bluefoxicy/proftpd repository overview

This description is quick-and-dirty.

This Proftpd image allows some broad configuration via environments, including:

• FTP Port
• Pasive ports
• Timeouts
• Default root
• Max instances
• umask
• auth order
• TLS
• TLSRequired

It has a few volumes:

• /var/ftp - The FTP data directory
• /etc/proftpd/auth.d - Auth configuration, e.g. ldap.conf, sql.conf
• /etc/proftpd/conf.d - Additional configuration, e.g. limits.conf
• /etc/proftpd/user.d - Non-config files, such as authfile files

Environment variables:

• PROFTPD_FTP_PORT="21" - The FTP port proftpd listens on inside the container
• PROFTPD_PASSIVE_PORTS="49200-49230" - Port range for passive FTP. You'll need to map these ports directly on the host, e.g. docker run -p 49200-49230:49200-49230 -d bluefoxicy/proftpd
• PROFTPD_DEBUG_LEVEL="1" - Logging level
• PROFTPD_SERVER_NAME="Proftpd" - Server name
• PROFTPD_REQUIRE_VALID_SHELL="off" - Controls whether users with a valid shell can log in. Should be off.
• PROFTPD_TIMEOUT_NO_TRANSFER="600" - TimeoutNoTransfer setting
• PROFTPD_TIMEOUT_STALLED="600" - TimeoutStalled setting
• PROFTPD_TIMEOUT_IDLE="600" - TimeoutIdle
• PROFTPD_DEFAULT_ROOT="~" - mod_vroot DefaultRoot setting
• PROFTPD_MAX_INSTANCES="300" - MaxInstances. Total number of proftpd processes allowed to spawn.
• PROFTPD_UMASK="022 022" - umask directive
• PROFTPD_AUTH_ORDER="mod_auth_pam.c* mod_auth_unix.c" - AuthOrder directive
• PROFTPD_TLS="off" - Enables or disables TLS. You must provide a TLS certificate, key, and chain (chain can be empty), e.g. by docker run -v /etc/ssl/certs/example.com.crt:/etc/ssl/certs/proftpd.crt:ro and so forth. Certificates are /etc/ssl/certs/proftpd.crt, /etc/ssl/certs/chain.crt, and /etc/proftpd/private/proftpd.key.
• PROFTPD_TLS_REQUIRED="off" - Controls if clients can connect without TLS

Be sure to drop unnecessary capabilities in your docker-compose.yml. The below example works well; whereas setgid and setuid are required capabilities and cannot be dropped.

# Launch proftpd
ftp:
  image: bluefoxicy/proftpd
cap_drop:
  - net_raw
  - mknod
  - setpcap
  - setfcap
  - fowner
  - dac_override
  environment:
    PROFTPD_PASSIVE_PORTS: "50000-50030"
    PROFTPD_TLS: on
    PROFTPD_AUTH_ORDER: "mod_auth_file.c"
  ports:
    - "21:21"
    - "50000-50030:50000-50030"
  volumes:
    # FTP directory
    - /var/ftp/site1/files/:/var/ftp
    # Configuration
    - /var/ftp/site1/config/auth.d/:/etc/proftpd/auth.d/
    - /var/ftp/site1/config/conf.d/:/etc/proftpd/conf.d/
    # keeping user.d/authfile/passwd and user.d/authfile/group
    - /var/ftp/site1/config/user.d/:/etc/proftpd/user.d/
    # ssl certificates
    - /etc/ssl/certs/example.com.crt:/etc/ssl/certs/proftpd.crt:ro
    - /etc/ssl/certs/example.com.chain.crt:/etc/ssl/certs/chain.crt:ro
    - /etc/ssl/private/example.com.key:/etc/ssl/private/proftpd.key:ro

For winbind, configure winbind on your host system, then add the following volumes:

  volumes:
    # Winbind
    - /var/run/samba/winbindd/:/var/run/samba/winbindd/:ro
    - /var/lib/samba/winbindd_privileged/:/var/lib/samba/winbindd_privileged/:ro
    - /etc/nsswitch.conf:/etc/nsswitch.conf:ro

Your configuration should use mod_auth_pam.c and mod_auth_unix.c with PersistentPassword set to off.