proftpd: new software

software/proftpd/README.md

+Proftpd with sftp and virtual users
+
+http://www.proftpd.org/docs/
+
+# Features
+
+ * sftp only is enabled
+ * partially uploadloaded are not visible thanks to [`HiddenStores`](http://proftpd.org/docs/directives/linked/config_ref_HiddenStores.html) ( in fact they are, but name starts with `.` )
+ * 5 failed login attempts will cause the host to be temporary banned
+
+
+# TODO
+
+ * only password login is enabled. enabling [`SFTPAuthorizedUserKeys`](http://www.proftpd.org/docs/contrib/mod_sftp.html#SFTPAuthorizedUserKeys) seems to break password only login
+ * log rotation
+ * make sure SFTPLog is useful (seems very verbose and does not contain more than stdout)
+ * make it easier to manage users ( using `mod_auth_web` against an ERP5 endpoint or accepting a list of user/password as instance parameter )
+ * allow configuring webhooks when new file is uploaded
+
+

software/proftpd/buildout.hash.cfg

+# THIS IS NOT A BUILDOUT FILE, despite purposedly using a compatible syntax.
+# The only allowed lines here are (regexes):
+# - "^#" comments, copied verbatim
+# - "^[" section beginings, copied verbatim
+# - lines containing an "=" sign which must fit in the following categorie.
+#   - "^\s*filename\s*=\s*path\s*$" where "path" is relative to this file
+#     But avoid directories, they are not portable.
+#     Copied verbatim.
+#   - "^\s*hashtype\s*=.*" where "hashtype" is one of the values supported
+#     by the re-generation script.
+#     Re-generated.
+# - other lines are copied verbatim
+# Substitution (${...:...}), extension ([buildout] extends = ...) and
+# section inheritance (< = ...) are NOT supported (but you should really
+# not need these here).
+
+[instance-profile]
+filename = instance.cfg.in
+md5sum = 8ed5b4a7940db47ccb386c2f4e3e7273
+
+[instance-default]
+filename = instance-default.cfg.in
+md5sum = 89e145188fe2a223f22f57e5c0c242e4
+
+[proftpd-config-file]
+filename = proftpd-config-file.cfg.in
+md5sum = 46cbe4ea65b445822d3da32c76c7d67d
+

