Minimal alpine ProFTPD Docker-Image with Configuration-Template
Pkg Source: https://pkgs.alpinelinux.org/packages?name=proftpd
alpine_proftpd:
container_name: alpine_proftpd
image: h0tmann/alpine_proftpd_db:latest
hostname: alpine_proftpd
network_mode: host
# ports:
# - 20-21:20-21 # FTP(s) Ports
# - 22:22 # sFTP Port
# - 49152-65534:49152-65534 # FTP(s) Ephemeral Ports (better choose a smaller range!)
# - 127.0.0.1:8003:8003 # Admin Port
environment:
# System Variablen
- TZ=Europe/Berlin # German time is always good 🇩🇪
- LANG=de_DE.UTF-8 # German locale is always good 🇩🇪
# basic proFTPd Einstellungen
# - PUBLIC_IP=0.0.0.0 # default: 0.0.0.0 - Required in "network_mode: host". Use "0.0.0.0 ::" for IPv4 and IPv6
# - SFTP_PORT=22 # default: 22
# - FTP_PORT=21 # default: 21
# proFTPd App Variablen
# - APP_UID=850 # UID which the app (proftpd) runs with (default is "850")
# - APP_GID=950 # GID which the app (proftpd) runs with (default is "950")
# optionale proFTPd Variablen
# - MAX_INSTANCES=2001 # default: 2001 | http://www.proftpd.org/docs/modules/mod_core.html#MaxInstances
# - MAX_CLIENTS=1000 "max %m total connections" # default: '1000 "max %m total connections"' | http://www.proftpd.org/docs/modules/mod_auth.html#MaxClients
# - MAX_CLIENTS_PER_USER=20 "max %m connections per user" # default: '20 "max %m connections per user"' | http://www.proftpd.org/docs/modules/mod_auth.html#MaxClientsPerUser
# - MAX_CONNECTION_RATE= # default: empty | http://www.proftpd.org/docs/modules/mod_core.html#MaxConnectionRate
# - ALLOW_OVERWRITE=off # default: off | http://www.proftpd.org/docs/modules/mod_xfer.html#AllowOverwrite
# - ALLOW_UPLOAD_RESTART=on # default: on | http://www.proftpd.org/docs/modules/mod_xfer.html#AllowStoreRestart
# - ALLOW_DOWNLOAD_RESTART=on # default: on | http://www.proftpd.org/docs/modules/mod_xfer.html#AllowRetrieveRestart
# - ALLOW_GLOBAL_CHMOD=off # default: off | all values other than 'true' or 'on' will result in 'off'!
# - DEFAULT_TRANSFER_MODE=ascii # default: ascii | http://www.proftpd.org/docs/modules/mod_xfer.html#DefaultTransferMode
# - CREATE_HOME=on 770 skel /etc/proftpd/data/skel uid 850 gid 950 dirmode 770 # http://www.proftpd.org/docs/modules/mod_auth.html#CreateHome
# - USE_REVERSE_DNS=off # default: off | http://www.proftpd.org/docs/modules/mod_core.html#UseReverseDNS
# - DENY_FILTER=\*.*/ # default: '\*.*/'| http://www.proftpd.org/docs/modules/mod_core.html#PathDenyFilter
# - PATH_DENY_FILTER=(?<=/|^)\.[^/]+$ # default: '(?<=/|^)\.[^/]+$' (DENY DOT-Files) | http://www.proftpd.org/docs/modules/mod_core.html#PathDenyFilter
# - UMASK=0007 # default: 0007 | http://www.proftpd.org/docs/modules/mod_core.html#Umask
# - USE_IPV6=on # default: on | http://www.proftpd.org/docs/modules/mod_core.html#UseIPv6
# TIMEOUTS
# - TIMEOUT_LOGIN=300 # default: 300 | http://www.proftpd.org/docs/modules/mod_auth.html#TimeoutLogin
# - TIMEOUT_IDLE=1200 # default: 1200 | http://www.proftpd.org/docs/modules/mod_core.html#TimeoutIdle
# - TIMEOUT_LINGER=10 # default: 10 | http://www.proftpd.org/docs/modules/mod_core.html#TimeoutLinger
