Version information
This version is compatible with:
- Puppet Enterprise 3.x
- Puppet >= 3.0.0 < 5.0.0
- Ubuntu, Debian, RedHat, CentOS, FreeBSD
This module has been deprecated by its author since Jul 11th 2023.
The reason given was: new maintainer
The author has suggested markt-proftpd as its replacement.
Start using this module
Documentation
Table of Contents
Overview
fraenki/proftpd is a Puppet module for managing ProFTPD. It allows for very flexible configuration and is hiera-friendly.
Requirements
- Puppet 3.x or 4.x
- puppetlabs/concat
- puppetlabs/stdlib
Usage
Beginning with proftpd
This example will install packages, setup a minimal configuration and activate the service for you:
class { 'proftpd': }
Loading additional modules is easy too:
class { 'proftpd':
load_modules => {
ban => {},
tls => {},
sql => {},
}
}
It is simple to add new options or overwrite the defaults in the configuration root or any (sub) section:
class { 'proftpd':
options => {
'ROOT' => {
'ServerName' => 'FTP server',
'MaxInstances' => '10',
},
'IfModule mod_vroot.c' => {
'VRootEngine' => 'on',
},
},
}
NOTE: You don't need to take care for section brackets or closing tags. The module will add this automatically.
Enabling anonymous login and customizing it's default options works the same way:
class { 'proftpd':
anonymous_enable => true,
options => {
'Anonymous ~ftp' => {
'Directory uploads/*' => {
'Limit STOR' => {
'AllowAll' => true,
'DenyAll' => false,
},
},
},
},
You may opt to disable the default configuration and do everything from scratch:
class { 'proftpd':
default_config => false,
options => {...}
}
(Here the options hash must contain all options required to run ProFTPD.)
Using Hiera
You're encouraged to define your configuration using Hiera, especially if you plan to disable the default configuration:
proftpd::default_config: false
# load modules in a specific order if necessary
proftpd::load_modules:
sql:
order: 1
sql_mysql:
order: 2
quotatab:
order: 3
quotatab_sql:
order: 4
rewrite:
order: 5
ban: {}
tls: {}
proftpd::options:
ROOT:
ServerType: 'standalone'
DefaultServer: 'on'
ScoreboardFile: '/var/run/proftpd.scoreboard'
DelayTable: '/var/run/proftpd.delay'
ControlsSocket: '/var/run/proftpd.socket'
User: 'www'
Group: 'www'
Umask: '006'
UseReverseDNS: 'off'
DefaultRoot: '~ !'
DefaultChdir: '/var/ftp'
ServerName: '%{::fqdn}'
Port: '21'
PassivePorts: '49152 65534'
TransferLog: 'NONE'
LogFormat:
- 'default "%h %l %u %t \"%r\" %s %b"'
- 'auth "%t %v [%P] %h \"%r\" %s"'
- 'access "%h %l %u %t \"%r\" %s %b"'
ExtendedLog:
- '/var/log/proftpd/access.log INFO,DIRS,MISC,READ,WRITE access'
- '/var/log/proftpd/auth.log AUTH auth'
MaxClients: '20 "Connection limit reached (%m)."'
MaxInstances: '20'
MaxClientsPerHost: '15 "Connection limit reached (%m)."'
MaxClientsPerUser: '10 "Connection limit reached (%m)."'
TLSEngine: 'on'
TLSProtocol: 'SSLv23'
TLSRequired: 'off'
TLSOptions: 'NoCertRequest'
TLSCipherSuite: 'ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP'
TLSVerifyClient: 'off'
TLSRSACertificateFile: '/etc/ssl/%{::fqdn}.crt'
TLSRSACertificateKeyFile: '/etc/ssl/%{::fqdn}.key'
TLSLog: '/var/log/proftpd/tls.log'
Global:
RequireValidShell: 'off'
UseFtpUsers: 'on'
AllowRetrieveRestart: 'on'
AllowStoreRestart: 'on'
AllowOverwrite: 'yes'
AccessGrantMsg: '"Login OK"'
IdentLookups: 'off'
ServerIdent: 'on "FTP Service"'
AllowForeignAddress: 'on'
DirFakeUser: 'on www'
DirFakeGroup: 'on www'
PathDenyFilter: '"(\.ftpaccess)$"'
ListOptions: '"-a"'
MaxLoginAttempts: '2'
AuthUserFile: '/etc/proftpd/proftpd.passwd'
AuthGroupFile: '/etc/proftpd/proftpd.group'
TimeoutLogin: '1800'
TimeoutIdle: '1800'
TimeoutStalled: '1800'
TimeoutNoTransfer: '1800'
'Directory /':
AllowOverwrite: 'on'
Reference
Syntax
You may want to use the $options
parameter to overwrite default configuration options or build a ProFTPD configuration from scratch. There are few things you need to know:
sections
: ProFTPD's configuration uses a number of <sections>. You create a new section by specifying a hash, the module's erb template will do the rest for you. This works for special cases like <IfDefine X> too.ROOT
: To add items to the root of the ProFTPD configuration, use this namespace.false
: Setting a value to 'false' will remove the item from the configuration.multiple values
: If you want to specify multiple values for the same configuration item (i.e.LogFormat
orExtendedLog
), you need to specify these values as an array.
