eldhodoc/vsftpd repository overview

FROM centos:7 MAINTAINER Eldho

RUN yum -y update && yum clean all RUN yum -y install httpd && yum clean all RUN yum install -y iproute RUN yum install -y
vsftpd
db4-utils
db4

ENV FTP_USER admin ENV FTP_PASS admin123 ENV PASV_ADDRESS IPv4 ENV PASV_MIN_PORT 21100 ENV PASV_MAX_PORT 21110 ENV LOG_STDOUT Boolean

COPY vsftpd.conf /etc/vsftpd/ COPY vsftpd_virtual /etc/pam.d/ COPY vsftpd.sh /usr/sbin/

RUN chmod +x /usr/sbin/vsftpd.sh RUN mkdir -p /home/vsftpd/

VOLUME /home/vsftpd VOLUME /var/log/vsftpd VOLUME /etc/vsftpd

EXPOSE 20 21

CMD ["/usr/sbin/vsftpd.sh"]

Conf file ++++++++

⁠Run in the foreground to keep the container running:

background=NO

⁠Allow anonymous FTP? (Beware - allowed by default if you comment this out).

anonymous_enable=NO

⁠Uncomment this to allow local users to log in.

local_enable=YES

⁠Enable virtual users

guest_enable=YES

⁠Virtual users will use the same permissions as anonymous

virtual_use_local_privs=YES

⁠Uncomment this to enable any form of FTP write command.

write_enable=YES

⁠PAM file name

pam_service_name=vsftpd_virtual

⁠Home Directory for virtual users

user_sub_token=$USER local_root=/home/vsftpd/$USER

⁠You may specify an explicit list of local users to chroot() to their home

⁠directory. If chroot_local_user is YES, then this list becomes a list of

⁠users to NOT chroot().

chroot_local_user=NO

⁠Workaround chroot check.

⁠See https://www.benscobie.com/fixing-500-oops-vsftpd-refusing-to-run-with-writable-root-inside-chroot/⁠

⁠and http://serverfault.com/questions/362619/why-is-the-chroot-local-user-of-vsftpd-insecure⁠

allow_writeable_chroot=YES

⁠Hide ids from user

hide_ids=YES

⁠Set passive port address

pasv_addr_resolve=NO

⁠Enable logging

xferlog_enable=YES xferlog_file=/var/log/vsftpd/vsftpd.log

⁠Enable active mode

port_enable=YES connect_from_port_20=YES ftp_data_port=20

⁠Disable seccomp filter sanboxing

seccomp_sandbox=NO

⁠Enable passive mode

pasv_enable=YES pasv_promiscuous=YES #timeoutt issue solved reverse_lookup_enable=NO ##Userss list userlist_file=/etc/vsftpd/virtual_users.txt userlist_enable=YES userlist_deny=NO pasv_address= pasv_max_port=21110 pasv_min_port=21100 chown_uploads=YES

++++++++

vsftpd.sh

++++ #!/bin/bash

⁠if no env var for FTP_USER has been specified, use 'admin':

if [ "$FTP_USER" = "String" ]; then export FTP_USER='admin' fi

⁠If no env var has been specified, generate a random password for FTP_USER:

if [ "$FTP_PASS" = "Random" ]; then export FTP_PASS=cat /dev/urandom | tr -dc A-Z-a-z-0-9 | head -c${1:-16} fi

⁠Do not log to STDOUT by default:

if [ "$LOG_STDOUT" = "Boolean" ]; then export LOG_STDOUT='' else export LOG_STDOUT='Yes.' fi

⁠Create home dir and update vsftpd user db:

mkdir -p "/home/vsftpd/${FTP_USER}" echo -e "${FTP_USER}\n${FTP_PASS}" >> /etc/vsftpd/virtual_users.txt /usr/bin/db_load -T -t hash -f /etc/vsftpd/virtual_users.txt /etc/vsftpd/virtual_users.db

⁠Set passive mode parameters:

if [ "$PASV_ADDRESS" = "IPv4" ]; then export PASV_ADDRESS=$(/sbin/ip route|awk '/default/ { print $3 }') fi

echo "pasv_address=${PASV_ADDRESS}" >> /etc/vsftpd/vsftpd.conf echo "pasv_max_port=${PASV_MAX_PORT}" >> /etc/vsftpd/vsftpd.conf echo "pasv_min_port=${PASV_MIN_PORT}" >> /etc/vsftpd/vsftpd.conf

⁠Get log file path

export LOG_FILE=grep xferlog_file /etc/vsftpd/vsftpd.conf|cut -d= -f2

#Set permissions for FTP user chown -R ftp:ftp /home/vsftpd/ log "Fixed permissions for newly created user: ${FTP_USER}"

if [ ! $LOG_STDOUT ]; then cat << EOB ************************************************* * * * Docker image: eldhodoc/vsftpd * * * * * *************************************************

SERVER SETTINGS
---------------
· FTP User: $FTP_USER
· FTP Password: $FTP_PASS
· Log file: $LOG_FILE
· Redirect vsftpd log to STDOUT: No.

EOB else /usr/bin/ln -sf /dev/stdout $LOG_FILE fi

⁠Run vsftpd:

&>/dev/null /usr/sbin/vsftpd /etc/vsftpd/vsftpd.conf ++++

++++ #%PAM-1.0 auth required pam_userdb.so db=/etc/vsftpd/virtual_users account required pam_userdb.so db=/etc/vsftpd/virtual_users session required pam_loginuid.so

++++