Proftpd with Openssl and virtual users: Difference between revisions
No edit summary |
m 1 revision imported |
(No difference)
| |
Revision as of 08:58, 22 June 2015
For detailed info, look here http://forum.qnap.com/viewtopic.php?f=90&t=3499&p=16283 and here viewtopic.php?f=90&t=2851&p=16280
This is how I did it...
First install Optware/ IPKG
You need Optware/IPKG
- a. Go to administration web login and go to Applications - QPKG Center and install Optware, also read http://wiki.qnap.com/wiki/Install_Optware_IPKG
- b. Don't forget to enable Optware in administration web login - Applications - QPKG Center (click 'Enable' ) after installation and then restart the NAS. If you have not restarted, you need at least to do
PATH=$PATH:/opt/bin:/opt/sbin
Installing stuff
First I go to a temp folder (so the littering files stays here)
mkdir /opt/temp
cd /opt/temp
Install (to install perl, you can also do like this http://wiki.qnap.com/wiki/Perl_5.8.8_Installation )
/opt/bin/ipkg update
/opt/bin/ipkg install proftpd
/opt/bin/ipkg install perl
Get ftpasswd
From the source (I did this), find your favorite downloading/mirror site here http://www.proftpd.org/ or download from ftp://ftp.proftpd.org/distrib/source/ :
cd /opt/temp
wget ftp://ftp-stud.fht-esslingen.de/pub/Mirrors/ftp.proftpd.net/devel/source/proftpd-cvs-20080226.tar.gz
tar xvfz proftpd-cvs-20080226.tar.gz
cp /opt/temp/proftpd-cvs-20080226/contrib/ftpasswd /opt/bin/
rm proftpd-cvs-20080226* -r
Or maybe you prefer to get it from castaglia.org? I guess you could do like this:
cd /opt/bin/
wget http://www.castaglia.org/proftpd/contrib/ftpasswd
chmod 700 ftpasswd
If you installed perl with ipkg, open ftpasswd and change it with (if you installed with http://wiki.qnap.com/wiki/Perl_5.8.8_Installation, you don't need to change it):
vi /opt/bin/ftpasswd
From:
#!/usr/bin/perl
To:
#!/opt/bin/perl
Make one virtual user to test with
mkdir /home/proftpusers
mkdir /home/proftpusers/bob
cd /opt/etc/ftpd
/opt/bin/ftpasswd --passwd --name=bob --uid=1001 --home=/home/proftpusers/bob --shell=/bin/false
Openssl
mkdir /opt/etc/openssl
chmod 600 /opt/etc/openssl
cd /opt/etc/openssl
touch sign.sh
vi sign.sh
I paste this into sign.sh:
#!/bin/sh
##
## sign.sh -- Sign a SSL Certificate Request (CSR)
## Copyright (c) 1998-2001 Ralf S. Engelschall, All Rights Reserved.
##
# argument line handling
CSR=$1
if [ $# -ne 1 ]; then
echo "Usage: sign.sign <whatever>.csr"; exit 1
fi
if [ ! -f $CSR ]; then
echo "CSR not found: $CSR"; exit 1
fi
case $CSR in
*.csr ) CERT="`echo $CSR | sed -e 's/\.csr/.crt/'`" ;;
* ) CERT="$CSR.crt" ;;
esac
# make sure environment exists
if [ ! -d ca.db.certs ]; then
mkdir ca.db.certs
fi
if [ ! -f ca.db.serial ]; then
echo '01' >ca.db.serial
fi
if [ ! -f ca.db.index ]; then
cp /dev/null ca.db.index
fi
# create an own SSLeay config
cat > ca.config <<EOT
[ ca ]
default_ca = CA_own
[ CA_own ]
dir = .
