roles/ftpserver: Update config;roles/shinyproxy: get_url with checksum

group_vars/stations/eci_users.yml

@@ -2,18 +2,17 @@ eci_users:
   - ecitk
   - eciae
   - ecihmt
-  - testuser
-  - testuser2
+  - ecipc
 
 eci_overseers:
   - ecitk
   - eciae
   - ecihmt
+  - ecipc
 
 
 eci_users_uid:
-  testuser: 71
-  testuser2: 72
   ecitk: 73
   eciae: 74
   ecihmt: 75
+  ecipc: 76

hosts.txt

@@ -2,7 +2,7 @@
 pf0320 ansible_host=10.184.166.26
 #pf0320 ansible_host=10.184.166.17
 #pf0322 ansible_host=10.184.166.19
-pf0323 ansible_host=10.184.167.12
+#pf0323 ansible_host=10.184.167.12
 [all:vars]
 ansible_python_interpreter=/usr/bin/python3
 #vault_password_file=meta/zubizareta

roles/ftpserver/files/etc/proftpd/modules.conf

+#
+# This file is used to manage DSO modules and features.
+#
+
+# This is the directory where DSO modules reside
+
+ModulePath /usr/lib/proftpd
+
+# Allow only user root to load and unload modules, but allow everyone
+# to see which modules have been loaded
+
+ModuleControlsACLs insmod,rmmod allow user root
+ModuleControlsACLs lsmod allow user *
+
+#This is required only if you need to set IdentLookups on
+#LoadModule mod_ident.c
+
+LoadModule mod_ctrls_admin.c
+
+# Install proftpd-mod-crypto to use this module for TLS/SSL support.
+#LoadModule mod_tls.c
+# Even these modules depend on the previous one
+#LoadModule mod_tls_fscache.c
+#LoadModule mod_tls_shmcache.c
+
+# Install one of proftpd-mod-mysql, proftpd-mod-pgsql or any other
+# SQL backend engine to use this module and the required backend.
+# This module must be mandatory loaded before anyone of
+# the existent SQL backeds.
+#LoadModule mod_sql.c
+
+# Install proftpd-mod-ldap to use this for LDAP support.
+#LoadModule mod_ldap.c
+
+#
+# 'SQLBackend mysql' or 'SQLBackend postgres' (or any other valid backend) directives 
+# are required to have SQL authorization working. You can also comment out the
+# unused module here, in alternative.
+#
+
+# Install proftpd-mod-mysql and decomment the previous
+# mod_sql.c module to use this.
+#LoadModule mod_sql_mysql.c
+
+# Install proftpd-mod-pgsql and decomment the previous 
+# mod_sql.c module to use this.
+#LoadModule mod_sql_postgres.c
+
+# Install proftpd-mod-sqlite and decomment the previous
+# mod_sql.c module to use this
+#LoadModule mod_sql_sqlite.c
+
+# Install proftpd-mod-odbc and decomment the previous
+# mod_sql.c module to use this
+#LoadModule mod_sql_odbc.c
+
+# Install one of the previous SQL backends and decomment 
+# the previous mod_sql.c module to use this
+#LoadModule mod_sql_passwd.c
+
+LoadModule mod_radius.c
+LoadModule mod_quotatab.c
+LoadModule mod_quotatab_file.c
+
+# Install proftpd-mod-ldap to use this
+#LoadModule mod_quotatab_ldap.c
+
+# Install one of the previous SQL backends and decomment 
+# the previous mod_sql.c module to use this
+#LoadModule mod_quotatab_sql.c
+LoadModule mod_quotatab_radius.c
+# Install proftpd-mod-wrap module to use this
+#LoadModule mod_wrap.c
+LoadModule mod_rewrite.c
+LoadModule mod_load.c
+LoadModule mod_ban.c
+LoadModule mod_wrap2.c
+LoadModule mod_wrap2_file.c
+# Install one of the previous SQL backends and decomment 
+# the previous mod_sql.c module to use this
+#LoadModule mod_wrap2_sql.c
+LoadModule mod_dynmasq.c
+LoadModule mod_exec.c
+LoadModule mod_shaper.c
+LoadModule mod_ratio.c
+LoadModule mod_site_misc.c
+
+# Install proftpd-mod-crypto to use this module for SFTP support.
+#LoadModule mod_sftp.c
+#LoadModule mod_sftp_pam.c
+
+# Install one of the previous SQL backends and decomment 
+# the previous mod_sql.c module to use this
+#LoadModule mod_sftp_sql.c
+
+LoadModule mod_facl.c
+LoadModule mod_unique_id.c
+LoadModule mod_copy.c
+LoadModule mod_deflate.c
+LoadModule mod_ifversion.c
+LoadModule mod_memcache.c
+# Install proftpd-mod-crypto to use this module for TLS/SSL support.
+#LoadModule mod_tls_memcache.c
+
+#LoadModule mod_redis.c
+# Install proftpd-mod-crypto to use this module for TLS/SSL support.
+#LoadModule mod_tls_redis.c
+#LoadModule mod_wrap2_redis.c
+
+#LoadModule mod_auth_otp.c
+
+LoadModule mod_readme.c
+
+# Install proftpd-mod-geoip to use the GeoIP feature
+#LoadModule mod_geoip.c
+
+# Install proftpd-mod-snmp to use the SNMP feature
+LoadModule mod_tls.c
+
+# keep this module the last one
+LoadModule mod_ifsession.c

