230 lines
6.7 KiB
Markdown
230 lines
6.7 KiB
Markdown
# Install Pure-FTPd with OpenLDAP backend on RHEL/CentOS
|
|
|
|
[TOC]
|
|
|
|
## Install Pure-FTPd
|
|
|
|
Install PureFTPD from EPEL yum repo:
|
|
|
|
```
|
|
# yum install pure-ftpd
|
|
```
|
|
|
|
## Use a proper LDAP bind dn/password to query accounts
|
|
|
|
iRedMail generates a read-only LDAP bind dn `cn=vmail,dc=xxx,dc=xxx` during
|
|
installation, so it's perfect to query user accounts with this dn.
|
|
|
|
You can find the full dn and password in `/etc/postfix/ldap/catchall_maps.cf`:
|
|
|
|
```
|
|
# grep 'bind_' /etc/postfix/ldap/catchall_maps.cf
|
|
bind_dn = cn=vmail,dc=example,dc=com
|
|
bind_pw = InYTi8qGjamTb6Me2ESwbb6rxQUs5y
|
|
```
|
|
|
|
## Configure the LDAP setting for PureFTPD
|
|
|
|
* Open `/etc/pure-ftpd/pureftpd-ldap.conf` and update parameters below:
|
|
|
|
```
|
|
LDAPServer localhost
|
|
LDAPPort 389
|
|
LDAPBaseDN o=domains,dc=example,dc=com
|
|
LDAPBindDN cn=vmail,dc=example,dc=com
|
|
LDAPBindPW InYTi8qGjamTb6Me2ESwbb6rxQUs5y # cn=vmail password
|
|
LDAPDefaultUID 2000 # <- UID of `vmail` user.
|
|
LDAPDefaultGID 2000 # <- GID of `vmail` user.
|
|
LDAPFilter (&(objectClass=PureFTPdUser)(mail=\L)(FTPStatus=enabled))
|
|
LDAPHomeDir FTPHomeDir # <- New LDAP attribute, we will add it later.
|
|
LDAPVersion 3
|
|
```
|
|
|
|
## Config OpenLDAP
|
|
|
|
* Get the schema modified by iredmail, it adds a new attribute `FTPHomeDir` to
|
|
store per-user FTP home directory. Default schema uses `homeDirectory`.
|
|
|
|
```
|
|
# wget https://bitbucket.org/zhb/iredmail/raw/default/extra/samples/pureftpd.schema
|
|
# mv pureftpd.schema /etc/openldap/schema/
|
|
```
|
|
|
|
* Update `/etc/openldap/slapd.conf`, include `pureftpd.schema` after `iredmail.schema`:
|
|
|
|
```
|
|
include /etc/openldap/schema/iredmail.schema
|
|
include /etc/openldap/schema/pureftpd.schema # <-- Add this line.
|
|
```
|
|
|
|
* Open `/etc/openldap/slapd.conf`, append required indexes for attributes
|
|
defined in `pureftpd.schema`:
|
|
|
|
```
|
|
# Indexes for Pure-FTPd LDAP attributes.
|
|
index FTPQuotaFiles,FTPQuotaMBytes eq,pres
|
|
index FTPUploadRatio,FTPDownloadRatio eq,pres
|
|
index FTPUploadBandwidth,FTPDownloadBandwidth eq,pres
|
|
index FTPStatus,FTPuid,FTPgid,FTPHomeDir eq,pres
|
|
```
|
|
|
|
## Create FTP Home Directory
|
|
|
|
We're going to store all FTP data under `/home/ftp/` directory, so let's create
|
|
`/home/ftp/` first, directory owner MUST be `root` user.
|
|
|
|
```
|
|
# mkdir /home/ftp/
|
|
# ls -dl /home/ftp
|
|
drwxr-xr-x 3 root root 4096 Jun 7 20:18 /home/ftp/
|
|
```
|
|
|
|
## Restart OpenLDAP and Pure-FTPD Service
|
|
|
|
Restart Pure-FTPd and OpenLDAP services:
|
|
|
|
```
|
|
# /etc/init.d/ldap restart
|
|
# /etc/init.d/pure-ftpd restart
|
|
|
|
# netstat -ntlp | grep pure-ftpd
|
|
tcp 0 0 0.0.0.0:21 0.0.0.0:* LISTEN 2062/pure-ftpd (SERVER)
|
|
tcp 0 0 :::21 :::* LISTEN 2062/pure-ftpd (SERVER)
|
|
```
|
|
|
|
## Add LDAP FTP attributes and values for new user
|
|
|
|
With script shipped in iRedMail, you can quickly create NEW mail user which
|
|
has pureftpd service support.
|
|
|
|
* Open file `tools/create_mail_user_OpenLDAP.sh` under your iRedMail directory
|
|
(e.g. `/root/iRedMail-0.9.4/tools/create_mail_user_OpenLDAP.sh`), update
|
|
paraemters below with correct values:
|
|
|
|
```
|
|
LDAP_SUFFIX="dc=example,dc=com" # <- Change the LDAP suffix
|
|
BINDPW='passwd' # <- Password for the bind dn `cn=Manager,dc=example,dc=com`
|
|
PUREFTPD_INTEGRATION='YES' # <- Set to 'YES' to enable the pureftp inteegration
|
|
FTP_STORAGE_BASE_DIRECTORY='/home/ftp' # <- Change it to the ftp home directory
|
|
```
|
|
|
|
* Run the script to create a new user `user1@example.com`. The default
|
|
password is same as user name (`user1`) by default.
