From d805748b9f3305b778ffeabcbbd3dc2514cb5b98 Mon Sep 17 00:00:00 2001 From: Amin Vakil Date: Thu, 6 Feb 2020 00:46:40 +0330 Subject: [PATCH] Add TLS Support --- Dockerfile | 11 ++++++----- README.md | 4 +++- start_vsftpd.sh | 9 ++++----- vsftpd.conf | 43 ++++++++++++++++++++++++++---------------- vsftpd.pem | 50 +++++++++++++++++++++++++++++++++++++++++++++++++ 5 files changed, 90 insertions(+), 27 deletions(-) create mode 100644 vsftpd.pem diff --git a/Dockerfile b/Dockerfile index de88d9a..e2e0755 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,12 +1,13 @@ FROM alpine:3.13 + +LABEL maintainer="Amin Vakil " + RUN apk --no-cache add vsftpd -COPY start_vsftpd.sh /bin/start_vsftpd.sh +COPY vsftpd.pem /etc/ssl/certs/vsftpd.pem +COPY start_vsftpd.sh /usr/local/bin/start_vsftpd.sh COPY vsftpd.conf /etc/vsftpd/vsftpd.conf -EXPOSE 21 21000-21010 -VOLUME /ftp/ftp - STOPSIGNAL SIGKILL -ENTRYPOINT ["/bin/start_vsftpd.sh"] +ENTRYPOINT ["/usr/local/bin/start_vsftpd.sh"] diff --git a/README.md b/README.md index b764e99..9362f2d 100644 --- a/README.md +++ b/README.md @@ -1,5 +1,4 @@ # docker-alpine-ftp-server -[![Docker Stars](https://img.shields.io/docker/stars/delfer/alpine-ftp-server.svg)](https://hub.docker.com/r/delfer/alpine-ftp-server/) [![Docker Pulls](https://img.shields.io/docker/pulls/delfer/alpine-ftp-server.svg)](https://hub.docker.com/r/delfer/alpine-ftp-server/) [![Docker Automated build](https://img.shields.io/docker/automated/delfer/alpine-ftp-server.svg)](https://hub.docker.com/r/delfer/alpine-ftp-server/) [![Docker Build Status](https://img.shields.io/docker/build/delfer/alpine-ftp-server.svg)](https://hub.docker.com/r/delfer/alpine-ftp-server/) [![MicroBadger Layers](https://img.shields.io/microbadger/layers/delfer/alpine-ftp-server.svg)](https://hub.docker.com/r/delfer/alpine-ftp-server/) [![MicroBadger Size](https://img.shields.io/microbadger/image-size/delfer/alpine-ftp-server.svg)](https://hub.docker.com/r/delfer/alpine-ftp-server/) Small and flexible docker image with vsftpd server ## Usage @@ -26,3 +25,6 @@ Environment variables: - `user|password foo|bar|/home/foo` - `user|password|/home/user/dir|10000` - `user|password||10000` +======= +# docker-alpine-ftp-server-tls +Small and flexible docker image with vsftpd server with tls diff --git a/start_vsftpd.sh b/start_vsftpd.sh index 7f14f3e..54182f5 100755 --- a/start_vsftpd.sh +++ b/start_vsftpd.sh @@ -1,7 +1,7 @@ #!/bin/sh - +set +x #Remove all ftp users -grep '/ftp/' /etc/passwd | cut -d':' -f1 | xargs -n1 deluser +#grep '/ftp/' /etc/passwd | cut -d':' -f1 | xargs -n1 deluser #Create users #USERS='name1|password1|[folder1][|uid1] name2|password2|[folder2][|uid2]' @@ -15,7 +15,7 @@ grep '/ftp/' /etc/passwd | cut -d':' -f1 | xargs -n1 deluser #Default user 'ftp' with password 'alpineftp' if [ -z "$USERS" ]; then - USERS="ftp|alpineftp" + USERS="amin|alpineftp" fi for i in $USERS ; do @@ -55,6 +55,5 @@ fi if [ ! -z "$1" ]; then exec "$@" else - exec /usr/sbin/vsftpd -opasv_min_port=$MIN_PORT -opasv_max_port=$MAX_PORT $ADDR_OPT /etc/vsftpd/vsftpd.conf + exec /usr/sbin/vsftpd -opasv_min_port=$MIN_PORT -opasv_max_port=$MAX_PORT $ADDR_OPT /etc/vsftpd/vsftpd.conf & sleep infinity fi - diff --git a/vsftpd.conf b/vsftpd.conf index 788099d..4184b10 100644 --- a/vsftpd.conf +++ b/vsftpd.conf @@ -1,5 +1,5 @@ # Allow anonymous FTP? (Beware - allowed