FTP Server / proftpd.conf (SSL/TLS + MySQL)

# cat /usr/local/etc/proftpd.conf

ServerName                      "ProFTPD Default Installation"
ServerType                      standalone
DefaultServer                   on
ScoreboardFile          /var/run/proftpd/proftpd.scoreboard
Port                            21
IdentLookups off
UseReverseDNS off
ListOptions "-a"
Umask                           022
MaxInstances                    30
CommandBufferSize       512
User                            nobody
Group                           nogroup
AllowOverwrite          on

  DenyAll


    TLSEngine on
    TLSLog /var/log/proftpd/tls.log
    TLSProtocol SSLv23 TLSv1
    TLSRequired off
    TLSRSACertificateFile /usr/local/etc/ssl/server.crt
    TLSRSACertificateKeyFile /usr/local/etc/ssl/server.key
    TLSVerifyClient off
    TLSRenegotiate required off


    SQLAuthenticate     users
    SQLConnectInfo      proftpd@localhost:3306 proftpd 
    SQLAuthTypes        Plaintext
    SQLUserInfo         users userid passwd uid gid homedir shell
    SQLGroupInfo        groups groupname gid members
    AuthOrder           mod_sql.c

ProFTPD mini-HOWTO Index
On SQL configurations
http://www.proftpd.org/docs/howto/SQL.html
On SSL/TLS configurations
http://www.proftpd.org/docs/howto/TLS.html

DNS Server / .zone

# cat /etc/namedb/master/rishiri.info.zone

$TTL    86400
@       IN      SOA     ps1.rishiri.info. root.ps1.rishiri.info. (
                        2008110601;     Serial
                        3600    ;       Refresh
                        900     ;       Retry
                        1209600 ;       Expire
                        3600)   ;       Minimum
        IN      A       219.117.217.101
        IN      NS      ps1.rishiri.info.
        IN      NS      ddns1.interlink.or.jp.
        IN      MX      10      mx.rishiri.info.
        IN TXT "v=spf1 a mx ptr ip4:219.117.217.101 mx:mx.rishiri.info mx:rishiri.info -all"
_policy._domainkey.rishiri.info. IN TXT "t=y; o=~;"
selector._domainkey.rishiri.info. IN TXT "k=rsa; t=y; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCvq5/6nE1kA9MiZZ0lu2ixS/i976+RY+Da51oIE4gcdGiuS/8ORBOTDpyaX6NQodfeZe9RM7gfutL8YgN5htZHhCV9wJTgA+evV3kiZ10zfgpsExoEhKESN5EVm5lIuZ8CwKRBUK/qLEN/NupF3EZXczR/YUymvPmFTfBOFk06KwIDAQAB"

ps1     IN      A       219.117.217.101
mx      IN      A       219.117.217.101
www     IN      A       219.117.217.101
mail    IN      A       219.117.217.101
ftp     IN      A       219.117.217.101
server  IN      A       219.117.217.101
ldap    IN      A       219.117.217.101

# cat /etc/namedb/master/rishiri.info_dmz.zone

$TTL    86400
@       IN      SOA     ps1.rishiri.info. root.ps1.rishiri.info. (
                        2008110601;     Serial
                        3600    ;       Refresh
                        900     ;       Retry
                        1209600 ;       Expire
                        3600)   ;       Minimum

        IN      NS      ps1.rishiri.info.
        IN      MX      10      rishiri.info.

        IN      A       192.168.0.3
server  IN      A       192.168.0.3
ps1     IN      A       192.168.1.10
www     IN      A       192.168.0.3
ftp     IN      A       192.168.0.3
mail    IN      A       192.168.0.3
mx      IN      A       192.168.0.3
ldap    IN      A       192.168.0.3

# cat /etc/namedb/master/rishiri.info_private.zone

$TTL    86400
@       IN      SOA     ps1.rishiri.info. root.ps1.rishiri.info. (
                        2008110601;     Serial
                        3600    ;       Refresh
                        900     ;       Retry
                        1209600 ;       Expire
                        3600)   ;       Minimum

        IN      NS      ps1.rishiri.info.
        IN      NS      ddns1.interlink.or.jp.
        IN      MX      10      mx.rishiri.info.