roles/ftpserver/files/etc/proftpd/proftpd.conf

+#
+# /etc/proftpd/proftpd.conf -- This is a basic ProFTPD configuration file.
+# To really apply changes, reload proftpd after modifications, if
+# it runs in daemon mode. It is not required in inetd/xinetd mode.
+#
+
+# Includes DSO modules
+Include /etc/proftpd/modules.conf
+
+# Set off to disable IPv6 support which is annoying on IPv4 only boxes.
+UseIPv6 on
+# If set on you can experience a longer connection delay in many cases.
+<IfModule mod_ident.c>
+  IdentLookups off
+</IfModule>
+
+# ServerName "PF0320"
+# Set to inetd only if you would run proftpd by inetd/xinetd/socket.
+# Read README.Debian for more information on proper configuration.
+ServerType standalone
+DeferWelcome off
+
+# Disable MultilineRFC2228 per https://github.com/proftpd/proftpd/issues/1085
+# MultilineRFC2228on
+DefaultServer on
+ShowSymlinks on
+
+TimeoutNoTransfer 600
+TimeoutStalled 600
+TimeoutIdle 1200
+
+DisplayLogin welcome.msg
+DisplayChdir .message true
+ListOptions "-l"
+
+DenyFilter \*.*/
+
+# Use this to jail all users in their homes 
+# DefaultRoot~
+
+# Users require a valid shell listed in /etc/shells to login.
+# Use this directive to release that constrain.
+# RequireValidShelloff
+
+# Port 21 is the standard FTP port.
+Port 21
+
+# In some cases you have to specify passive ports range to by-pass
+# firewall limitations. Ephemeral ports can be used for that, but
+# feel free to use a more narrow range.
+# PassivePorts 49152 65534
+
+# If your host was NATted, this option is useful in order to
+# allow passive tranfers to work. You have to use your public
+# address and opening the passive ports used on your firewall as well.
+# MasqueradeAddress 1.2.3.4
+
+# This is useful for masquerading address with dynamic IPs:
+# refresh any configured MasqueradeAddress directives every 8 hours
+<IfModule mod_dynmasq.c>
+# DynMasqRefresh 28800
+</IfModule>
+
+# To prevent DoS attacks, set the maximum number of child processes
+# to 30.  If you need to allow more than 30 concurrent connections
+# at once, simply increase this value.  Note that this ONLY works
+# in standalone mode, in inetd mode you should use an inetd server
+# that allows you to limit maximum number of processes per service
+# (such as xinetd)
+MaxInstances 30
+
+# Set the user and group that the server normally runs at.
+User proftpd
+Group nogroup
+
+# Umask 022 is a good standard umask to prevent new files and dirs
+# (second parm) from being group and world writable.
+Umask 002 002
+# Normally, we want files to be overwriteable.
+AllowOverwrite on
+
+# Uncomment this if you are using NIS or LDAP via NSS to retrieve passwords:
+# PersistentPasswd off
+
+# This is required to use both PAM-based authentication and local passwords
+# AuthOrder mod_auth_pam.c* mod_auth_unix.c
+
+# Be warned: use of this directive impacts CPU average load!
+# Uncomment this if you like to see progress and transfer rate with ftpwho
+# in downloads. That is not needed for uploads rates.
+#
+# UseSendFile off
+
+TransferLog /var/log/proftpd/xferlog
+SystemLog /var/log/proftpd/proftpd.log
+
+# Logging onto /var/log/lastlog is enabled but set to off by default
+#UseLastlog on
+
+# In order to keep log file dates consistent after chroot, use timezone info
+# from /etc/localtime.  If this is not set, and proftpd is configured to
+# chroot (e.g. DefaultRoot or <Anonymous>), it will use the non-daylight
+# savings timezone regardless of whether DST is in effect.
+#SetEnv TZ :/etc/localtime
+
+<IfModule mod_quotatab.c>
+QuotaEngine off
+</IfModule>
+
+<IfModule mod_ratio.c>
+Ratios off
+</IfModule>
+
+
+# Delay engine reduces impact of the so-called Timing Attack described in
+# http://www.securityfocus.com/bid/11430/discuss
+# It is on by default. 
+<IfModule mod_delay.c>
+DelayEngine on
+</IfModule>
+
+<IfModule mod_ctrls.c>
+ControlsEngine off
+ControlsMaxClients 2
+ControlsLog /var/log/proftpd/controls.log
+ControlsInterval 5
+ControlsSocket /var/run/proftpd/proftpd.sock
+</IfModule>
+
+<IfModule mod_ctrls_admin.c>
+AdminControlsEngine off
+</IfModule>
+
+#
+# Alternative authentication frameworks
+#
+#Include /etc/proftpd/ldap.conf
+#Include /etc/proftpd/sql.conf
+
+#
+# This is used for FTPS connections
+#
+Include /etc/proftpd/tls.conf
+
+#
+# This is used for SFTP connections
+#
+#Include /etc/proftpd/sftp.conf
+
+#
+# This is used for other add-on modules
+#
+#Include /etc/proftpd/dnsbl.conf
+#Include /etc/proftpd/geoip.conf
+#Include /etc/proftpd/snmp.conf
+
+#
+# Useful to keep VirtualHost/VirtualRoot directives separated
+#
+#Include /etc/proftpd/virtuals.conf
+
+# A basic anonymous configuration, no upload directories.
+
+# <Anonymous ~ftp>
+#   User ftp
+#   Group nogroup
+#   # We want clients to be able to login with "anonymous" as well as "ftp"
+#   UserAlias anonymous ftp
+#   # Cosmetic changes, all files belongs to ftp user
+#   DirFakeUser on ftp
+#   DirFakeGroup on ftp
+# 
+#   RequireValidShell off
+# 
+#   # Limit the maximum number of anonymous logins
+#   MaxClients 10
+# 
+#   # We want 'welcome.msg' displayed at login, and '.message' displayed
+#   # in each newly chdired directory.
+#   DisplayLogin welcome.msg
+#   DisplayChdir .message
+# 
+#   # Limit WRITE everywhere in the anonymous chroot
+#   <Directory *>
+#     <Limit WRITE>
+#       DenyAll
+#     </Limit>
+#   </Directory>
+# 
+#   # Uncomment this if you're brave.
+#   # <Directory incoming>
+#   #   # Umask 022 is a good standard umask to prevent new files and dirs
+#   #   # (second parm) from being group and world writable.
+#   #   Umask022  022
+#   #   <Limit READ WRITE>
+#   #     DenyAll
+#   #     </Limit>
+#   #       <Limit STOR>
+#   #         AllowAll
+#   #     </Limit>
+#   # </Directory>
+# 
+# </Anonymous>
+
+# Include other custom configuration files
+# !! Please note, that this statement will read /all/ file from this subdir,
+# i.e. backup files created by your editor, too !!!
+# Eventually create file patterns like this: /etc/proftpd/conf.d/*.conf
+# 
+Include /etc/proftpd/conf.d/
+
+DefaultRoot ~
+RequireValidShell off
+AuthUserFile /etc/proftpd/ftpd.passwd
+AuthGroupFile /etc/proftpd/ftpd.group
+AuthOrder mod_auth_file.c
+PassivePorts                  50000 65534