Parameters
anonymous_options
: An optional hash containing the default options to configure ProFTPD for anonymous FTP access. Use this to overwrite these defaults.anonymous_enable
: Set to 'true' to enable loading of the$anonymous_options
hash.load_modules
: A hash of optional ProFTPD modules to load. It is possible to load modules in a specific order by using theorder
attribute.options
: Specify a hash containing options to either overwrite the default options or configure ProFTPD from scratch. Will be merged with$default_options
hash (as long as$default_config
is not set to 'false').default_options
: A hash containing a set of working default options for ProFTPD. This should make it easy to get a running service and to overwrite a few settings.config_template
: Specify which erb template to use.default_config
: Set to 'false' to disable loading of the default configuration. Defaults to 'true'.manage_config_file
: Set to 'false' to disable managing of the ProFTPD configuration file(s).packages
: An array of packages which should be installed.package_ensure
: Overwrite the package 'ensure' parameter.package_manage
: Set to 'false' to disable package management. Defaults to 'true'.service_name
: The name of the ProFTPD service.service_manage
: Set to 'false' to disable service management. Defaults to 'true'.service_enable
: Set to 'false' to disable the ProFTPD system service. Defaults to 'true'.service_ensure
: Overwrite the service 'ensure' parameter.prefix
: Prefix to be added to all paths. Only required on certain operating systems or special installations.prefix_bin
: Path to the ProFTPD binary.config
: Path to the ProFTPD configuration file.base_dir
: Directory for additional configuration files.log_dir
: Directory for log files.run_dir
: Directory for runtime files (except PIDfile).pidfile
: Path and name of the PIDfile for the ProFTPD service.scoreboardfile
: Path and name of the ScoreboardFile for the ProFTPD service.user
: Set the user under which the server will run.group
: Set the group under which the server will run.
Limitations
No Ruby 1.8 support
Some users reported issues when running this module on Ruby 1.8. The config file may change on every puppet run. Please upgrade to Ruby 1.9 to fix this issue. (See PUP-1755 for more details and a description of the root cause.)
OS Compatibility
This module was tested on FreeBSD, CentOS and Debian. Please open a new issue if your operating system is not supported yet, and provide information about problems or missing features.
Template Issues
The proftpd.conf.erb
template... sucks. It suffers from code repetition. Furthermore it is limited to only four nested configuration sections (which should still be enough, even for rather complex configurations). If you come up with a better idea please let me know.
Development
Please use the github issues functionality to report any bugs or requests for new features. Feel free to fork and submit pull requests for potential contributions.
Contributors
This module is heavily inspired by and in part based on the following modules:
See the LICENSE
file for further information.
Changelog
1.4.4
- Bugfix: Fix service notifies for config changes
- Contributor: rendhalver
1.4.3
- Bugfix: Fix requirements and silence a warning
- Documentation: Known issues when running on Ruby 1.8
- Contributor: franzs
1.4.2
- Bugfix: Fix puppet-lint issues
1.4.1
- Bugfix: Do not fail if an expected config section does not exist
1.4.0
- Bugfix: Several fixes to make the validate_cmd more robust
- Feature: Add parameter for ordering modules
- Contributor: cdenneen
1.3.0
- Feature: Create empty AuthUserFile/AuthGroupFile to allow the configtest to succeed
- Bugfix: Fix ERB template to be ready for Puppet 4
- Bugfix: Fix syntax errors in non-hiera example configuration
- Contributors: yarikdot, trlinkin, lmorfitt
1.2.0
- Feature: Add hiera lookup for
$::proftpd::options
to merge values from multiple hierarchy levels - Contributor: cdenneen
1.1.1
- Bugfix: Fix
LogFormat
andExtendedLog
in default configuration
1.1.0
- Feature: Setting an option to 'false' will remove it from the configuration.
- Security: Change insecure default value in
$anonymous_options
to disable write access.
1.0.0
- Initial release
Dependencies
- puppetlabs/concat (>= 1.0.0 <3.0.0)
- puppetlabs/stdlib (>= 4.2.0 <5.0.0)
Copyright (C) 2015 Frank Wall All rights reserved. Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: 1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ================================================================================ Based in part on arioch/puppet-proftpd: Copyright (C) 2012 Tom De Vylder Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. ================================================================================ Based in part on takumin/puppet-proftpd: Copyright (C) 2014 Takumi Takahashi Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. ================================================================================ Based in part on cegeka/puppet-proftpd: Copyright (C) 2012 Fabian Dammekens