# IP address/port to listen to (default=all IP and port 21).

# Bind                      127.0.0.1,21
# listen on ipv4 address only
#Bind                      0.0.0.0,21
# listen on ipv6 address only
#Bind                      ::,21
# listen on all interfaces and address
Bind                      *,21


# Port range for passive connections replies. - for firewalling.

# PassivePortRange          30000 50000
PassivePortRange          32768 65534


# Force an IP address in PASV/EPSV/SPSV replies. - for NAT.
# Symbolic host names are also accepted for gateways with dynamic IP
# addresses.

# ForcePassiveIP                192.168.0.1
# ForcePassiveIP                1.1.1.1

# Maximum idle time in minutes (default = 15 minutes)

MaxIdleTime                 15

# Display fortune cookies

# FortunesFile              /usr/share/fortune/zippy

# - '-F <fortune file>': Display a fortune cookie on login. The sentence is
# a random extract from the text file <fortune file>. This text file should be
# formatted like standard "fortune" files (fortunes are separated by a '%'
# sign on a single line) . Pure-FTPd has to be compiled with support for
# cookies (--with-cookie). If you just want a simple banner displayed before
#the login prompt, add the name of any text file here.

# create /etc/pure-ftpd/conf/FortunesFile
echo "/home/user/fortunes.txt" > /etc/pure-ftpd/conf/FortunesFile
/usr/sbin/pure-ftpd -F /etc/pure-ftpd/conf/FortunesFile

# Create an additional log file with transfers logged in a Apache-like format
# :
# fw.c9x.org - jedi [13/Dec/1975:19:36:39] "GET /ftp/linux.tar.bz2" 200
# 21809338
# This log file can then be processed by www traffic analyzers.

#AltLog                     clf:/var/log/pureftpd.log
AltLog                     clf:/var/log/pureftpd/pureftpd.log



# Create an additional log file with transfers logged in a format optimized
# for statistic reports.

# AltLog                     stats:/var/log/pureftpd.log
AltLog                     stats:/var/log/pureftpd/pureftpd.xfer.log



# Create an additional log file with transfers logged in the standard W3C
# format (compatible with most commercial log analyzers)

# AltLog                     w3c:/var/log/pureftpd.log

# OPTIONS

# - '-O <format>:<log file>': Record all file transfers into a specific log
# file, in an alternative format. Currently, four formats are supported: CLF
# (Apache-like), Stats, W3C and xferlog.

# If you add '-O clf:/var/log/pureftpd.log' to your starting options,
# Pure-FTPd will log transfers in /var/log/pureftpd.log in a format similar to
# the Apache web server in default configuration. 

# If you use '-O stats:/var/log/pureftpd.log' to your starting options,
# Pure-FTPd will create log files in a special format, designed for statistical
# reports. The Stats format is compact, more efficient and more accurate that
# CLF and the old broken "xferlog" format.

/usr/sbin/pure-ftpd -O clf:/var/log/pureftpd/pureftpd.log -O stats:/var/log/pureftpd/pureftpd.xfer.log

# Disallow anonymous connections. Only allow authenticated users.

NoAnonymous                 no

# PureDB user database (see README.Virtual-Users)

# PureDB                        /etc/pure-ftpd/pureftpd.pdb


# Path to pure-authd socket (see README.Authentication-Modules)

# ExtAuth                       /var/run/ftpd.sock



# If you want to enable PAM authentication, uncomment the following line

PAMAuthentication             yes



# If you want simple Unix (/etc/passwd) authentication, uncomment this

UnixAuthentication            yes



# Please note that LDAPConfigFile, MySQLConfigFile, PAMAuthentication and
# UnixAuthentication can be used only once, but they can be combined
# together. For instance, if you use MySQLConfigFile, then UnixAuthentication,
# the SQL server will be asked. If the SQL authentication fails because the
# user wasn't found, another try # will be done with /etc/passwd and
# /etc/shadow. If the SQL authentication fails because the password was wrong,
# the authentication chain stops here. Authentication methods are chained in
# the order they are given.