software/proftpd/instance-default.cfg.in

+[buildout]
+parts =
+  promises
+  publish-connection-parameter
+
+
+[instance-parameter]
+# TODO: this is not needed
+recipe = slapos.cookbook:slapconfiguration
+computer = ${slap-connection:computer-id}
+partition = ${slap-connection:partition-id}
+url = ${slap-connection:server-url}
+key = ${slap-connection:key-file}
+cert = ${slap-connection:cert-file}
+
+[slap-configuration]
+recipe = slapos.cookbook:slapconfiguration.serialised
+computer = ${slap-connection:computer-id}
+partition = ${slap-connection:partition-id}
+url = ${slap-connection:server-url}
+key = ${slap-connection:key-file}
+cert = ${slap-connection:cert-file}
+
+[directory]
+recipe = slapos.cookbook:mkdirectory
+home = ${buildout:directory}
+etc = ${:home}/etc
+var = ${:home}/var
+log = ${:var}/log
+srv = ${:home}/srv
+service = ${:etc}/service
+promise = ${:etc}/promise
+proftpd-dir = ${:srv}/proftpd/
+ssh-authorized-keys-dir = ${:etc}/authorized_keys/
+
+[config-file]
+recipe = slapos.recipe.template:jinja2
+template = {{ software_parts_directory }}/${:_buildout_section_name_}/${:_buildout_section_name_}.cfg.in
+rendered = ${directory:etc}/${:_buildout_section_name_}.cfg
+mode = 0644
+extensions = jinja2.ext.do
+
+[check-port-listening-promise]
+recipe = slapos.cookbook:check_port_listening
+path = ${directory:promise}/${:_buildout_section_name_}
+
+[proftpd-userinfo]
+recipe = slapos.cookbook:userinfo
+
+
+[proftpd-password]
+recipe = slapos.cookbook:generate.password
+username = proftpd
+bytes = 12
+
+[proftpd]
+ipv6 = ${instance-parameter:ipv6-random}
+ipv4 = ${instance-parameter:ipv4-random}
+host = ${:ipv6}
+sftp-port = {{ slapparameter_dict.get('port', 8022) }}
+url = sftp://[${:host}]:${:sftp-port}
+data-dir = ${directory:proftpd-dir}
+user=${proftpd-userinfo:pw-name}
+group=${proftpd-userinfo:gr-name}
+sftp-log=${directory:log}/proftpd-sftp.log
+xfer-log=${directory:log}/proftpd-xfer.log
+ban-log=${directory:log}/proftpd-ban.log
+ssh-host-rsa-key=${ssh-host-rsa-key:output}
+ssh-host-dsa-key=${ssh-host-dsa-key:output}
+ssh-host-ecdsa-key=${ssh-host-ecdsa-key:output}
+ssh-authorized-keys-dir = ${directory:ssh-authorized-keys-dir}
+ban-table=${directory:srv}/proftpd-ban-table
+auth-user-file=${auth-user-file:output}
+
+recipe = slapos.cookbook:wrapper
+command-line =
+   {{ proftpd_bin }} --nodaemon --config ${proftpd-config-file:rendered}
+wrapper-path = ${directory:service}/proftpd
+
+[proftpd-listen-promise]
+<= check-port-listening-promise
+hostname = ${proftpd:ipv6}
+port = ${proftpd:sftp-port}
+
+
+[ftpasswd]
+# command line to add a user, invoke with:
+#   ftpasswd --name=bob
+# to prompt for password, or --stdin to read password from stdin
+recipe = slapos.recipe.template:jinja2
+mode = 0700
+extensions = jinja2.ext.do
+rendered = ${buildout:bin-directory}/${:_buildout_section_name_}
+wrapper-path = ${:rendered}
+# XXX: to workaround bug that pw-uid and gr-gir slapos.cookbook:userinfo cannot
+# be used in a buildout part (as they are returned as int and not strings), we
+# use slapos.recipe.template:jinja2 and not a simple slapos.cookbook:wrapper,
+# because only the former is compatible with userinfo.
+# Because we are already in a jinja template, we have to escape jinja template
+# with {% raw %} / {% endraw %}
+template = inline:
+  #!/bin/bash
+  {{ perl_bin }} {{ ftpasswd_bin }} --passwd --home=${proftpd:data-dir} --shell=/bin/false --uid={% raw %}{{ pw_uid }} --gid={{ gr_gid }}{% endraw %} --file ${auth-user-file:output} $@
+context =
+  key pw_uid proftpd-userinfo:pw-uid
+  key gr_gid proftpd-userinfo:gr-gid
+
+[auth-user-file]
+recipe = plone.recipe.command
+output = ${directory:etc}/ftpd.passwd
+command =
+  echo ${proftpd-password:passwd} | ${ftpasswd:wrapper-path} --name=${proftpd-password:username} --stdin
+update-command = ${:command}
+
+
+[ssh-keygen-base]
+recipe = plone.recipe.command
+output = ${directory:etc}/${:_buildout_section_name_}
+command = {{ ssh_keygen_bin }} -f ${:output} -N '' ${:extra-args}
+
+[ssh-host-rsa-key]
+<=ssh-keygen-base
+extra-args=-t rsa
+[ssh-host-dsa-key]
+<=ssh-keygen-base
+extra-args=-t dsa
+[ssh-host-ecdsa-key]
+<=ssh-keygen-base
+extra-args=-t ecdsa -b 521
+
+
+[proftpd-config-file]
+<= config-file
+context =
+  section proftpd proftpd
+  key slapparameter_dict slap-configuration:configuration
+
+
+[promises]
+recipe =
+instance-promises =
+  ${proftpd-listen-promise:path}
+
+
+[publish-connection-parameter]
+recipe = slapos.cookbook:publish
+url = ${proftpd:url}
+username = ${proftpd-password:username}
+password = ${proftpd-password:passwd}

software/proftpd/instance-input-schema.json

+{
+  "$schema": "http://json-schema.org/draft-04/schema#",
+  "description": "Parameters to instantiate PoFTPd",
+  "additionalProperties": false,
+  "properties": {
+    "port": {
+      "description": "Port number to listen to - default to 8022",
+      "type": "number"
+    }
+  }
+}

software/proftpd/instance-output-schema.json

+{
+  "$schema": "http://json-schema.org/draft-04/schema#",
+  "description": "Values returned by ProFTPd instantiation",
+  "additionalProperties": false,
+  "properties": {
+    "url": {
+      "description": "URL of the SFTP service",
+      "pattern": "^sftp://",
+      "type": "string"
+    },
+    "username": {
+      "description": "Default username",
+      "type": "string",
+      "optional": true
+    },
+    "password": {
+      "description": "Password for default username",
+      "type": "string",
+      "optional": true
+    }
+  },
+  "type": "object"
+}

