# Install Pure-FTPd with OpenLDAP backend on RHEL/CentOS

## Install Pure-FTPd

Install PureFTPD from EPEL yum repo:

    # yum install pure-ftpd

## Use a proper LDAP bind dn/password to query accounts

iRedMail generates a read-only LDAP bind dn `cn=vmail,dc=xxx,dc=xxx` during installation, so it's perfect to query user accounts with this dn.

You can find the full dn and password in `/etc/postfix/ldap/catchall_maps.cf`:

    # grep 'bind_' /etc/postfix/ldap/catchall_maps.cf
    bind_dn         = cn=vmail,dc=example,dc=com
    bind_pw         = InYTi8qGjamTb6Me2ESwbb6rxQUs5y

## Configure the LDAP setting for PureFTPD

- Open `/etc/pure-ftpd/pureftpd-ldap.conf` and update parameters below:

    LDAPServer      localhost
    LDAPPort        389
    LDAPBaseDN      o=domains,dc=example,dc=com
    LDAPBindDN      cn=vmail,dc=example,dc=com
    LDAPBindPW      InYTi8qGjamTb6Me2ESwbb6rxQUs5y   # cn=vmail password
    LDAPDefaultUID  2000                             # <- UID of `vmail` user.
    LDAPDefaultGID  2000                             # <- GID of `vmail` user.
    LDAPFilter      (&(objectClass=PureFTPdUser)(mail=\L)(FTPStatus=enabled))
    LDAPHomeDir     FTPHomeDir                       # <- New LDAP attribute, we will add it later.
    LDAPVersion     3

## Config OpenLDAP

- Get the schema modified by iredmail, it adds a new attribute `FTPHomeDir` to store per-user FTP home directory. Default schema uses `homeDirectory`.

    # wget https://bitbucket.org/zhb/iredmail/raw/default/extra/samples/pureftpd.schema
    # mv pureftpd.schema /etc/openldap/schema/

- Update `/etc/openldap/slapd.conf`, include `pureftpd.schema` after `iredmail.schema`:

    include /etc/openldap/schema/iredmail.schema
    include /etc/openldap/schema/pureftpd.schema    # <-- Add this line.

- Open `/etc/openldap/slapd.conf`, append required indexes for attributes defined in `pureftpd.schema`:

    # Indexes for Pure-FTPd LDAP attributes.
    index FTPQuotaFiles,FTPQuotaMBytes eq,pres
    index FTPUploadRatio,FTPDownloadRatio eq,pres
    index FTPUploadBandwidth,FTPDownloadBandwidth eq,pres
    index FTPStatus,FTPuid,FTPgid,FTPHomeDir eq,pres

## Create FTP Home Directory

We're going to store all FTP data under `/home/ftp/` directory, so let's create `/home/ftp/` first, directory owner MUST be `root` user.

    # mkdir /home/ftp/
    # ls -dl /home/ftp
    drwxr-xr-x 3 root root 4096 Jun  7 20:18 /home/ftp/

## Restart OpenLDAP and Pure-FTPD Service

Restart Pure-FTPd and OpenLDAP services:

    # /etc/init.d/ldap restart
    # /etc/init.d/pure-ftpd restart

    # netstat -ntlp | grep pure-ftpd
    tcp 0   0 0.0.0.0:21    0.0.0.0:*   LISTEN  2062/pure-ftpd (SERVER)
    tcp 0   0 :::21         :::*        LISTEN  2062/pure-ftpd (SERVER)

## Add LDAP FTP attributes and values for new user

With script shipped in iRedMail, you can quickly create NEW mail user which has pureftpd service support.

- Open file `tools/create_mail_user_OpenLDAP.sh` under your iRedMail directory (e.g. `/root/iRedMail-0.9.4/tools/create_mail_user_OpenLDAP.sh`), update paraemters below with correct values:

    LDAP_SUFFIX="dc=example,dc=com"         # <- Change the LDAP suffix
    BINDPW='passwd'                         # <- Password for the bind dn `cn=Manager,dc=example,dc=com`
    PUREFTPD_INTEGRATION='YES'              # <- Set to 'YES' to enable the pureftp inteegration
    FTP_STORAGE_BASE_DIRECTORY='/home/ftp'  # <- Change it to the ftp home directory

- Run the script to create a new user `user1@example.com`. The default password is same as user name (`user1`) by default.