# - TIMEOUT_NO_TRANSFER=600 # default: 600 | http://www.proftpd.org/docs/modules/mod_xfer.html#TimeoutNoTransfer
# - TIMEOUT_STALLED=600 # default: 600 | http://www.proftpd.org/docs/modules/mod_xfer.html#TimeoutStalled
# LIMIT Folders
# - LIMIT_USER_HOME=false # default: false | resonable limits the users homedirectory for increased security
# - LIMIT_USER_SUBDIRS=false # default: false | resonable limits the users subdirectories for increased security
# SFTP Einstellungen
# - ENABLE_SFTP=true # default: true [boolean] enables SFTP vhost
# - SFTP_AUTH_METHODS=publickey password # hostbased|keyboard-interactive|password|publickey | http://www.proftpd.org/docs/contrib/mod_sftp.html#SFTPAuthMethods
# - SFTP_CLIENT_ALIVE=6 10 # default: '6 10' | http://www.proftpd.org/docs/contrib/mod_sftp.html#SFTPClientAlive
# - SFTP_CRYPTO_DEVICE=all # default: all | http://www.proftpd.org/docs/contrib/mod_sftp.html#SFTPCryptoDevice
# - SFTP_EXTENSIONS=-hardlink -spaceAvailable -statvfs -vendorID -xattr # default: '-hardlink -spaceAvailable -statvfs -vendorID -xattr' | http://www.proftpd.org/docs/contrib/mod_sftp.html#SFTPExtensions
# - SFTP_MAX_CHANNELS=50 # default: 50 | http://www.proftpd.org/docs/contrib/mod_sftp.html#SFTPMaxChannels
# SFTP Einstellungen (Algos)
# - SFTP_LIMIT_CIPHERS_TO= # default: empty | http://www.proftpd.org/docs/contrib/mod_sftp.html#SFTPCiphers
# - SFTP_LIMIT_DIGESTS_TO= # default: empty | http://www.proftpd.org/docs/contrib/mod_sftp.html#SFTPDigests
# - SFTP_LIMIT_HOST_KEYS_TO= # default: empty | http://www.proftpd.org/docs/contrib/mod_sftp.html#SFTPHostKeys
# - SFTP_LIMIT_KEXS_TO= # default: empty | http://www.proftpd.org/docs/contrib/mod_sftp.html#SFTPKeyExchanges
# - SFTP_COMPRESSION=on # default: on | http://www.proftpd.org/docs/contrib/mod_sftp.html#SFTPCompression
# FTP(S) Einstellungen
# - ENABLE_FTP=false # default: false [boolean] enables FTP in vhost
# - ENABLE_FTPS=false # default: false [boolean] enables FTPS in vhost
# - FTP_PASS_PORT_MIN=49152 # default: 49152 (depending on how many virtual servers you use you might want to limit this)
# - FTP_PASS_PORT_MAX=65534 # default: 65534 (depending on how many virtual servers you use you might want to limit this)
# - FTP_LIST_OPTIONS="-lAn +R" strict # default: "-lAn +R" strict | http://www.proftpd.org/docs/modules/mod_ls.html#ListOptions
# - FTP_SHOW_SYMLINKS=on # default: on | http://www.proftpd.org/docs/modules/mod_ls.html#ShowSymlinks
# - FTPS_REQUIRED=on # default: on | http://www.proftpd.org/docs/contrib/mod_tls.html#TLSRequired
# - FTPS_PROTOCOL=ALL -TLSv1 -TLSv1.1 -SSLv3 # default: ALL -TLSv1 -TLSv1.1 -SSLv3 | http://www.proftpd.org/docs/contrib/mod_tls.html#TLSProtocolhtml
# - # default: on | http://www.proftpd.org/docs/contrib/mod_tls.html#TLSNextProtocol
# - FTPS_RENEGOTIATE=required off # default: required off | http://www.proftpd.org/docs/contrib/mod_tls.html#TLSRenegotiate
# - FTPS_CIPHER_SUITE=DEFAULT:!ADH:!EXPORT:!DES:!NULL # default: 'DEFAULT:!ADH:!EXPORT:!DES:!NULL' | http://www.proftpd.org/docs/contrib/mod_tls.html#TLSCipherSuite
