp");
templates2events("/etc/logrotate.d/proftpd", qw(
bootstrap-console-save
smeserver-proftpd-update
@ -41,6 +39,13 @@ templates2events("/etc/proftpd.conf", qw(
ssl-update
));
templates2events("/usr/lib/systemd/system/ftp.service.d/50koozali.conf", qw(
bootstrap-console-save
smeserver-proftpd-update
ssl-update
));
foreach my $event (qw(
remoteaccess-update))
{

1
root/etc/e-smith/db/configuration/defaults/ftp/TCPPorts Normal file
View File

@ -0,0 +1 @@
49200:49999

6
root/etc/e-smith/templates/etc/proftpd.conf/05portPassive Normal file
View File

@ -0,0 +1,6 @@
{
my $PassivePorts=$ftp{TCPPorts}||'49200:49999"';
$PassivePorts=~ s/:/ /;
$PassivePorts="49200 49999" if (index(',', $PassivePorts) != -1);
$OUT= "PassivePorts $PassivePorts\n";
}

9
root/etc/e-smith/templates/etc/proftpd.conf/06ModTLS
View File

@ -1,5 +1,5 @@
{
use esmith::ssl;
use esmith::ssl;
#check if TLS is enabled
if (($ftp{TLSEnable} || 'on') eq 'on') {
@ -21,7 +21,10 @@
$chain_file = "# no chain cert" unless -e $chain_file;
$chain_file = ( $chain_file eq "# no chain cert" )? $chain_file : "TLSCertificateChainFile $chain_file";
my $ciphers = $modSSL{CipherSuite} || $ftp{CipherSuite} || $smeCiphers;
my $ciphers = $ftp{CipherSuite} || $modSSL{CipherSuite} || $smeCiphers;
#SME11 proftpd 1.3.6 branch does not support TLS v1.3
$smeSSLprotocol =~ s/TLSv1.3//;
# NoSessionReuseRequired is required with newer clients and TLS to be bale to list folder
$OUT .= <<SSL_END;
<IfModule mod_tls.c>
@ -29,7 +32,7 @@ TLSEngine on
TLSLog /var/log/proftpd/tls.log
TLSProtocol $smeSSLprotocol
TLSCipherSuite $ciphers
TLSOptions NoCertRequest AllowClientRenegotiations
TLSOptions NoCertRequest AllowClientRenegotiations NoSessionReuseRequired
TLSRSACertificateFile $crt
TLSRSACertificateKeyFile $key
$chain_file

2
root/etc/e-smith/templates/etc/proftpd.conf/40IBayAccess
View File

@ -32,7 +32,7 @@
$OUT .= "\n";
$OUT .= "<Directory /home/e-smith/files/ibays/$key/*>\n";
$OUT .= " AllowOverwrite on\n";
$OUT .= " GroupOwner shared\n";
$OUT .= " GroupOwner ".$properties{'Group'}."\n";
$OUT .= " Umask $umask\n";
$OUT .= " <Limit WRITE>\n";
$OUT .= " AllowAll\n";

2
root/etc/e-smith/templates/etc/proftpd.conf/50AnonymousPrimary
View File

@ -3,7 +3,7 @@
# How to handle anonymous FTP logins: chroot to the Primary
# i-bay files directory.
#------------------------------------------------------------
return "" if ($ftp{DisableAnonymous} || 'no') eq 'yes';
return "" if ($ftp{DisableAnonymous} || 'yes') eq 'yes';
$OUT = << 'EOF';
<Anonymous /home/e-smith/files/ibays/Primary/files>

4
root/etc/e-smith/templates/etc/proftpd.conf/60AnonymousIBay
View File

@ -3,6 +3,7 @@
# How to handle logins from information bay accounts: chroot to the
# files part of the information bay directory.
#------------------------------------------------------------
return "# Anonymous access disabled by default" unless(( $ftp{DisableAnonymous} || "yes") eq "yes");
use esmith::AccountsDB;
use Net::IPv4Addr qw(ipv4_parse);
@ -56,8 +57,7 @@
# variables: $allow (IP), $pass (bool)
if ( ($ftp{DisableAnonymous} || 'no') ne 'yes' &&
($ibay->prop('DisableAnonymous') || 'no') ne 'yes' )
if ( ($ibay->prop('DisableAnonymous') || 'no') ne 'yes' )
{
$OUT .= "\n";
$OUT .= "<Anonymous /home/e-smith/files/ibays/$key/files>\n";

10
root/etc/e-smith/templates/usr/lib/systemd/system/ftp.service.d/50koozali.conf/40service Normal file
View File

@ -0,0 +1,10 @@
[Service]
Environment=
Environment={
$OUT = "CONCURRENCYREMOTE=". ($ftp{Instances} || "40");
$OUT .= " PER_IP_INSTANCES=". ($ftp{InstancesPerIP} || "4");
$OUT .= " LOCALNAME=$SystemName.$DomainName";
$OUT .= " LISTENIP=0";
$OUT .= " PORT=". ($ftp{TCPPort} || "21");
}

0
root/var/service/proftpd/control/1 → root/sbin/e-smith/systemd/ftp-tcpsvd
View File