roles/ftpserver/files/etc/proftpd/tls.conf

+#
+# Proftpd sample configuration for FTPS connections.
+#
+# Note that FTPS impose some limitations in NAT traversing.
+# See http://www.castaglia.org/proftpd/doc/contrib/ProFTPD-mini-HOWTO-TLS.html
+# for more information.
+#
+
+<IfModule mod_tls.c>
+TLSEngine                               on
+TLSLog                                  /var/log/proftpd/tls.log
+TLSRSACertificateFile  /etc/eci-platform/pub/certificate.key
+TLSRSACertificateKeyFile /etc/eci-platform/priv/certificate.key
+TLSOptions NoCertRequest EnableDiags NoSessionReuseRequired
+TLSCipherSuite ALL :!ADH:!DES
+TLSVerifyClient off
+TLSRenegotiate required off
+TLSLog /var/log/proftpd/tls.log
+
+#TLSProtocol                             SSLv23
+#
+# Server SSL certificate. You can generate a self-signed certificate using 
+# a command like:
+#
+# openssl req -x509 -newkey rsa:1024 \
+#          -keyout /etc/ssl/private/proftpd.key -out /etc/ssl/certs/proftpd.crt \
+#          -nodes -days 365
+#
+# The proftpd.key file must be readable by root only. The other file can be
+# readable by anyone.
+#
+# chmod 0600 /etc/ssl/private/proftpd.key 
+# chmod 0640 /etc/ssl/private/proftpd.key
+# 
+#TLSRSACertificateFile                   /etc/ssl/certs/proftpd.crt
+#TLSRSACertificateKeyFile                /etc/ssl/private/proftpd.key
+#
+# CA the server trusts...
+#TLSCACertificateFile 			 /etc/ssl/certs/CA.pem
+# ...or avoid CA cert and be verbose
+#TLSOptions                      NoCertRequest EnableDiags 
+# ... or the same with relaxed session use for some clients (e.g. FireFtp)
+#TLSOptions                      NoCertRequest EnableDiags NoSessionReuseRequired
+#
+#
+# Per default drop connection if client tries to start a renegotiate
+# This is a fix for CVE-2009-3555 but could break some clients.
+#
+#TLSOptions 							AllowClientRenegotiations
+#
+# Authenticate clients that want to use FTP over TLS?
+#
+#TLSVerifyClient                         off
+#
+# Are clients required to use FTP over TLS when talking to this server?
+#
+#TLSRequired                             on
+#
+# Allow SSL/TLS renegotiations when the client requests them, but
+# do not force the renegotations.  Some clients do not support
+# SSL/TLS renegotiations; when mod_tls forces a renegotiation, these
+# clients will close the data connection, or there will be a timeout
+# on an idle data connection.
+#
+#TLSRenegotiate                          required off
+</IfModule>