# - FTPS_CIPHER_PREFERENCE=on # default: on | http://www.proftpd.org/docs/contrib/mod_tls.html#TLSServerCipherPreference
# - FTPS_OPTIONS=NoSessionReuseRequired AllowClientRenegotiations # default: "NoSessionReuseRequired AllowClientRenegotiations" | http://www.proftpd.org/docs/contrib/mod_tls.html#TLSOptions
# - FTPS_VERIFY_CLIENT=optional # default: optional | http://www.proftpd.org/docs/contrib/mod_tls.html#TLSVerifyClient
# - FTPS_STAPLING=off # default: off | http://www.proftpd.org/docs/contrib/mod_tls.html#TLSStapling
# FTPS Einstellungen (Zerts)
# - FTPS_SSL_CERT=cert.pem # default: cert.pem | Certificate filename in "/etc/proftpd/ssl/"
# - FTPS_SSL_CHAIN=chain.pem # default: chain.pem | FullChain filename in "/etc/proftpd/ssl/"
# - FTPS_SSL_KEY=key.pem # default: key.pem | Key filename in "/etc/proftpd/ssl/"
# LOG Einstellungen
# - ENABLE_LOGS=true # default: true [boolean] enable General Logging
# - ENABLE_SFTP_LOGS=true # default: true [boolean] enable SFTP Logging
# - ENABLE_FTPS_LOGS=true # default: true [boolean] enable FTPS Logging
# - ENABLE_EXT_LOGS=true # default: true [boolean] enable Extended Logging
# - ENABLE_TRANS_LOGS=true # default: true [boolean] enable Transfer Logging
# - ENABLE_SERVER_LOGS=true # default: true [boolean] enable Server Logging
# - ENABLE_TRACE_LOGS=false # default: false [boolean] enable Trace Logging
# - TRACE=DEFAULT:10 tls:10 # default: 'Trace DEFAULT:10 tls:10'
# - LOG_EXT_ATTR= # default: empty [filename string]
# - LOG_EXT_FILE=extended.log # default: extended.log [filename string]
# - LOG_SFTP_FILE=sftp.log # default: sftp.log | http://www.proftpd.org/docs/contrib/mod_sftp.html#SFTPLog
# - LOG_FTPS_FILE=ftps.log # default: ftps.log | http://www.proftpd.org/docs/contrib/mod_tls.html#TLSLog
# - LOG_TRANS_FILE=xfer.log # default: xfer.log | http://www.proftpd.org/docs/modules/mod_core.html#TransferLog
# - LOG_SERVER_FILE=server.log # default: server.log | http://www.proftpd.org/docs/modules/mod_log.html#ServerLog
# - LOG_SERVER_FILE=trace.log # default: trace.log | http://www.proftpd.org/docs/howto/Tracing.html
# Sprache/Encoding Einstellungen
# - LANG_DEFAULT=en_US # default: en_US | http://www.proftpd.org/docs/modules/mod_lang.html#LangDefault
# - LANG_OPTIONS=PreferServerEncoding # default: PreferServerEncoding | http://www.proftpd.org/docs/modules/mod_lang.html#LangOptions
# - LANG_USE_ENCODING=on # default: on | http://www.proftpd.org/docs/modules/mod_lang.html#UseEncoding
# ADMIN WEB-UI KONFIG
# - ADMIN_IP=0.0.0.0 # default: 0.0.0.0 | any string ip
# - ADMIN_PORT=8003 # default: 8003 | any UINT number (valid port)
# - ADMIN_BASE_PATH=/ # default: /
# - ADMIN_PASS=Hy2i3kBw4q8Z4zmNVKWHPGV5eC9roeN3 # default: 'Hy2i3kBw4q8Z4zmNVKWHPGV5eC9roeN3' >= 32 characters | written to the DB on every start, leave unset/empty to keep the stored password
# - ADMIN_MIN_ID=1000 # default: 1000 | any UINT number
# - ADMIN_JWT_SIGN=dy8ECoA0z1aLvLqXDRjanaRSABzuzi4e # default: 'dy8ECoA0z1aLvLqXDRjanaRSABzuzi4e' >= 32 characters | JWT Token
# - ADMIN_JWT_ENC=po35XsS8jpEIg708VV4d4TyEDBkSocUH # default: 'po35XsS8jpEIg708VV4d4TyEDBkSocUH' >= 32 characters | JWT Token
# - ADMIN_COOKIE_TTL=86400 # default: 86400
# - ADMIN_COOKIE_SSL=true # default: true
# - ADMIN_COOKIE_HTTPONLY=true # default: true
# Auto-Migrate
# - ADMIN_MIGRATE_TO_V1=false # default: false | enable to migrate Users
# Admin Web-Ui API Firewall
# - FIREWALL_ENABLE=false # default: false
# - FIREWALL_SCHEMA=http # default: 'http'
# - FIREWALL_IP=127.0.0.1 # default: '127.0.0.1'
# - FIREWALL_PORT=8004 # default: 8004
# - FIREWALL_PORT_SFTP # default: nil / unset
# - FIREWALL_PORT_FTP # default: nil / unset
# LOGROTATE
# - LOGROTATE_SIZE=100M # default 100M ([uint]K, [uint]M, [uint]G)
# - LOGROTATE_ROTATE=10 # default 10 [uint]
# - LOGROTATE_MAX_AGE=15 # default 15 [uint]
volumes:
- "/etc/timezone:/etc/timezone:ro" # sets "/etc/timezone" to the same as the host
- "/etc/localtime:/etc/localtime:ro" # sets "/etc/localtime" to the same as the host
- "/var/log/proftpd/:/var/log/proftpd/:rw" # folder for logs
- "./folder/data/:/etc/proftpd/data/:rw" # folder for Config-Data
- "/mnt/ftpusers/:/mnt/ftpusers/:rw" # folder for User-Data
deploy:
resources:
limits:
memory: 1G # adjust to your needs (be generous, as this is just max), recommended are 2G!
# XZ uses 80% of the available memory as limit, so give it enough to compress properly.
restart: unless-stopped
you can also run this docker-compose with specific ports - but it is not recommended if you want to use FTPS:
ports:
- 20-21:20-21 # FTP(s) Ports
# Port 20 = ftp(s) controll port
# Port 21 = ftp(s) connection port
- 22:22 # sFTP Port
- 49152-65534:49152-65534 # FTP Ephemeral Ports (better choose a smaller range!)
- 8003:8003 # Admin Port
The used JWT Token are fully encrypted and are RFC7519 compliant.
Please make sure you set a unique ADMIN_JWT_SIGN & ADMIN_JWT_ENC for every installation!
On newer Systems you explicitly need to create the file /etc/modprobe.d/iptables.conf with this content:
options nf_conntrack_ftp ports=21
(change Port according to the Port you specified - on older Systems use options ip_conntrack_ftp ports=21)
Now run the command modprobe nf_conntrack_ftp or on older Systems modprobe ip_conntrack_ftp.
Highports now should open automatically and Passive Mode should work flawlessly.
Please keep in mind, that without network_mode: host, the rules in the config may need to be altered to have the wanted effect.
As all requests are comming through the docker-network your docker-container is in.
I personally recommend network_mode: host, as it also makes it way more easy to migrate from a plain installation to this dockerized version.
If you know what you do - feel free to use mapped ports.
proFTPd needs public keys in the RFC4716-Format.
In ordert to convert to this format use this command:
ssh-keygen -e -f ~/.ssh/id_rsa.pub -m RFC4716 > ~/.ssh/id_rsa.rfc4716.pub
Other than this use the buildin function in the Admin Web-UI.
Create the container and have fun!
Content type
Image
Digest
sha256:b80bce0cc…
Size
25.1 MB
Last updated
5 months ago
docker pull h0tmann/alpine_proftpd_db