certs = \$dir
new_certs_dir = \$dir/ca.db.certs
database = \$dir/ca.db.index
serial = \$dir/ca.db.serial
RANDFILE = \$dir/ca.db.rand
certificate = \$dir/ca.crt
private_key = \$dir/ca.key
unique_subject = no
# default key expiry set to 5 years but can be changed
default_days = 1825
default_crl_days = 30
default_md = md5
preserve = no
policy = policy_anything
[ policy_anything ]
countryName = optional
stateOrProvinceName = optional
localityName = optional
organizationName = optional
organizationalUnitName = optional
commonName = supplied
emailAddress = optional
EOT
# sign the certificate
echo "CA signing: $CSR -> $CERT:"
openssl ca -config ca.config -out $CERT -infiles $CSR
echo "CA verifying: $CERT <-> CA cert"
openssl verify -CAfile ca.crt $CERT
# cleanup after SSLeay
rm -f ca.config
rm -f ca.db.serial.old
rm -f ca.db.index.old
# die gracefully
exit 0
Make sign.sh owned by root and executable
chown admin:administrators /opt/etc/openssl/sign.sh
chmod 700 /opt/etc/openssl/sign.sh
Creating the Keys and Certificates
openssl genrsa -des3 -out ca.key 1024
mv ca.key ca.key.orig
openssl rsa -in ca.key.orig -out ca.key
openssl req -new -x509 -days 1825 -key ca.key -out ca.crt
cp /opt/etc/openssl/ca.crt /opt/etc/ftpd/
openssl genrsa -des3 -out server.key 1024
mv server.key server.key.orig
openssl rsa -in server.key.orig -out server.key
cp /opt/etc/openssl/server.key /opt/etc/ftpd/
Prepare a certificate signing request (CSR). Important - when asked for a Common Name - enter localhost
openssl req -new -key server.key -out server.csr
./sign.sh server.csr
cp /opt/etc/openssl/server.crt /opt/etc/ftpd/
Setup proftpd
Create a user to run proftpd
addgroup nogroup
adduser -h /home/proftpusers/ -G nogroup -s /bin/false proftpduser
Lets change the config file, but first we do a backup of it:
cp /opt/etc/proftpd.conf /opt/etc/proftpd.conf.backup
vi /opt/etc/proftpd.conf
Change it to this:
# This is a basic ProFTPD configuration file (rename it to
# 'proftpd.conf' for actual use. It establishes a single server
# and a single anonymous login. It assumes that you have a user/group
# "nobody" and "ftp" for normal operation and anon.
ServerName "FTP"
ServerType standalone
DefaultServer on
WtmpLog off
#MasqueradeAddress ftp.yourdomain.com
# Port 21 is the standard FTP port.
Port 21
PassivePorts 50000 50019
UseReverseDNS off
IdentLookups off
# Umask 022 is a good standard umask to prevent new dirs and files
# from being group and world writable.
Umask 022
# To prevent DoS attacks, set the maximum number of child processes
# to 30. If you need to allow more than 30 concurrent connections
# at once, simply increase this value. Note that this ONLY works
# in standalone mode, in inetd mode you should use an inetd server
# that allows you to limit maximum number of processes per service
# (such as xinetd).
MaxInstances 10
<Global>
RootLogin Off
RequireValidShell off
# Lets use our new virtual users
AuthUserFile /opt/etc/ftpd/ftpd.passwd
AuthOrder mod_auth_file.c
AllowStoreRestart on
# TransferRate RETR 25
# TransferRate APPE,STOR 100:2048
</Global>
# Set the user and group under which the server will run.
User proftpduser
Group nogroup
# To cause every FTP user to be "jailed" (chrooted) into their home
# directory, uncomment this line.
DefaultRoot ~
# Normally, we want files to be overwriteable.
AllowOverwrite on
# Bar use of SITE CHMOD by default
<Limit SITE_CHMOD>
DenyAll
</Limit>
# A basic anonymous configuration, no upload directories. If you do not
# want anonymous users, simply delete this entire <Anonymous> section.
<IfModule mod_tls.c>
TLSEngine on
TLSLog /opt/var/proftpd/tls.log
# Set the TLSProtocol to one of the following
# SSLv23 - Use SSL3 for ctrl and TLS1 for data channels (works with most clients)
# SSLv3 - Use only SSL3
# TLSv1 - Use only TLS1
TLSProtocol SSLv23
# Clients are required to use FTP over SSL/TLS when talking to this server
# off - clients can connect using insecure FTP or secure FTP/SSL
# ctrl - encrypt only the ctrl channel using FTP/SSL
# data - encrypt only the data channel using FTP/SSL (not recommended)
# on - encrypt both the ctrl and data channels using FTP/SSL
TLSRequired ctrl
# Server's certificate
TLSRSACertificateFile /opt/etc/ftpd/server.crt
TLSRSACertificateKeyFile /opt/etc/ftpd/server.key
# CA the server trusts
TLSCACertificateFile /opt/etc/ftpd/ca.crt
# Authenticate clients that want to use FTP over SSL/TLS
# off - client SSL certificates are not requried
# on - client SSL certificates are required
TLSVerifyClient off
</IfModule>
Or if you want some logging, use this (I use this one):
# This is a basic ProFTPD configuration file (rename it to
# 'proftpd.conf' for actual use. It establishes a single server
# and a single anonymous login. It assumes that you have a user/group
# "nobody" and "ftp" for normal operation and anon.
ServerName "FTP"