roles/ftpserver/files/etc/proftpd/welcome.msg

+Environmental Cheminformatics FTP node.
+
+Welcome, visitor!
+
+
+
+ECI, LCSB, University of Luxembourg

roles/ftpserver/tasks/main.yml

@@ -16,56 +16,18 @@
   loop: "{{eci_users}}"
   notify: restart-ftp
 
-
-
-- name: Configure ProFTPd umask.
-  ansible.builtin.lineinfile:
-    regexp: '^Umask'
-    line: Umask 002 002
-    path: /etc/proftpd/proftpd.conf
+- name: Copy proftpd config.
   notify: restart-ftp
+  ansible.builtin.copy:
+    src: files/etc/proftpd
+    dest: /etc/proftpd
 
-- name: Configure ProFTPd umask.
+- name: FTP Server name.
   ansible.builtin.lineinfile:
-    regexp: '^#?.LoadModule'
-    line: ModulePath mod_tls.c
-    path: /etc/proftpd/modules.conf
-  notify: restart-ftp
-  
-- name: Configure ProFTPd for multiple virtual users.
-  tags: proftpd-conf-text
-  blockinfile:
+    regexp: '^ServerName'
+    line: "ServerName \"{{ hostvars[inventory_hostname].ansible_hostname }}\""
     path: /etc/proftpd/proftpd.conf
-    block: |
-      DefaultRoot ~
-      RequireValidShell off
-      AuthUserFile /etc/proftpd/ftpd.passwd
-      AuthGroupFile /etc/proftpd/ftpd.group
-      ServerName "{{hostvars[inventory_hostname].ansible_hostname}}"
-      AuthOrder mod_auth_file.c
-      PassivePorts                  50000 65534
-  notify: restart-ftp
-
-- name: Touch tls.conf.
-  tags: proftpd-conf-text
-  file:
-    path: /etc/proftpd/conf.d/tls.conf
-    state: touch
-    
-- name: Add TLS to ProFTPd.
-  tags: proftpd-conf-text
-  blockinfile:
-    path: /etc/proftpd/conf.d/tls.conf
-    block: |
-      TLSEngine on
-      TLSRequired on
-      TLSRSACertificateFile  /etc/eci-platform/pub/certificate.key
-      TLSRSACertificateKeyFile /etc/eci-platform/priv/certificate.key
-      TLSOptions NoCertRequest EnableDiags NoSessionReuseRequired
-      TLSCipherSuite ALL :!ADH:!DES
-      TLSVerifyClient off
-      TLSRenegotiate required off
-      TLSLog /var/log/proftpd/tls.log
   notify: restart-ftp
+  
 
 

roles/shinyproxy/tasks/main.yml

@@ -53,6 +53,7 @@
 - name: Get Shinyproxy.
   get_url:
     url: https://www.shinyproxy.io/downloads/shinyproxy-2.6.0.jar
+    checksum: "sha256:33e79a030294dc4dcb61c3030a53d239a964d6aa1122143d854a329c5c7a233b"
     dest: /eci-users/proxer/shinyproxy.jar
     owner: proxer
     mode: '0700'
@@ -61,6 +62,7 @@
   get_url:
     url: https://zenodo.org/record/6362024/files/docker-shinyscreen.tar.gz?download=1
     dest: /eci-users/proxer/docker-shinyscreen.tar.gz
+    checksum: "sha256:1c1ec4a14d3a691d1a79aaa43e8e58b36ccd5363a6b056c17a7177357dd31d06"
     owner: proxer
     mode: '0700'