Proftpd - настройка FTP-сервера с хранением списка пользователей в БД MySQL и поддержкой TLS шифрования

# cd /usr/ports/ftp/proftpd-mysql/
# make install clean

Options for proftpd-mysql 1.3.2a

[ ] BAN              Include mod_ban (Requires CTRLS)
[ ] CLAMAV           Include mod_clamav
[ ] CTRLS            Include controls
[ ] DIGEST           Include mod_digest
[X] IFSESSION        Include mod_ifsession
[ ] IPV6             Use IPv6
[ ] LDAP             Use LDAP
[ ] LDAP_TLS         Use LDAP TLS (Requires LDAP, OPENSSL)
[ ] NLS              Use nls (builds mod_lang)
[X] OPENSSL          Include mod_tls
[ ] PGSQL            Postgres auth (Can be combined with MYSQL)
[X] QUOTA            Include mod_quota
[ ] QUOTATAB_RADIUS  include mod_quotatab_radius
[ ] RADIUS           Include mod_radius
[X] RATIO            Include mod_ratio
[X] README           Include mod_readme
[X] REWRITE          Include mod_rewrite
[ ] TDS              FreeTDS - Sybase & MS-SQL auth (Exclusive)
[X] WRAP             Include mod_wrap2
[ ] WRAP_FILE        Include mod_wrap2_file
[ ] WRAP_SQL         Include mod_wrap2_sql
[X] MYSQL            MySQL auth (Can be combined with PGSQL)

# cat /usr/local/etc/proftpd.conf

ServerName                      "Local Ftp Server"
ServerType                      standalone
DefaultServer                   on

ServerIdent on "FTP Server ready"

DeferWelcome                    off

Port                            21
Umask                           002
TimeoutLogin                    300
TimeoutIdle                     36000
TimeoutNoTransfer               36000
TimeoutStalled                  36000
TimeoutSession                  0

User                            proftpd
Group                           proftpd

MaxInstances                    100
MaxClientsPerHost               100

AllowRetrieveRestart            on
AllowStoreRestart               on
AllowOverwrite                  on
AllowOverride                   off

RootLogin                       off
IdentLookups                    off
UseReverseDNS                   off
DenyFilter                      \*.*/
TimesGMT                        off

DefaultRoot                     ~

RLimitCPU                       1200 1200
RLimitMemory                    256M 256M
RLimitOpenFiles                 1024 1024

PassivePorts                    50000 60000

LogFormat                       default "%h %l %u %t \"%r\" %s %b"
LogFormat                       auth    "%v [%P] %h %t \"%r\" %s"
LogFormat                       write   "%h %l %u %t \"%r\" %s %b"

SystemLog                       /var/log/proftpd/proftpd.log
TransferLog                     /var/log/proftpd/xfer.log
ExtendedLog                     /var/log/proftpd/access.log WRITE,READ write
ExtendedLog                     /var/log/proftpd/auth.log AUTH auth
#ExtendedLog                     /var/log/proftpd/paranoid.log ALL default

<Global>
  SQLConnectInfo proftpd@localhost proftpd SQL-Password_here
  SQLAuthTypes Crypt
  SQLUserInfo users username password uid gid homedir NULL
  RequireValidShell off
  SQLAuthenticate users*
  SQLLogFile /var/log/proftpd.log
  SQLNamedQuery getcount SELECT "count, username from users where username='%u'"
  SQLNamedQuery updatecount UPDATE "count=count+1 WHERE username='%u'" users
  SQLShowInfo PASS "230" "You've logged on %{getcount} times, %u"
  SQLLog PASS updatecount
</Global>

# mysql –u username –p
Enter password:
mysql> create database proftpd;

Query OK, 1 row affected (0.00 sec)
mysql> grant all on proftpd.* to 'proftpd'@'localhost' identified by 'password';

Query OK, 0 rows affected (0.06 sec)
mysql>quit

# mkdir -p /var/ftp/test
# chown -R proftpd:proftpd /var/ftp/
# mysql -u proftpd -p
Enter password:
Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 74435 to server version: 4.1.22

# telnet localhost 21
Trying ::1...
Trying 127.0.0.1...
Connected to localhost
Escape character is '^]'.
220 ProFTPD 1.3.2a Server (Local Ftp Server) [127.0.0.1]

quit
221 Goodbye.
Connection closed by foreign host.

# mkdir /etc/ssl/certs

# cd /etc/ssl/certs

<IfModule mod_tls.c>
        TLSEngine on
        TLSLog /var/log/proftpd/tls.log
        TLSProtocol SSLv3
        TLSOptions NoCertRequest
        TLSRSACertificateFile /etc/ssl/certs/proftpd.cert.pem
        TLSRSACertificateKeyFile /etc/ssl/certs/proftpd.key.pem
        TLSVerifyClient on
        TLSRequired off
</IfModule>