    # bash create_mail_user_OpenLDAP.sh example.com user1

    adding new entry "ou=Users,domainName=example.com,o=domains,dc=example,dc=com"
    ldapadd: Already exists (68)
    adding new entry "ou=Groups,domainName=example.com,o=domains,dc=example,dc=com"
    ldapadd: Already exists (68)
    adding new entry "ou=Aliases,domainName=example.com,o=domains,dc=example,dc=com"
    ldapadd: Already exists (68)
    adding new entry "mail=user1@example.com,ou=Users,domainName=example.com,o=domains,dc=example,dc=com"

You can now login to both webmail and FTP service as this user.

## Configure iptables

iRedMail doesn't open port 20 and 21 by default, you must open them first.

- Open `/etc/sysconfig/iptables` and set correct values:

    -A INPUT -p tcp --dport 20 -j ACCEPT
    -A INPUT -p tcp --dport 21 -j ACCEPT

- Restart the iptables service

    # service iptables restart

## Testing

You can use windows FTP client or Linux ftp client (e.g. command line ftp client `lftp` or GUI client `FileZilla`) for testing.

We use `lftp` for testing below:

    $ lftp localhost
    localhost:~> debug 4
    localhost:~> login user1@example.com user1 # <-- input the username and password
    user1@example.com@localhost:~> ls
    ---- Connecting to localhost (127.0.0.1) port 21
    <--- 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------
    <--- 220-You are user number 1 of 50 allowed.
    <--- 220-Local time is now 16:25. Server port: 21.
    <--- 220-IPv6 connections are also welcome on this server.
    <--- 220 You will be disconnected after 15 minutes of inactivity.
    <--- 211-Extensions supported:
    <---  EPRT
    <---  IDLE
    <---  MDTM
    <---  SIZE
    <---  REST STREAM
    <---  MLST type*;size*;sizd*;modify*;UNIX.mode*;UNIX.uid*;UNIX.gid*;unique*;
    <---  MLSD
    <---  ESTP
    <---  PASV
    <---  EPSV
    <---  SPSV
    <---  ESTA
    <---  AUTH TLS
    <---  PBSZ
    <---  PROT
    <---  UTF8
    <--- 211 End.
    <--- 500 This security scheme is not implemented
    <--- 200 OK, UTF-8 enabled
    <--- 200  MLST OPTS type;size;sizd;modify;UNIX.mode;UNIX.uid;UNIX.gid;unique;
    <--- 331 User user1@example.com OK. Password required
    <--- 230-Your bandwidth usage is restricted
    <--- 230-User user1@example.com has group access to:  vmail
    <--- 230-You must respect a 1:5 (UL/DL) ratio
    <--- 230-OK. Current restricted directory is /
    <--- 230-0 files used (0%) - authorized: 50 files
    <--- 230 0 Kbytes used (0%) - authorized: 10240 Kb
    <--- 257 "/" is your current location
    <--- 227 Entering Passive Mode (127,0,0,1,32,58)
    <--- 150 Accepted data connection
    drwxr-xr-x    2 500      vmail        4096 Jun 10 16:16 .
    drwxr-xr-x    2 500      vmail        4096 Jun 10 16:16 ..
    -rw-------    1 500      vmail           0 Jun 10 16:16 .ftpquota

## Troubleshooting

Enable verbose log in pure-ftpd

- Open `/etc/pure-ftpd/pure-ftpd.conf` and set correct values:

    VerboseLog                  yes # <-- change from no to yes

- Open `/etc/rsyslog.conf` and set correct values:

    ftp.*                       -/var/log/pureftpd.log # <-- Add entry

- Restart services

    # service pure-ftpd restart
    # service rsyslog restart

Monitor `/var/log/pureftpd.log` for troubleshooting:

    # tail -0f /var/log/pureftpd.log

If you need to debug OpenLDAP, please refer to another document: Debug OpenLDAP.