by default if you comment this out). -anonymous_enable=NO +anonymous_enable=YES # # Uncomment this to allow local users to log in. local_enable=YES @@ -9,11 +9,7 @@ write_enable=YES # # Default umask for local users is 077. You may wish to change this to 022, # if your users expect that (022 is used by most other ftpd's) -local_umask=022 -# -# Activate directory messages - messages given to remote users when they -# go into a certain directory. -dirmessage_enable=YES +#local_umask=022 # # Activate logging of uploads/downloads. xferlog_enable=YES @@ -21,15 +17,9 @@ xferlog_enable=YES # Make sure PORT transfer connections originate from port 20 (ftp-data). connect_from_port_20=YES # -# If you want, you can arrange for uploaded anonymous files to be owned by -# a different user. Note! Using "root" for uploaded files is not -# recommended! -#chown_uploads=YES -#chown_username=whoever -# # You may override where the log file goes if you like. The default is shown # below. -#xferlog_file=/dev/stdout +#xferlog_file=/var/log/vsftpd.log vsftpd_log_file=/proc/1/fd/1 # # If you want, you can have your log file in standard ftpd xferlog format. @@ -42,6 +32,10 @@ vsftpd_log_file=/proc/1/fd/1 # You may change the default value for timing out a data connection. #data_connection_timeout=120 # +# It is recommended that you define on your system a unique user which the +# ftp server can use as a totally isolated and unprivileged user. +#nopriv_user=ftpsecure +# # Enable this and the server will recognise asynchronous ABOR requests. Not # recommended for security (the code is non-trivial). Not enabling it, # however, may confuse older FTP clients. @@ -60,7 +54,7 @@ vsftpd_log_file=/proc/1/fd/1 #ascii_download_enable=YES # # You may fully customise the login banner string: -ftpd_banner=Welcome Alpine ftp server https://hub.docker.com/r/delfer/alpine-ftp-server/ +ftpd_banner=Welcome Alpine ftp server tls https://quay.io/aminvakil/alpine-ftp-server-tls # # You may specify an explicit list of local users to chroot() to their home # directory. If chroot_local_user is YES, then this list becomes a list of @@ -79,17 +73,34 @@ ftpd_banner=Welcome Alpine ftp server https://hub.docker.com/r/delfer/alpine-ftp # the presence of the "-R" option, so there is a strong case for enabling it. #ls_recurse_enable=YES # + # When "listen" directive is enabled, vsftpd runs in standalone mode and # listens on IPv4 sockets. This directive cannot be used in conjunction # with the listen_ipv6 directive. listen=YES # -## Enable passive mode +# Enable passive mode pasv_enable=YES pasv_addr_resolve=YES # -## Disable seccomp filter sanboxing +# Disable seccomp filter sanboxing seccomp_sandbox=NO +# # Run in background background=NO +ssl_enable=YES + +# by default all non anonymous logins and forced to use SSL to send and receive password and data, set to NO to allow non secure connections +force_local_logins_ssl=YES +force_local_data_ssl=YES + +# provide the path of your certificate and of your private key +# note that both can be contained in the same file or in different files +rsa_cert_file=/etc/ssl/certs/vsftpd.pem +rsa_private_key_file=/etc/ssl/certs/vsftpd.pem + +# this setting is set to YES by default and requires all data connections exhibit session reuse which proves they know the secret of the control channel. +# this is more secure but is