# Postgres configuration file (see README.PGSQL)

# PGSQLConfigFile               /etc/pure-ftpd/pureftpd-pgsql.conf
PGSQLConfigFile               /etc/pure-ftpd/pureftpd-pgsql.conf
[...]
# Minimum UID for an authenticated user to log in.

MinUID                      450

# If PostgreSQL listens to a TCP socket
#PGSQLServer     localhost
PGSQLServer     10.5.5.5
PGSQLPort       5432

# *or* if PostgreSQL can only be reached through a local Unix socket
# PGSQLServer     /tmp
# PGSQLPort       .s.PGSQL.5432

# Mandatory : user to bind the server as.
#PGSQLUser       postgres
PGSQLUser       pureftpd

# Mandatory : user password. You *must* have a password.
#PGSQLPassword   rootpw
PGSQLPassword   pureftpd

# Mandatory : database to open.
#PGSQLDatabase   pureftpd
PGSQLDatabase   virtual

# Mandatory : how passwords are stored
# Valid values are : "cleartext", "crypt", "md5" and "any"
PGSQLCrypt      cleartext
[...]
# Query to execute in order to fetch the password

#PGSQLGetPW      SELECT Password FROM users WHERE User='\L'
PGSQLGetPW      SELECT password FROM pureftpd_users WHERE username='\L'


# Query to execute in order to fetch the system user name or uid

#PGSQLGetUID     SELECT Uid FROM users WHERE User='\L'
PGSQLGetUID     SELECT uid FROM pureftpd_users WHERE username='\L'


# Optional : default UID - if set this overrides PGSQLGetUID

#PGSQLDefaultUID 1000


# Query to execute in order to fetch the system user group or gid

#PGSQLGetGID     SELECT Gid FROM users WHERE User='\L'
PGSQLGetGID     SELECT gid FROM pureftpd_users WHERE username='\L'


# Optional : default GID - if set this overrides PGSQLGetGID

#PGSQLDefaultGID 1000


# Query to execute in order to fetch the home directory

#PGSQLGetDir     SELECT Dir FROM users WHERE User='\L'
PGSQLGetDir     SELECT home FROM pureftpd_users WHERE username='\L'

# MySQL configuration file (see README.MySQL)

# MySQLConfigFile               /etc/pure-ftpd/pureftpd-mysql.conf
MySQLConfigFile               /etc/pure-ftpd/pureftpd-mysql.conf
[...]
# Minimum UID for an authenticated user to log in.

MinUID                      450

# Optional : MySQL server name or IP. Don't define this for unix sockets.

# MYSQLServer     127.0.0.1
MYSQLServer     10.5.5.5


# Optional : MySQL port. Don't define this if a local unix socket is used.

# MYSQLPort       3306
MYSQLPort       3306


# Optional : define the location of mysql.sock if the server runs on this host.

#MYSQLSocket     /var/lib/mysql/mysql.sock


# Mandatory : user to bind the server as.

#MYSQLUser       root
MYSQLUser       pureftpd


# Mandatory : user password. You must have a password.

#MYSQLPassword   rootpw
MYSQLPassword   pureftpd


# Mandatory : database to open.

#MYSQLDatabase   pureftpd
MYSQLDatabase   virtual


# Mandatory : how passwords are stored
# Valid values are : "cleartext", "crypt", "md5" and "password"
# ("password" = MySQL password() function)
# You can also use "any" to try "crypt", "md5" *and* "password"

MYSQLCrypt      cleartext
[...]
# Query to execute in order to fetch the password

#MYSQLGetPW      SELECT Password FROM users WHERE User="\L"
MYSQLGetPW      SELECT password FROM pureftpd_users WHERE username="\L"


# Query to execute in order to fetch the system user name or uid

#MYSQLGetUID     SELECT Uid FROM users WHERE User="\L"
MYSQLGetUID     SELECT uid FROM pureftpd_users WHERE username="\L"


