This repository has been archived on 2024-05-31. You can view files and clone it, but cannot push or open issues or pull requests.
authentik/website/integrations/services/proftpd/index.md

117 lines
4.9 KiB
Markdown
Raw Normal View History

---
title: ProFTPD
---
<span class="badge badge--secondary">Support level: Community</span>
## What is ProFTPD
> ProFTPD is a high-performance, extremely configurable, and most of all a secure FTP server, featuring Apache-like configuration and blazing performance.
>
> -- From http://www.proftpd.org
This integration leverages authentik's LDAP for the identity provider to achieve an SSO experience. See [ldap provider generic setup](../../../docs/providers/ldap/generic_setup) for setting up the LDAP provider.
## Preparation
The following placeholders will be used:
- `authentik.company` is the FQDN of the authentik install.
## authentik Configuration
### Step 1 - Service account
Create a new user account _(or reuse an existing one)_ for ProFTPD to use for LDAP bind under _Directory_ -> _Users_ -> _Create_ and give the account a name, such as `ldapservice`.
:::note
On default provider settings, the DN of this user will be `cn=ldapservice,ou=users,dc=ldap,dc=goauthentik,dc=io`
:::
This user must be part of a group which allows LDAP search queries. If you don't have a group for that yet, create one (e.g. `LDAPServiceUsers`) and add the user `ldapservice` to that group. You can specify that group during the provider creation below.
:::note
_If you are unfamiliar with LDAP_: A bind account is used for authentication against the LDAP server itself - similar to an API key in modern applications.
:::
### Step 2 - LDAP Provider
In authentik, create a LDAP provider (under _Applications/Providers_). This is an example for the settings:
- Name : `provider-ldap` - or choose any
- Bind DN : `DC=ldap,DC=goauthentik,DC=io`
- Search group : `LDAPServiceUsers`
- Certificate : `authentik Self-signed Certificate`
### Step 3 - Application
In authentik, create an application (under _Resources/Applications_) with these settings :
- Name: `FTP` - or choose any
- Provider: Choose the provider you created in _Step 2_
### Step 4 - Outpost
If not done yet, create an outpost (under _Applications/Outposts_) of type `LDAP` that includes the LDAP Application you created in _Step 3_. You can also use an existing outpost, just make sure to edit it and to also include the just created application in the respective field.
### Step 5 - Create a group for restricting access
_Optionally_, create a new group like `ftpusers` to scope access to the ftp server.
## ProFTPD configuration
Ensure that the ProFTPD LDAP plugin is installed, which may be included in the distribution package `proftpd-ldap`.
Check that `LoadModule mod_ldap.c` is not commented out in `/etc/proftpd/modules.conf`.
Edit your ProFTPD configuration, usually located under `/etc/proftpd.conf`. You can use the following LDAP configuration as a starting point.
```bash
DefaultRoot /your/ftp/storage/dir
<IfModule mod_ldap.c>
LDAPAuthBinds on
# Replace this with the server-url:port of your LDAP outpost
LDAPServer authentik.company:389
# The LDAP Bind account must be specified here
LDAPBindDN cn=ldapservice,ou=users,dc=ldap,dc=goauthentik,dc=io PASSWORDOFLDAPSERVICE
# The second parameter is optional
# In this case I am restricting access to the group ftpusers
# Instead you could also create bind policies in your created authentik application
LDAPUsers ou=users,dc=ldap,dc=goauthentik,dc=io (&(objectClass=user)(cn=%u)(memberOf=cn=ftpusers,ou=groups,dc=ldap,dc=goauthentik,dc=io))
# In this example, I am forcing the permission of all files to the system user/group 1000
LDAPDefaultUID 1000
LDAPDefaultGID 1000
LDAPForceDefaultUID on
LDAPForceDefaultGID on
# This way I am making a shared folder, which all ftp users share
LDAPGenerateHomedir on
LDAPGenerateHomedirPrefix /your/ftp/storage/dir
LDAPGenerateHomedirPrefixNoUsername on
LDAPLog /var/log/mod_ldap.log
RequireValidShell off
LDAPAttr uid cn
LDAPSearchScope subtree
</IfModule>
```
In this example, every user shares a single folder. If you want to have separate folders for each user, you can adapt the `LDAPGenerateHomedirPrefixNoUsername` setting.
Additionally, note that each file will have Linux user and group ID `1000`. Beforehand, make sure that the respective Linux user exists (usually the first Linux user created receives ID `1000`). Check `/etc/passwd` and create a user if necessary.
If you do not set `LDAPForceDefaultUID`/`LDAPForceDefaultGID`, Authentik's `uidNumber` field will be used. If you do not set `LDAPGenerateHomedir`, Authentik's `homeDirectory` field will be used (`/home/$username`). For more information about default attributes provided by Authentik, refer to the [LDAP Provider documentation](../../../docs/providers/ldap).
Make sure to read ProFTPD's [available LDAP options](http://www.proftpd.org/docs/contrib/mod_ldap.html).
Finally, after adding the configuration, restart ProFTPD.
:::note
If login fails, make sure to check the logs of the LDAP plugin: `tail -f /var/log/mod_ldap.log`.
:::