software/proftpd/instance.cfg.in

+[buildout]
+parts = switch-softwaretype
+eggs-directory = {{ buildout['eggs-directory'] }}
+develop-eggs-directory = {{ buildout['develop-eggs-directory'] }}
+
+[slap-configuration]
+recipe = slapos.cookbook:slapconfiguration.serialised
+computer = ${slap-connection:computer-id}
+partition = ${slap-connection:partition-id}
+url = ${slap-connection:server-url}
+key = ${slap-connection:key-file}
+cert = ${slap-connection:cert-file}
+
+[instance-template]
+recipe = slapos.recipe.template:jinja2
+filename = ${:_buildout_section_name_}.cfg
+rendered = ${buildout:parts-directory}/${:_buildout_section_name_}/${:filename}
+mode = 0644
+extensions = jinja2.ext.do
+context =
+  key slapparameter_dict slap-configuration:configuration
+  raw software_parts_directory {{ buildout['parts-directory'] }}
+  raw proftpd_bin {{ proftpd_bin }}
+  raw ftpasswd_bin {{ ftpasswd_bin }}
+  raw ftpdctl_bin {{ ftpdctl_bin }}
+  raw ssh_keygen_bin {{ ssh_keygen_bin }}
+  raw perl_bin {{ perl_bin }}
+
+[instance-default]
+<= instance-template
+template = {{ instance_default }}
+
+[switch-softwaretype]
+recipe = slapos.cookbook:switch-softwaretype
+# XXX Jerome: what is this override for ?
+override = {{ dumps(override_switch_softwaretype |default) }}
+default = instance-default:rendered
+# BBB
+RootSoftwareInstance = ${:default}

software/proftpd/proftpd-config-file.cfg.in

+ServerName "ProFTPD SlapOS"
+ServerType standalone
+MaxInstances  30
+DefaultAddress {{ proftpd['ipv6'] }} {{ proftpd['ipv4']}}
+SocketBindTight on
+DefaultServer off
+Port {{ proftpd['sftp-port'] }}
+
+User {{ proftpd['user'] }}
+Group {{ proftpd['group'] }}
+
+Umask 022
+AllowOverwrite on
+
+# SFTP
+SFTPEngine on
+SFTPHostKey {{ proftpd['ssh-host-rsa-key'] }}
+SFTPHostKey {{ proftpd['ssh-host-dsa-key'] }}
+SFTPHostKey {{ proftpd['ssh-host-ecdsa-key'] }}
+#SFTPAuthorizedUserKeys file:{{ proftpd['ssh-authorized-keys-dir'] }}%u
+
+
+# Logging
+TransferLog {{ proftpd['xfer-log'] }}
+SFTPLog {{ proftpd['sftp-log'] }}
+BanLog {{ proftpd['ban-log'] }}
+
+
+# Virtual users
+RequireValidShell off
+AuthUserFile {{ proftpd['auth-user-file'] }}
+
+
+# Prevent partially uploaded files to be visible
+HiddenStores on
+DeleteAbortedStores on
+AllowStoreRestart off
+
+
+# Limitations of running as non-root user
+WtmpLog off
+# ( we cannot use DefaultRoot ~ )
+
+# Prevent user for escaping their home
+<Directory />
+  <Limit ALL>
+    DenyAll
+  </Limit>
+</Directory>
+
+<Directory {{ proftpd['data-dir'] }}>
+  <Limit ALL>
+    AllowAll
+  </Limit>
+</Directory>
+
+
+
+# Ban failed logins
+MaxLoginAttempts 1
+BanEngine on
+BanTable {{ proftpd['ban-table'] }}
+# 5 failed login attemps in 5 minutes -> ban for 20 minutes
+BanOnEvent MaxLoginAttempts 5/00:05:00 00:20:00 "Too many Failed Login Attempts"
+BanControlsACLs all allow user {{ proftpd['user'] }}
+
+

software/proftpd/software.cfg

+[buildout]
+extends =
+  ../../stack/slapos.cfg
+  ../../component/openssh/buildout.cfg
+  ../../component/proftpd/buildout.cfg
+  buildout.hash.cfg
+
+versions = versions
+parts =
+  slapos-cookbook
+  proftpd-config-file
+  instance-profile
+
+
+[download-file-base]
+recipe = slapos.recipe.build:download
+url = ${:_profile_base_location_}/${:filename}
+download-only = true
+mode = 0644
+
+[proftpd-config-file]
+<= download-file-base
+
+[instance-default]
+<= download-file-base
+
+[instance-profile]
+recipe = slapos.recipe.template:jinja2
+template = ${:_profile_base_location_}/${:filename}
+rendered = ${buildout:directory}/instance.cfg
+mode = 0644
+extensions = jinja2.ext.do
+context =
+  section buildout buildout
+  key instance_default instance-default:target
+  key proftpd_bin proftpd-output:proftpd
+  key ftpasswd_bin proftpd-output:ftpasswd
+  key ftpdctl_bin proftpd-output:ftpdctl
+  key ssh_keygen_bin openssh-output:keygen
+  key perl_bin proftpd-output:perl
+
+
+[versions]
+collective.recipe.environment = 1.1.0
+collective.recipe.grp = 1.1.0
+slapos.recipe.template = 4.3
+plone.recipe.command = 1.1

software/proftpd/software.cfg.json

+{
+  "name": "ProFTPd",
+  "description": "ProFTPd as a SFTP server with virtual users",
+  "serialisation": "json-in-xml",
+  "software-type": {
+    "default": {
+      "title": "Default",
+      "description": "ProFTPd, with a default user and users added with command line",
+      "request": "instance-input-schema.json",
+      "response": "instance-output-schema.json",
+      "index": 0
+    }
+  }
+}