        IN      A       192.168.1.3
server  IN      A       192.168.1.3
mx      IN      A       192.168.1.3
www     IN      A       192.168.1.3
mail    IN      A       192.168.1.3
ftp     IN      A       192.168.1.3
client1 IN      A       192.168.1.4
client2 IN      A       192.168.1.5
ps1     IN      A       192.168.1.10
ldap    IN      A       192.168.1.3

# cat /etc/namedb/master/127.0.0.zone

$TTL    86400
@       IN      SOA     ps1.rishiri.info. root.ps1.rishiri.info. (
                        2008110601;     Serial
                        3600    ;       Refresh
                        900     ;       Retry
                        1209600 ;       Expire
                        3600)   ;       Minimum

        IN      NS      ps1.rishiri.info.
1       IN      PTR     localhost.

# cat /etc/namedb/master/192.168.0.zone

$TTL    86400
@       IN      SOA     ps1.rishiri.info. root.ps1.rishiri.info. (
                        2008110601;     Serial
                        3600    ;       Refresh
                        900     ;       Retry
                        1209600 ;       Expire
                        3600)   ;       Minimum

        IN      NS      ps1.rishiri.info.

3       IN      PTR     rishiri.info.
10      IN      PTR     ps1.rishiri.info.

# cat /etc/namedb/master/192.168.1.zone

$TTL    86400
@       IN      SOA     ps1.rishiri.info. root.ps1.rishiri.info. (
                        2008110601;     Serial
                        3600    ;       Refresh
                        900     ;       Retry
                        1209600 ;       Expire
                        3600)   ;       Minimum

        IN      NS      ps1.rishiri.info.

        IN      PTR     rishiri.info.
3       IN      PTR     ps1.rishiri.info.
4       IN      PTR     client1.rishiri.info.
5       IN      PTR     client2.rishiri.info.
6       IN      PTR     backup.rishiri.info.
10      IN      PTR     ps1.rishiri.info.

# cat /etc/namedb/master/192.168.10.zone

$TTL    86400
@       IN      SOA     ps1.rishiri.info. root.ps1.rishiri.info. (
                        2008110601;     Serial
                        3600    ;       Refresh
                        900     ;       Retry
                        1209600 ;       Expire
                        3600)   ;       Minimum

        IN      NS      ps1.rishiri.info.

1       IN      PTR     setup.netvorante.jp.
2       IN      PTR     ps1.rishiri.info.

# cat /etc/namedb/master/219.117.217.101.zone

$TTL 86400
@       IN      SOA     ps1.rishiri.info. root.ps1.rishiri.info. (
                        2008102906;     Serial
                        3600    ;       Refresh
                        900     ;       Retry
                        1209600 ;       Expire
                        3600)   ;       Minimum

        IN      NS      ps1.rishiri.info.
        IN      NS      ddns1.interlink.or.jp.
        IN      MX      10      mx.rishiri.info.

        IN      PTR     ps1.rishiri.info.

DNS Server / rndc.conf

# cat /etc/namedb/rndc.conf

include "/etc/namedb/rndc.key";

options {
        default-server 127.0.0.1;
        default-key RNDC;
};