not supported by many FTP clients, set to NO for better compatibility +require_ssl_reuse=YES +ssl_ciphers=HIGH diff --git a/vsftpd.pem b/vsftpd.pem new file mode 100644 index 0000000..38f1bda --- /dev/null +++ b/vsftpd.pem @@ -0,0 +1,50 @@ +-----BEGIN PRIVATE KEY----- +MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQD1i+ypsZD+Hb/Z +5AwabbZhzjLUCDbL1kNCFBvo0dGCHNpcVBzu8VWNSjiirXdB9u1D/8fCppBPVjx5 +fx8yuEwfdQm7twDOMoaj5lhnP9DUIqo23iCXzY+gLQy+gwf66J5Ydk5mVh41EHSs +NtWDkoFlFOU1jmYKtDx1BngTickJfqerI9ztt5G8nrRRTnM6dR+1THqqa2we4TO4 +PxtBO+BKm+BeaTN20+2dBh0k9CrGiPiSW/maKpHvJhqY7Ofa6EwwzzMOadXKKDP9 +5DHtYaEqaWvWQ+D4X2c/zJaOUADcmiS4fmiU2qNfCAyOQYVRB1+SoH71knk00Ei9 +8F97ntsJAgMBAAECggEATd0XKSCDp/FrGv8zz1WnFhC7EX2hUrYZEeUqjIOseiQI +ImsR2btxs6Irn3p+bM6OopeDkvganu3rs2NaU00Z5ofIlFwNx1VCWMr8kZEs+Xgc +ndWGZFztBJAEkI0ghLIrNEYfylfYsF8NgGbLAjP9ED62CGuldBN/cGSiwx9YPsfq +BHTmKBhXzoUMW3/J+1TmZ4bLpJ88PuFKmJB2jdQwQFSztuxMsGt5Gc/3NOqXF4jg +KWhGxSpqiyTGGPefqdGsccwJEB2JfvuTNg18gm9AzYI+O5ZJ5Nr6f3kOHwkOuyNG +Dj3tpIHl8tVZSNqf6bFUNVyIZ3vJLJPfsxTgX75tYQKBgQD7xU2Q5/Zr8cvFo3O2 +19nUsfgated8VwcYkJvptbHX9f82tbo18p0/kw4tSlGDSqxuCPvsfq72Ltle2bcg +NGTojQVOzy8NUlV/3WHrJPWABIR28uvuurQc7mgXBn2V3+Q2V3i7ukVoTsSbqeWd +CO5L3xp1USCNQdF1KjHBDrwm9QKBgQD5q9sLVsD58/TrkXJOqgR+uF61NI9bfa0z +JxtoKTrGeF9qUpP+RXY/mfT3zQOGkVIJj1tE/YKPPbvOFG6PSdzd0dp2JMl70R4w +JxpaGVtcfQvP1igPE43hzbC0WbyeCDD6EBDvg/D44V0it56wIXPKX7ma7MBbWhZN +RUtTZiAPRQKBgDQfpO9bFqlCZe2E6W/xQCfIsJTXFBWp7s4nIiBAfZE4XJ33AZYp +pGSFDWpS+I016HzfX0iW8aIGEPqSGFeSgVGj4HVwb01SvmC6dIs6G5llVgdKQ44p +GSDkOqiJr3ZX4+dcNKKo7bWqmQmhIuhf8PXEOrYPFa4o8jRPh/1wD4QBAoGBALiP +n8bMBK9A9aZFyFf6OoRqSihtiCO7zZLor8vZ3obkaLQyAxCNzJHLf1jHBnotZpWG +kZN4S1ET84atd+UYVtrqzDFVlFOhDE3QOhysber6zQaAavBqJhHreVp4k4PGzl2s +Drjfsfxoq+6EChxtPik1hgDOTou5Fo9cUAiAj+Z5AoGBALhapyGnrRzztyVQimA9 +vGQ7mCp+/U0H6sZ+RZMhQpDDiGR4RGBKqDgxXtPUbDu1Y0hUEsLiv62dfXBDGCdy +Xs8IE9gNAdzwY56VUj4a7eV+rgp9pOtl7bXbMqMPM2SZWyCC06paeKHyAjhBU/Lk +c3gVuktFJSOIwZSYJRNfnUvx +-----END PRIVATE KEY----- +-----BEGIN CERTIFICATE----- +MIIDpTCCAo2gAwIBAgIJAPy3jyzhtm/GMA0GCSqGSIb3DQEBCwUAMGkxCzAJBgNV +BAYTAklSMQ8wDQYDVQQIDAZUZWhyYW4xDzANBgNVBAcMBlRlaHJhbjEVMBMGA1UE +CgwMU2FtaW4gU2VydmVyMSEwHwYJKoZIhvcNAQkBFhJpbmZvQGFtaW52YWtpbC5j +b20wHhcNMjAwMjA1MDkzMTQ4WhcNNDAwMTMxMDkzMTQ4WjBpMQswCQYDVQQGEwJJ +UjEPMA0GA1UECAwGVGVocmFuMQ8wDQYDVQQHDAZUZWhyYW4xFTATBgNVBAoMDFNh +bWluIFNlcnZlcjEhMB8GCSqGSIb3DQEJARYSaW5mb0BhbWludmFraWwuY29tMIIB +IjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA9YvsqbGQ/h2/2eQMGm22Yc4y +1Ag2y9ZDQhQb6NHRghzaXFQc7vFVjUo4oq13QfbtQ//HwqaQT1Y8eX8fMrhMH3UJ +u7cAzjKGo+ZYZz/Q1CKqNt4gl82PoC0MvoMH+uieWHZOZlYeNRB0rDbVg5KBZRTl +NY5mCrQ8dQZ4E4nJCX6nqyPc7beRvJ60UU5zOnUftUx6qmtsHuEzuD8bQTvgSpvg +XmkzdtPtnQYdJPQqxoj4klv5miqR7yYamOzn2uhMMM8zDmnVyigz/eQx7WGhKmlr +1kPg+F9nP8yWjlAA3JokuH5olNqjXwgMjkGFUQdfkqB+9ZJ5NNBIvfBfe57bCQID +AQABo1AwTjAdBgNVHQ4EFgQUY4WFvh5w3tD8yWEqjjsZ0mwgbLQwHwYDVR0jBBgw +FoAUY4WFvh5w3tD8yWEqjjsZ0mwgbLQwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0B +AQsFAAOCAQEAQV9riXqeKPEbntqJQ073qY4zmd7gceDLLsMfdSRvR0784uEZYLUo +b/1WRxlZBKIZyCdcF1SOODUfs4u0r+n3482IiNCmGsZB1yYXnyjko6H7GUgTjGTn +AR6nCv6bS7KvIU0ikuT/ptaDBV4PBm5B3BE0dFdZsiqy5eGwFloNI19u31d1DcKd +hZbuRrW8I/Q9lScT+EjL5AYIdNKsTbHAo8IT7TsQ2qS87r3pgFNXIdkEGMTXDurE +Z61gdw5P6A3dklSIF7LCVaZdGRbDo8EGsT+U3BnsGiF/LbbR9ibsTB6xgjw9k3sV +dUvJCiNnTbd3E2wa3bpGQJGX23l/2pFVfQ== +-----END CERTIFICATE-----