From 6b93aae155bebc4c498d63ca90b4674c4ed2e4c7 Mon Sep 17 00:00:00 2001
From: Paolo Asperti <paolo@asperti.com>
Date: Sat, 18 May 2019 00:41:50 +0200
Subject: [PATCH] Initial release

---
 Dockerfile  | 13 +++++++++++++
 README.md   | 41 ++++++++++++++++++++++++++++++++++++++++-
 custom.conf | 12 ++++++++++++
 run.sh      | 39 +++++++++++++++++++++++++++++++++++++++
 4 files changed, 104 insertions(+), 1 deletion(-)
 create mode 100644 Dockerfile
 create mode 100644 custom.conf
 create mode 100644 run.sh

diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..c502d52
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,13 @@
+FROM alpine:edge
+
+RUN  \
+    echo "http://dl-cdn.alpinelinux.org/alpine/edge/testing" >> /etc/apk/repositories && \
+    apk -U add proftpd proftpd-mod_tls proftpd-mod_auth_file proftpd-utils openssl && \
+    mkdir -p /var/run/proftpd
+
+COPY custom.conf /etc/proftpd/conf.d/custom.conf
+COPY run.sh /run.sh
+
+RUN chmod +x /run.sh
+ 
+ENTRYPOINT ["/run.sh"]
diff --git a/README.md b/README.md
index 769264b..860c29a 100644
--- a/README.md
+++ b/README.md
@@ -1,3 +1,42 @@
 # docker-ftps
 
-Simple container for FTP+TLS+authentication
+Simple container for FTP+TLS+authentication
+
+## build
+
+```bash
+docker build . -t my-ftps
+```
+
+## run
+
+```bash
+docker run -d --name my-ftps \
+  -p 21:21 -p 20:20 -p 50000-50500:50000-50500 \
+  -e "MASQUERADE=ftp.mydomain.com" \
+  -v "$PWD/auth:/auth" -v "$PWD/ftpdata:/home" \
+  -v "$PWD/certs:/certs" \
+  my-ftps
+```
+
+The *MASQUERADE* parameter is the only required one. You can use an IP address (which is discouraged) or a DNS name.
+You must provide valid certificates for TLS; if you use Lets'Encrypt, you can mofify like this:
+
+```bash
+docker run -d --name my-ftps \
+  -p 21:21 -p 20:20 -p 50000-50500:50000-50500 \
+  -e "MASQUERADE=ftp.mydomain.com" \
+  -v "$PWD/auth:/auth" -v "$PWD/ftpdata:/home" \
+  -v "/etc/letsencrypt/live/ftp.mydomain.com:/certs" \
+  my-ftps
+```
+
+## users management
+
+To change/set a password, do like this (replace "paolo" with the correct username):
+
+```bash
+docker exec -ti my-ftps ftpasswd --passwd --name=paolo --uid=1000 --home=/home/paolo --shell=/bin/false --file=/auth/passwd
+```
+
+You also have to create and chown the user's home folder.
diff --git a/custom.conf b/custom.conf
new file mode 100644
index 0000000..a2a91ab
--- /dev/null
+++ b/custom.conf
@@ -0,0 +1,12 @@
+AuthOrder mod_auth_file.c
+AuthUserFile /auth/passwd
+RequireValidShell off
+ScoreBoardFile /run/proftpd/scoreboard
+PassivePorts 50000 50500
+AllowOverwrite  on
+WtmpLog off
+UseReverseDNS off
+DefaultRoot ~
+Maxclients 30
+MaxClientsPerHost 5
+
diff --git a/run.sh b/run.sh
new file mode 100644
index 0000000..d21d352
--- /dev/null
+++ b/run.sh
@@ -0,0 +1,39 @@
+#!/bin/sh
+
+############ MASQUERADE
+
+MASQUERADE=${MASQUERADE:-127.0.0.1}
+echo "MasqueradeAddress ${MASQUERADE}" > /etc/proftpd/conf.d/masquerade.conf
+
+############ AUTH
+
+[ ! -f /auth/passwd ] && touch /auth/passwd
+
+chmod 0600 /auth/passwd
+chmod 0700 /auth
+
+############ TLS
+
+TLS_CERT=${TLS_CERT:-/certs/cert.pem}
+TLS_KEY=${TLS_KEY:-/certs/privkey.pem}
+TLS_CHAIN=${TLS_CHAIN:-/certs/chain.pem}
+
+cat <<EOF >/etc/proftpd/conf.d/tls.conf 
+<IfModule mod_tls.c>
+  TLSEngine                               on
+  TLSVerifyClient                         off
+  TLSRenegotiate                          none
+  TLSProtocol                             TLSv1.2
+  TLSRSACertificateFile                   $TLS_CERT
+  TLSRSACertificateKeyFile                $TLS_KEY
+  TLSCertificateChainFile                 $TLS_CHAIN
+  TLSCipherSuite                          "ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-RC4-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:RC4-SHA:AES256-GCM-SHA384:AES256-SHA256:CAMELLIA256-SHA:ECDHE-RSA-AES128-SHA:AES128-GCM-SHA256:AES128-SHA256:AES128-SHA:CAMELLIA128-SHA !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS !RC4" 
+  TLSOptions                              NoSessionReuseRequired AllowClientRenegotiations
+  TLSRequired                             on
+</IfModule>
+EOF
+
+
+############ START
+
+proftpd -n