DNS Server / named.conf

# cat /etc/namedb/named.conf

acl privatenet {
        192.168.1.0/24;
        127.0.0.1/32;
        };
acl dmznet {
        192.168.0.0/24;
        };
acl external {
        };
options {
        directory       "/etc/namedb";
        pid-file        "/var/run/named/pid";
        dump-file       "/var/dump/named_dump.db";
        statistics-file "/var/stats/named.stats";
        listen-on       { 127.0.0.1; 192.168.10.0/24; 192.168.1.0/24; 192.168.0.0/24; };
        allow-transfer  { none; };
        allow-query     { none; };
        recursion       no;
        version         "(^0^)";
        };
logging {
        category lame-servers { null; };
        channel security_log {
        file "/var/log/security.log" versions 7 size 1m;
        severity info;
        print-time yes;
        print-category yes;
        };
category security { "security_log"; };
        };
include "rndc.key";
controls {
        inet 127.0.0.1 allow { 127.0.0.1; } keys { RNDC; };
        };
view internal {
        match-clients   { privatenet; };
        allow-transfer  { privatenet; };
        allow-query     { privatenet; };
        recursion       yes;
zone "0.0.127.in-addr.arpa" {
        type master;
        file "master/127.0.0.zone";
        allow-update { none; };
                };
zone "rishiri.info" {
        type master;
        file "master/rishiri.info_private.zone";
                };
zone "1.168.192.in-addr.arpa" {
        type master;
        file "master/192.168.1.zone";
                };
        };
view dmz {
        match-clients { dmznet; };
        allow-query   { dmznet; };
        recursion no;
zone "0.168.192.in-addr.arpa" {
        type master;
        file "master/192.168.0.zone";
                };
zone "rishiri.info" {
        type master;
        file "master/rishiri.info_dmz.zone";
                };
        };
view external {
        match-clients { any; };
        allow-query     { any; };
        recursion no;
zone "." {
        type hint;
        file "named.root";
                };
zone "10.168.192.in-addr.arpa" {
        type master;
        file "master/192.168.10.zone";
        allow-update { none; };
                };
zone "rishiri.info" {
        type master;
        file "master/rishiri.info.zone";
        allow-transfer  {
        external;
                };
        };
zone "101.217.117.219.in-addr.arpa" {
        type master;
        file "master/219.117.217.101.zone";
        allow-transfer  {
        external;
                };
        };
};

Proxy Server / squid.conf

# cat /usr/local/etc/squid/squid.conf

auth_param basic program /usr/local/libexec/squid/ncsa_auth /usr/local/etc/squid/passwd.squid
auth_param basic children 5
auth_param basic realm Squid proxy-caching web server
auth_param basic credentialsttl 2 hours
auth_param basic casesensitive off
acl authen proxy_auth REQUIRED
acl all src 0.0.0.0/0.0.0.0
acl manager proto cache_object
acl localhost src 127.0.0.1/255.255.255.255
acl to_localhost dst 127.0.0.0/8
acl SSL_ports port 443
acl Safe_ports port 80          # http
acl Safe_ports port 21          # ftp
acl Safe_ports port 443         # https
acl Safe_ports port 70          # gopher
acl Safe_ports port 210         # wais
acl Safe_ports port 1025-65535  # unregistered ports
acl Safe_ports port 280         # http-mgmt
acl Safe_ports port 488         # gss-http
acl Safe_ports port 591         # filemaker
acl Safe_ports port 777         # multiling http
acl CONNECT method CONNECT
acl localnet src 192.168.1.0/255.255.255.0
http_access allow manager localhost
http_access deny manager
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow localnet
http_access deny all
icp_access allow all
http_port 18080 transparent
hierarchy_stoplist cgi-bin ?
cache_mem 32 MB
cache_dir ufs /usr/local/squid/cache 1024 16 256
access_log /usr/local/squid/logs/access.log squid
ftp_user mail@rishiri.info
acl QUERY urlpath_regex cgi-bin \?
cache deny QUERY
refresh_pattern ^ftp:           1440    20%     10080
refresh_pattern ^gopher:        1440    0%      1440
refresh_pattern .               0       20%     4320
acl apache rep_header Server ^Apache
broken_vary_encoding allow apache
header_access X-Forwarded-For deny all
header_access Via deny all
header_access Cache-Control deny all
header_replace User-Agent Nutscrape/1.0 (CP/M; 8-bit)
shutdown_lifetime 0 seconds
cache_effective_group squid
visible_hostname unknown
icp_port 0
error_directory /usr/local/etc/squid/errors/Japanese
forwarded_for off
coredump_dir /usr/local/squid/cache

Proxy Server / hosts

# cat hosts

::1                     localhost.rishiri.info localhost
127.0.0.1               localhost.rishiri.info localhost
192.168.10.1            setup.netvolante.jp
192.168.0.2             server.rishiri.info     server
192.168.10.2            ps1.rishiri.info ps1
192.168.10.2            ps1.rishiri.info.
192.168.0.10            ps1.rishiri.info        ps1
192.168.1.10            ps1.rishiri.info        ps1

Proxy Server / resolv.conf

# cat resolv.conf

domain  rishiri.info
nameserver      127.0.0.1
nameserver      192.168.10.2
nameserver      192.168.1.3
nameserver      219.117.217.101
nameserver      203.141.128.39