# Optional : default UID - if set this overrides MYSQLGetUID

#MYSQLDefaultUID 1000


# Query to execute in order to fetch the system user group or gid

#MYSQLGetGID     SELECT Gid FROM users WHERE User="\L"
MYSQLGetGID     SELECT gid FROM pureftpd_users WHERE username="\L"


# Optional : default GID - if set this overrides MYSQLGetGID

#MYSQLDefaultGID 1000


# Query to execute in order to fetch the home directory

#MYSQLGetDir     SELECT Dir FROM users WHERE User="\L"
MYSQLGetDir     SELECT home FROM pureftpd_users WHERE username="\L"

# PureDB user database (see README.Virtual-Users)

# PureDB                        /etc/pure-ftpd/pureftpd.pdb
PureDB                        /etc/pure-ftpd/pureftpd.pdb
[...]
# Minimum UID for an authenticated user to log in.

MinUID                      450

# LDAP configuration file (see README.LDAP)

LDAPConfigFile                /etc/pure-ftpd/pureftpd-ldap.conf



# Please note that LDAPConfigFile, MySQLConfigFile, PAMAuthentication and
# UnixAuthentication can be used only once, but they can be combined
# together. For instance, if you use MySQLConfigFile, then UnixAuthentication,
# the SQL server will be asked. If the SQL authentication fails because the
# user wasn't found, another try # will be done with /etc/passwd and
# /etc/shadow. If the SQL authentication fails because the password was wrong,
# the authentication chain stops here. Authentication methods are chained in
# the order they are given.

# Only connections to this specific IP address are allowed to be
# non-anonymous. You can use this directive to open several public IPs for
# anonymous FTP, and keep a private firewalled IP for remote administration.
# You can also only allow a non-routable local IP (like 10.x.x.x) to
# authenticate, and keep a public anon-only FTP server on another IP.

#TrustedIP                  10.1.1.1

# Don't allow authenticated users - have a public anonymous FTP only.

AnonymousOnly               no

# Disallow anonymous connections. Only allow authenticated users.

NoAnonymous                 no

# Are anonymous users allowed to create new directories ?

AnonymousCanCreateDirs      no

# Upload/download ratio for anonymous users.

# AnonymousRatio                1 10

# Disallow downloading of files owned by "ftp", ie.
# files that were uploaded but not validated by a local admin.

AntiWarez                   yes

# Do not use the /etc/ftpusers file to disable accounts. We're already
# using MinUID to block users with uid < 500

UseFtpUsers no

# Prohibit *reading* of files beginning with a dot (.history, .ssh...)

ProhibitDotFilesRead        no

# Users can't delete/write files beginning with a dot ('.')
# even if they own them. If TrustedGID is enabled, this group
# will have access to dot-files, though.

ProhibitDotFilesWrite       no

# Disallow anonymous users to upload new files (no = upload is allowed)

AnonymousCantUpload         yes

# This option can accept three values :
# 0 : disable SSL/TLS encryption layer (default).
# 1 : accept both traditional and encrypted sessions.
# 2 : refuse connections that don't use SSL/TLS security mechanisms,
#     including anonymous sessions.
# Do _not_ uncomment this blindly. Be sure that :
# 1) Your server has been compiled with SSL/TLS support (--with-tls),
# 2) A valid certificate is in place,
# 3) Only compatible clients will log in.

# TLS                      1
TLS                      1

# OPTIONS

# -Y  --tls                   <0:no TLS | 1:TLS+cleartext | 2:enforce TLS |
#                             3: enforce encrypted data channel as well>

/usr/sbin/pure-ftpd -Y 1

# OPTIONS

# - '-J <ciphers>': Sets the list of ciphers that will be accepted for
# SSL/TLS connections.
# For example: -J HIGH:MEDIUM

# -J --tlsciphersuite <ciphers>

/usr/sbin/pure-ftpd -J HIGH:MEDIUM