|
|
|
|
```
|
|
# bash create_mail_user_OpenLDAP.sh example.com user1
|
|
|
|
adding new entry "ou=Users,domainName=example.com,o=domains,dc=example,dc=com"
|
|
ldapadd: Already exists (68)
|
|
adding new entry "ou=Groups,domainName=example.com,o=domains,dc=example,dc=com"
|
|
ldapadd: Already exists (68)
|
|
adding new entry "ou=Aliases,domainName=example.com,o=domains,dc=example,dc=com"
|
|
ldapadd: Already exists (68)
|
|
adding new entry "mail=user1@example.com,ou=Users,domainName=example.com,o=domains,dc=example,dc=com"
|
|
```
|
|
|
|
You can now login to both webmail and FTP service as this user.
|
|
|
|
## Configure iptables
|
|
|
|
iRedMail doesn't open port 20 and 21 by default, you must open them first.
|
|
|
|
* Open `/etc/sysconfig/iptables` and set correct values:
|
|
|
|
```
|
|
-A INPUT -p tcp --dport 20 -j ACCEPT
|
|
-A INPUT -p tcp --dport 21 -j ACCEPT
|
|
```
|
|
|
|
* Restart the iptables service
|
|
|
|
```
|
|
# service iptables restart
|
|
```
|
|
|
|
## Testing
|
|
|
|
You can use windows FTP client or Linux ftp client (e.g. command line ftp
|
|
client `lftp` or GUI client [`FileZilla`](https://filezilla-project.org)) for
|
|
testing.
|
|
|
|
We use `lftp` for testing below:
|
|
|
|
```
|
|
$ lftp localhost
|
|
localhost:~> debug 4
|
|
localhost:~> login user1@example.com user1 # <-- input the username and password
|
|
user1@example.com@localhost:~> ls
|
|
---- Connecting to localhost (127.0.0.1) port 21
|
|
<--- 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------
|
|
<--- 220-You are user number 1 of 50 allowed.
|
|
<--- 220-Local time is now 16:25. Server port: 21.
|
|
<--- 220-IPv6 connections are also welcome on this server.
|
|
<--- 220 You will be disconnected after 15 minutes of inactivity.
|
|
<--- 211-Extensions supported:
|
|
<--- EPRT
|
|
<--- IDLE
|
|
<--- MDTM
|
|
<--- SIZE
|
|
<--- REST STREAM
|
|
<--- MLST type*;size*;sizd*;modify*;UNIX.mode*;UNIX.uid*;UNIX.gid*;unique*;
|
|
<--- MLSD
|
|
<--- ESTP
|
|
<--- PASV
|
|
<--- EPSV
|
|
<--- SPSV
|
|
<--- ESTA
|
|
<--- AUTH TLS
|
|
<--- PBSZ
|
|
<--- PROT
|
|
<--- UTF8
|
|
<--- 211 End.
|
|
<--- 500 This security scheme is not implemented
|
|
<--- 200 OK, UTF-8 enabled
|
|
<--- 200 MLST OPTS type;size;sizd;modify;UNIX.mode;UNIX.uid;UNIX.gid;unique;
|
|
<--- 331 User user1@example.com OK. Password required
|
|
<--- 230-Your bandwidth usage is restricted
|
|
<--- 230-User user1@example.com has group access to: vmail
|
|
<--- 230-You must respect a 1:5 (UL/DL) ratio
|
|
<--- 230-OK. Current restricted directory is /
|
|
<--- 230-0 files used (0%) - authorized: 50 files
|
|
<--- 230 0 Kbytes used (0%) - authorized: 10240 Kb
|
|
<--- 257 "/" is your current location
|
|
<--- 227 Entering Passive Mode (127,0,0,1,32,58)
|
|
<--- 150 Accepted data connection
|
|
drwxr-xr-x 2 500 vmail 4096 Jun 10 16:16 .
|
|
drwxr-xr-x 2 500 vmail 4096 Jun 10 16:16 ..
|
|
-rw------- 1 500 vmail 0 Jun 10 16:16 .ftpquota
|
|
```
|
|
|
|
## Troubleshooting
|
|
|
|
Enable verbose log in pure-ftpd
|
|
|
|
* Open `/etc/pure-ftpd/pure-ftpd.conf` and set correct values:
|
|
|
|
```
|
|
VerboseLog yes # <-- change from no to yes
|
|
```
|
|
|
|
* Open `/etc/rsyslog.conf` and set correct values:
|
|
|
|
```
|
|
ftp.* -/var/log/pureftpd.log # <-- Add entry
|
|
```
|
|
|
|
* Restart services
|
|
|
|
```
|
|
# service pure-ftpd restart
|
|
# service rsyslog restart
|
|
```
|
|
|
|
Monitor `/var/log/pureftpd.log` for troubleshooting:
|
|
|
|
```
|
|
# tail -0f /var/log/pureftpd.log
|
|
```
|
|
|
|
If you need to debug OpenLDAP, please refer to another document: [Debug OpenLDAP](./debug.openldap.html).
|