Ansible Role vsftpd
This role installs and configures vsftpd, optionally with SSL (FTPS) and user-specific configs.
Optional Role Variables
Variable |
Description |
Default Value |
---|---|---|
|
Allow chroot()‘ing a user to a directory writable by that user. Note that setting this to YES is potentially dangerous. This setting is only necessary if the root directory of the user’s chroot jail itself is writable. Uploading in subfolders works even if this setting is false. |
|
|
Boolean. If the user should be placed in a |
|
|
Boolean. If true, OpenSSL connection diagnostics are dumped to the vsftpd log file. See |
|
|
Boolean. If enabled, two log files are generated in parallel, going by default to |
|
|
Path to which vsftpd will try to change into after a local (i.e. non-anonymous) login. |
unset |
|
Boolean. When enabled, all FTP requests and responses are logged, providing the option |
|
|
Set to |
|
|
Use this option to override the IP address that vsftpd will advertise in response to the PASV command. Use this when running behind a firewall or loadbalancer. Also see |
unset |
|
Number. The maximum port to allocate for PASV style data connections. |
|
|
Number. The minimum port to allocate for PASV style data connections. |
|
|
Path of the RSA certificate to use for SSL encrypted connections. |
|
|
Path of the RSA private key to use for SSL encrypted connections. If unset, the private key is expected to be in the same file as the certificate. |
unset |
|
Boolean. Controls whether vsftpd attempts to maintain sessions for logins using PAM authentication. Use in combination with |
|
|
Boolean. If enabled vsftpd will support secure connections via SSL. See |
|
|
Path where the user-specific config should be placed. |
|
|
Boolean. If enabled, vsftpd will load a list of usernames, allowing or denying them based on |
|
|
Boolean. If enabled, every login denial based on the userlist will be logged. See |
|
|
Boolean. If enabled, the transfer log file will be written in standard xferlog format, as used by wu-ftpd, which is less readable but can be parsed by existing tools. See |
|
|
Boolean. If true, SSSD will be used during PAM authentication. Use in combination with |
|
|
Boolean. Enables or disables the service, analogous to |
|
|
List of dictionaries. Set user-specific configs, especially useful for the chroot directory (
|
|
Example:
# optional
vsftpd__conf_allow_writeable_chroot: false
vsftpd__conf_chroot_local_user: true
vsftpd__conf_debug_ssl: true
vsftpd__conf_dual_log_enable: true
vsftpd__conf_local_root: '/data'
vsftpd__conf_log_ftp_protocol: true
vsftpd__conf_pasv_addr_resolve: true
vsftpd__conf_pasv_address: 'ftp.example.com'
vsftpd__conf_pasv_max_port: 51000
vsftpd__conf_pasv_min_port: 50000
vsftpd__conf_rsa_cert_file: '/etc/pki/tls/certs/vsftpd.pem'
vsftpd__conf_rsa_private_key_file: '/etc/pki/tls/private/vsftpd.key'
vsftpd__conf_session_support: true
vsftpd__conf_ssl_enable: true
vsftpd__conf_user_config_dir: '/etc/vsftpd/user_config'
vsftpd__conf_userlist_enable: false
vsftpd__conf_userlist_log: true
vsftpd__conf_xferlog_std_format: false
vsftpd__service_enabled: true
vsftpd__user_config__host_var:
- name: 'user1@example.com'
template: 'raw'
state: 'present'
raw: |-
local_root=/data/share1