1
root/service/ftp
View File

@ -1 +0,0 @@
/var/service/proftpd

22
root/usr/lib/systemd/system/ftp.service
View File

@ -4,12 +4,24 @@ After=network.target
Requires=runit.service
[Service]
Type=oneshot
Type=simple
SyslogIdentifier=proftpd
Environment=CONCURRENCYREMOTE=40 PER_IP_INSTANCES=4 LOCALNAME=0 LISTENIP=0 PORT=ftp
WorkingDirectory=/var/service/proftpd/
ExecStartPre=/sbin/e-smith/service-status ftp
ExecStart=/usr/bin/sv u /service/ftp
ExecStop=/usr/bin/sv stop /service/ftp
ExecReload=/usr/bin/sv t /service/ftp
RemainAfterExit=yes
ExecStartPre=/sbin/e-smith/systemd/ftp-tcpsvd
ExecStart=/usr/bin/tcpsvd \
-v \
-i ./peers \
-c $CONCURRENCYREMOTE \
-C ${PER_IP_INSTANCES}:'421 per host concurrency limit reached\r\n' \
-l $LOCALNAME \
$LISTENIP \
$PORT \
/usr/sbin/in.proftpd
ExecReload=/bin/kill -HUP $MAINPID
Restart=always
RestartSec=20s
[Install]
WantedBy=sme-server.target

0
root/var/service/proftpd/env/.gitignore → root/usr/lib/systemd/system/ftp.service.d/.gitignore vendored
View File

0
root/var/service/proftpd/down
View File

23
root/var/service/proftpd/log/run
View File

@ -1,23 +0,0 @@
#!/bin/sh
#----------------------------------------------------------------------
# copyright (C) 2003-2006 Mitel Networks Corporation
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
#----------------------------------------------------------------------
exec \
/usr/bin/setuidgid smelog \
/usr/bin/multilog t s5000000 \
/var/log/ftp

0
root/var/service/proftpd/log/supervise/.gitignore vendored
View File

36
root/var/service/proftpd/run
View File

@ -1,36 +0,0 @@
#!/bin/sh
#----------------------------------------------------------------------
# copyright (C) 2003-5 Mitel Networks Corporation
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
#
# Technical support for this program is available from Mitel Networks
# Please visit our web site www.mitel.com/sme/ for details.
#----------------------------------------------------------------------
[ -f ./runenv ] && . ./runenv
exec 2>&1
# Adjust ACLs in ./peers
./control/1
exec /usr/bin/tcpsvd \
-v \
-i ./peers \
-c ${CONCURRENCYREMOTE:-40} \
-C ${PER_IP_INSTANCES:-4}:'421 per host concurrency limit reached\r\n' \
-l ${LOCALNAME:-0} \
${LISTENIP:-0} \
${PORT:-ftp} \
/usr/sbin/in.proftpd

0
root/var/service/proftpd/supervise/.gitignore vendored
View File

21
smeserver-proftpd.spec
View File

@ -4,7 +4,7 @@ Summary: smeserver specific proftpd configuration files and templates
%define name smeserver-proftpd
Name: %{name}
%define version 11.0.0
%define release 6
%define release 7
Version: %{version}
Release: %{release}%{?dist}
License: GPL
@ -26,6 +26,13 @@ Provides: e-smith-proftpd
AutoReqProv: no
%changelog
* Sat Feb 15 2025 Jean-Philippe Pialasse <jpp@koozali.org> 11.0.0-7.sme
- disable anonymous by default [SME: 931]
- add passive port [SME: 12454]
- TLSv1.3 filtered out as not supported by 1.3.6 branch [SME: 12925]
- fix wrong group defined for ibays [SME: 7914]
- drop runit for full systemd service unit [SME: 12874]
* Sun Jan 26 2025 Jean-Philippe Pialasse <jpp@koozali.org> 11.0.0-6.sme
- adding requirement for deamontools bin [SME: 12566]
@ -630,14 +637,8 @@ rm -rf $RPM_BUILD_ROOT
rm -f %{name}-%{version}-%{release}-filelist
/sbin/e-smith/genfilelist $RPM_BUILD_ROOT \
--dir /var/service/proftpd 'attr(01755,root,root)' \
--file /var/service/proftpd/down 'attr(0644,root,root)' \
--file /var/service/proftpd/run 'attr(0755,root,root)' \
--file /var/service/proftpd/control/1 'attr(0755,root,root)' \
--dir /var/service/proftpd/log 'attr(0755,root,root)' \
--dir /var/service/proftpd/log/supervise 'attr(0700,root,root)' \
--dir /var/service/proftpd/supervise 'attr(0700,root,root)' \
--file /var/service/proftpd/log/run 'attr(0755,root,root)' \
--dir /var/log/ftp 'attr(2750,smelog,smelog)' \
--dir /var/log/ftp 'attr(2750,root,root)' \
--file /sbin/e-smith/systemd/ftp-tcpsvd 'attr(0554,root,root)' \
> %{name}-%{version}-%{release}-filelist
echo "%doc COPYING" >> %{name}-%{version}-%{release}-filelist
@ -645,8 +646,6 @@ echo "%doc COPYING" >> %{name}-%{version}-%{release}-filelist
rm -rf $RPM_BUILD_ROOT
%pre
/sbin/e-smith/create-system-user smelog 1002 \
'sme log user' /var/log/smelog /bin/false
%files -f %{name}-%{version}-%{release}-filelist
%defattr(-,root,root)