pure-ftpd.yml 3.9 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127
  1. - name: 'Install pure-ftpd related packages'
  2. apt:
  3. pkg:
  4. - 'pure-ftpd'
  5. state: 'present'
  6. tags:
  7. - 'ftp'
  8. - 'pure-ftpd'
  9. - name: 'Install pure-ftpd configuration (TLS settings)'
  10. lineinfile:
  11. dest: '/etc/pure-ftpd/conf/{{ item.dest }}'
  12. regexp: '{{ item.regexp }}'
  13. line: '{{ item.line }}'
  14. create: yes
  15. with_items:
  16. - { dest: 'TLS', regexp: '^[0-9]+$', line: '3' }
  17. - { dest: 'TLSCipherSuite', regexp: '^.*$', line: 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!MD5:!PSK:!SSLv3:!SSLv2:!TLSv1' }
  18. notify:
  19. - 'Restart pure-ftpd'
  20. when: with_ftp_tls|bool
  21. tags:
  22. - 'ftp'
  23. - 'pure-ftpd'
  24. - name: 'Create pure-ftpd SSL bundle certificate symlink'
  25. file:
  26. src: '/etc/ssl/local/certs/{{ ftp_tls_domain }}/bundle.pem'
  27. path: '/etc/ssl/private/pure-ftpd.pem'
  28. state: 'link'
  29. notify:
  30. - 'Restart pure-ftpd'
  31. when: with_ftp_tls|bool and ftp_tls_domain
  32. tags:
  33. - 'ftp'
  34. - 'pure-ftpd'
  35. - name: 'Create pure-ftpd Diffie Hellman Param file symlink'
  36. file:
  37. src: '/etc/ssl/private/dh2048.pem'
  38. path: '/etc/ssl/private/pure-ftpd-dhparams.pem'
  39. state: 'link'
  40. notify:
  41. - 'Restart pure-ftpd'
  42. when: with_ftp_tls|bool
  43. tags:
  44. - 'ftp'
  45. - 'pure-ftpd'
  46. - name: 'Install pure-ftpd configuration'
  47. lineinfile:
  48. dest: '/etc/pure-ftpd/conf/{{ item.dest }}'
  49. regexp: '{{ item.regexp }}'
  50. line: '{{ item.line }}'
  51. create: yes
  52. with_items:
  53. - { dest: 'BrokenClientsCompatibility', regexp: '^(yes|no)', line: 'yes' }
  54. - { dest: 'ChrootEveryone', regexp: '^(yes|no)', line: 'yes' }
  55. - { dest: 'DontResolve', regexp: '^(yes|no)', line: 'yes' }
  56. - { dest: 'NoAnonymous', regexp: '^(yes|no)', line: 'yes' }
  57. - { dest: 'NoChmod', regexp: '^(yes|no)', line: 'yes' }
  58. - { dest: 'PAMAuthentication', regexp: '^(yes|no)', line: 'yes' }
  59. - { dest: 'VerboseLog', regexp: '^(yes|no)', line: 'no' }
  60. - { dest: 'MinUID', regexp: '^[0-9]+$', line: '34' } # Debian's uid(backup) = 34
  61. - { dest: 'PassivePortRange', regexp: '^[0-9]+ [0-9]+$', line: '64000 65000' }
  62. notify:
  63. - 'Restart pure-ftpd'
  64. tags:
  65. - 'ftp'
  66. - 'pure-ftpd'
  67. - name: 'Enable pure-ftpd internal DB'
  68. file:
  69. src: '/etc/pure-ftpd/conf/PureDB'
  70. path: '/etc/pure-ftpd/auth/80puredb'
  71. state: 'link'
  72. notify:
  73. - 'Restart pure-ftpd'
  74. tags:
  75. - 'ftp'
  76. - 'pure-ftpd'
  77. - name: 'Clean up pure-ftpd internal DB'
  78. raw: pure-pw list 2>/dev/null | sed -r 's/^(\S+)\s.*$/\1/' | while read u ; do pure-pw userdel "${u}" ; done
  79. changed_when: False
  80. tags:
  81. - 'ftp'
  82. - 'pure-ftpd'
  83. - name: 'Create FTP accounts home directory'
  84. file:
  85. path: '{{ item.home }}'
  86. owner: '{{ item.uid }}'
  87. group: '{{ item.gid }}'
  88. mode: 0755
  89. state: 'directory'
  90. with_items: '{{ ftp_accounts }}'
  91. when: ftp_accounts|length > 0
  92. tags:
  93. - 'ftp'
  94. - 'pure-ftpd'
  95. - name: 'Add FTP accounts in pure-ftpd'
  96. raw: printf "{{ item.password }}\n{{ item.password }}\n" | pure-pw useradd "{{ item.user }}" -d "{{ item.home }}" -u "{{ item.uid }}" -g "{{ item.gid }}"
  97. with_items: '{{ ftp_accounts }}'
  98. changed_when: False
  99. when: with_ftp|bool and ftp_accounts|length > 0
  100. tags:
  101. - 'ftp'
  102. - 'pure-ftpd'
  103. - name: 'Rebuild pure-ftpd internal DB'
  104. raw: pure-pw mkdb 2>/dev/null
  105. changed_when: False
  106. tags:
  107. - 'ftp'
  108. - 'pure-ftpd'
  109. - name: 'Ensure pure-ftpd is running'
  110. service:
  111. name: 'pure-ftpd'
  112. state: 'started'
  113. tags:
  114. - 'ftp'
  115. - 'pure-ftpd'
  116. # vim: ft=yaml.ansible