ServerType standalone
DefaultServer on
WtmpLog off
#MasqueradeAddress ftp.yourdomain.com
# Port 21 is the standard FTP port.
Port 21
PassivePorts 50000 50019
UseReverseDNS off
IdentLookups off
# Umask 022 is a good standard umask to prevent new dirs and files
# from being group and world writable.
Umask 022
# To prevent DoS attacks, set the maximum number of child processes
# to 30. If you need to allow more than 30 concurrent connections
# at once, simply increase this value. Note that this ONLY works
# in standalone mode, in inetd mode you should use an inetd server
# that allows you to limit maximum number of processes per service
# (such as xinetd).
MaxInstances 10
# Logging options
#
TransferLog /opt/var/proftpd/xferlog.legacy
#
# Some logging formats
#
LogFormat default "%h %l %u %t \"%r\" %s %b"
LogFormat auth "%v [%P] %h %t \"%r\" %s"
LogFormat write "%h %l %u %t \"%r\" %s %b"
#
<Global>
RootLogin Off
RequireValidShell off
# Lets use our new virtual users
AuthUserFile /opt/etc/ftpd/ftpd.passwd
AuthOrder mod_auth_file.c
AllowStoreRestart on
# TransferRate RETR 25
# TransferRate APPE,STOR 100:2048
#
# Logging
# file/dir access
ExtendedLog /opt/var/proftpd/access.log WRITE,READ write
#
# Record all logins
ExtendedLog /opt/var/proftpd/auth.log AUTH auth
</Global>
# Set the user and group under which the server will run.
User proftpduser
Group nogroup
# To cause every FTP user to be "jailed" (chrooted) into their home
# directory, uncomment this line.
DefaultRoot ~
# Normally, we want files to be overwriteable.
AllowOverwrite on
# Bar use of SITE CHMOD by default
<Limit SITE_CHMOD>
DenyAll
</Limit>
# A basic anonymous configuration, no upload directories. If you do not
# want anonymous users, simply delete this entire <Anonymous> section.
<IfModule mod_tls.c>
TLSEngine on
TLSLog /opt/var/proftpd/tls.log
# Set the TLSProtocol to one of the following
# SSLv23 - Use SSL3 for ctrl and TLS1 for data channels (works with most clients)
# SSLv3 - Use only SSL3
# TLSv1 - Use only TLS1
TLSProtocol SSLv23
# Clients are required to use FTP over SSL/TLS when talking to this server
# off - clients can connect using insecure FTP or secure FTP/SSL
# ctrl - encrypt only the ctrl channel using FTP/SSL
# data - encrypt only the data channel using FTP/SSL (not recommended)
# on - encrypt both the ctrl and data channels using FTP/SSL
TLSRequired ctrl
# Server's certificate
TLSRSACertificateFile /opt/etc/ftpd/server.crt
TLSRSACertificateKeyFile /opt/etc/ftpd/server.key
# CA the server trusts
TLSCACertificateFile /opt/etc/ftpd/ca.crt
# Authenticate clients that want to use FTP over SSL/TLS
# off - client SSL certificates are not requried
# on - client SSL certificates are required
TLSVerifyClient off
</IfModule>
Say you have a dir called 'uploads', where you like them to be able to upload files. Add this code just above </Global>
# An upload directory that allows storing files but not retrieving
# or creating directories.
<Limit WRITE>
DenyAll
</Limit>
<Directory /home/proftpusers/uploads/*>
<Limit READ>
DenyAll
</Limit>
<Limit STOR>
AllowAll
</Limit>
</Directory>
If you get disconnection problems with your FTP client, as an example say you want to copy several files but after the first file the other files don't get copied. And you need to close and restart the client to continue and in your TLS log you see something like this:
Apr 18 05:27:33 mod_tls/2.4.3[12797]: client did not reuse SSL session, rejecting data connection (see the NoSessionReuseRequired TLSOptions parameter)
Then you can try to add
TLSOptions NoSessionReuseRequired
inside of
<IfModule mod_tls.c> ... </IfModule>
Don't forget:
- Pathnames in <Directory ...> must always be absolute (except inside <Anonymous>), and should not reference symbolic links
- You may need to do a 'chmod 777' on the directory for this to work (dirs where you don't want 'them' to write you can have chmod 755)
- After a change in proftpd.conf, restart proftpd ('ps' -> check the PID -> 'kill <pid>' -> '/opt/sbin/proftpd &'
About <Directory ...>
http://www.proftpd.org/docs/directives/linked/config_ref_Directory.html
About <Limit ...>
http://www.proftpd.org/docs/directives/linked/config_ref_Limit.html
-- More --
Configuration Directives by Functionality
http://www.castaglia.org/proftpd/doc/contrib/functional-directive-index.html
ProFTPD Configuration Directives By Context
http://www.castaglia.org/proftpd/doc/contrib/contextual-directive-index.html
EVEN MORE ----
Howtos, configs etc:
http://www.castaglia.org/proftpd/
Lets try it
/opt/sbin/proftpd &
Since 1.3.2 is available for Qnap ipkg, so any FileZilla client should work with these settings:
GENERAL
Servertype: FTPES - FTP over explicit TLS/SSL
Logontype: Normal
TRANSFER SETTINGS
Transfer mode: Active