#
# /etc/proftpd/proftpd.conf -- This is a basic ProFTPD configuration file.
# To really apply changes, reload proftpd after modifications, if
# it runs in daemon mode. It is not required in inetd/xinetd mode.
#

# Includes DSO modules
Include /etc/proftpd/modules.conf

# Set off to disable IPv6 support which is annoying on IPv4 only boxes.
%if %%activer_ipv6 == 'oui'
UseIPv6				on
%else
UseIPv6				off
%end if

# Normally, incoming active mode data connections
# and outgoing passive mode data connections
# have a reverse DNS lookup performed on the remote host's IP address.
# Disabling this directive prevents proftpd from attempting
# to reverse-lookup data connection IP addresses.
UseReverseDNS			off

ServerName              "%%ftp_servername"
ServerType              standalone
DeferWelcome            off

DefaultServer           on

# TimeoutNoTransfer -- Sets the connection without transfer timeout
TimeoutNoTransfer       600
# TimeoutIdle -- Sets the idle connection timeout
TimeoutIdle             %%ftp_timeoutidle

# MaxClients -- Limits the number of users that can connect
MaxClients              %%ftp_maxclients
# MaxInstances -- Sets the maximum number of child processes to be spawned
MaxInstances            %%ftp_maxinstances
# MaxRetrieveFileSize -- Restrict size of downloaded files
MaxRetrieveFileSize     %%ftp_maxretrievefilesize Mb
# MaxStoreFileSize -- Restrict size of uploaded files
MaxStoreFileSize        %%ftp_maxstorefilesize Mb

DisplayLogin            welcome.msg
DisplayChdir            .message true
ListOptions             "-l"

DenyFilter			\*.*/

# Use this to jail all users in their homes
# DefaultRoot			~

# Users require a valid shell listed in /etc/shells to login.
# Use this directive to release that constrain.
# RequireValidShell		off

# Port 21 is the standard FTP port.
Port				21

# In some cases you have to specify passive ports range to by-pass
# firewall limitations. Ephemeral ports can be used for that, but
# feel free to use a more narrow range.
# PassivePorts                  49152 65534

# If your host was NATted, this option is useful in order to
# allow passive tranfers to work. You have to use your public
# address and opening the passive ports used on your firewall as well.
# MasqueradeAddress		1.2.3.4

# This is useful for masquerading address with dynamic IPs:
# refresh any configured MasqueradeAddress directives every 8 hours
<IfModule mod_dynmasq.c>
# DynMasqRefresh 28800
</IfModule>

# To prevent DoS attacks, set the maximum number of child processes
# to 30.  If you need to allow more than 30 concurrent connections
# at once, simply increase this value.  Note that this ONLY works
# in standalone mode, in inetd mode you should use an inetd server
# that allows you to limit maximum number of processes per service
# (such as xinetd)
MaxInstances			30

# Set the user and group that the server normally runs at.
User				proftpd
Group				nogroup

# Umask 022 is a good standard umask to prevent new files and dirs
# (second parm) from being group and world writable.
Umask				022  022
# Normally, we want files to be overwriteable.
AllowOverwrite			on

# Uncomment this if you are using NIS or LDAP via NSS to retrieve passwords:
# PersistentPasswd		off

# This is required to use both PAM-based authentication and local passwords
# AuthOrder			mod_auth_pam.c* mod_auth_unix.c

# Be warned: use of this directive impacts CPU average load!
# Uncomment this if you like to see progress and transfer rate with ftpwho
# in downloads. That is not needed for uploads rates.
#
# UseSendFile			off

TransferLog /var/log/proftpd/xferlog
SystemLog   /var/log/proftpd/proftpd.log

# Logging onto /var/log/lastlog is enabled but set to off by default
#UseLastlog on

# In order to keep log file dates consistent after chroot, use timezone info
# from /etc/localtime.  If this is not set, and proftpd is configured to
# chroot (e.g. DefaultRoot or <Anonymous>), it will use the non-daylight
# savings timezone regardless of whether DST is in effect.
#SetEnv TZ :/etc/localtime

<IfModule mod_quotatab.c>
QuotaEngine off
</IfModule>

<IfModule mod_ratio.c>
Ratios off
</IfModule>


# Delay engine reduces impact of the so-called Timing Attack described in
# http://www.securityfocus.com/bid/11430/discuss
# It is on by default.
<IfModule mod_delay.c>
DelayEngine on
</IfModule>

<IfModule mod_ctrls.c>
ControlsEngine        off
ControlsMaxClients    2
ControlsLog           /var/log/proftpd/controls.log
ControlsInterval      5
ControlsSocket        /var/run/proftpd/proftpd.sock
</IfModule>

<IfModule mod_ctrls_admin.c>
AdminControlsEngine off
</IfModule>

#
# Alternative authentication frameworks
#
#Include /etc/proftpd/ldap.conf
#Include /etc/proftpd/sql.conf

# activation du tls
%if %%ftp_tls == 'oui'
LoadModule mod_tls.c
<IfModule mod_tls.c>
   TLSEngine on
   TLSRequired on
   TLSRSACertificateFile %%server_cert
   TLSRSACertificateKeyFile %%server_key
   TLSCACertificateFile /etc/ssl/certs/ca.crt
   TLSProtocol TLSv1
   TLSCipherSuite ALL:!aNULL:!ADH:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM
</IfModule>
%end if

# work around for symlinks with Filezilla (#7052)
# The mod_facts module is ProFTPD's module for handling the MLSD and MLST commands,
# in support of RFC 3659.
# In addition, the mod_facts module implements the MFF and MFMT commands defined in:
# http://tools.ietf.org/html/draft-somers-ftp-mfxx-04
<IfModule mod_facts.c>
   FactsOptions UseSlink
</IfModule>

#
# Useful to keep VirtualHost/VirtualRoot directives separated
#
#Include /etc/proftpd/virtuals.con

# Interdictions d'accès restrictives
<Directory />
    <Limit ALL>
        Order Allow,Deny
        Deny ALL
    </Limit>
</Directory>

# Needed for NIS.
PersistentPasswd        off

# Default root can be used to put users in a chroot environment.
# As an example if you have a user foo and you want to put foo in /home/foo
# chroot environment you would do this:
#
# DefaultRoot /home/foo foo
# DefaultRoot /home

# authentification PAM
AuthPAM                 on

# service PAM utilisé (mettre ftp pour utiliser /etc/pam.d/ftp)
AuthPAMConfig           proftpd

# l'utilisateur n'a pas obligatoirement de shell
RequireValidShell       off

# on arrive dans le répertoire spécial FTP
DefaultChdir            ~/.ftp

%if %%activer_ftp_anonymous_access == 'oui'
<Anonymous %%ftp_anonymous_directory>
    User                ftp
    Group               ftp
    UserAlias           anonymous ftp
    RequireValidShell   off
    <Limit WRITE>
        DenyAll
    </Limit>
</Anonymous>
%end if

%if %%activer_ftp_access == 'oui'
%for %%acces in %%ftp_access_directory
<Directory %%acces>
    <Limit ALL>
        Order Allow,Deny
        Allow ALL
    </Limit>
</Directory>
%end for
%end if

# Include other custom configuration files
Include /etc/proftpd/conf.d/
