### Run Go HTTP Server

Source: https://github.com/bolcom/unftp/blob/master/docs/server/http-usr.md

Execute the Go program to start the HTTP server. Ensure Go is installed.

```shell
go run main.go
```

--------------------------------

### Install unFTP using Nixpkgs

Source: https://github.com/bolcom/unftp/blob/master/docs/server/installation.md

Installs unFTP using the Nix package manager.

```sh
nix-shell -p uradvd
```

--------------------------------

### Install unFTP Binary on Linux (Dynamic with PAM)

Source: https://github.com/bolcom/unftp/blob/master/docs/server/installation.md

Installs the dynamically linked unFTP binary for Linux with PAM support using curl. Ensure you have sudo privileges.

```sh
curl -L https://github.com/bolcom/unFTP/releases/download/v0.15.2/unftp_x86_64-unknown-linux-gnu \
  | sudo tee /usr/local/bin/unftp > /dev/null && sudo chmod +x /usr/local/bin/unftp
```

--------------------------------

### Install unFTP using FreeBSD Ports

Source: https://github.com/bolcom/unftp/blob/master/docs/server/installation.md

Installs unFTP on FreeBSD using the ports system.

```sh
pkg install ftp/unftp
```

--------------------------------

### Install unFTP using AUR

Source: https://github.com/bolcom/unftp/blob/master/docs/server/installation.md

Installs unFTP using the Arch User Repository (AUR) helper 'yay'.

```sh
yay -S unftp
```

--------------------------------

### Install unFTP Binary on Linux (Static, no PAM)

Source: https://github.com/bolcom/unftp/blob/master/docs/server/installation.md

Installs the statically linked unFTP binary for Linux without PAM support using curl. Ensure you have sudo privileges.

```sh
curl -L https://github.com/bolcom/unFTP/releases/download/v0.15.2/unftp_x86_64-unknown-linux-musl \
  | sudo tee /usr/local/bin/unftp > /dev/null && sudo chmod +x /usr/local/bin/unftp
```

--------------------------------

### Run unFTP with FTPS Enabled

Source: https://github.com/bolcom/unftp/blob/master/docs/server/ftps.md

Start the unFTP server, specifying the certificate and key files. Use `--ftps-required-on-control-channel=all` to enforce TLS on the control channel.

```sh
./unftp \
  --root-dir=/home/unftp/data \
  --ftps-certs-file=/home/unftp/unftp.crt \
  --ftps-key-file=/home/unftp/unftp.key \
  --ftps-required-on-control-channel=all
```

--------------------------------

### Install unFTP Binary on macOS (Intel)

Source: https://github.com/bolcom/unftp/blob/master/docs/server/installation.md

Installs the unFTP binary for macOS (Intel architecture) using curl. Ensure you have sudo privileges.

```sh
curl -L https://github.com/bolcom/unFTP/releases/download/v0.15.2/unftp_x86_64-apple-darwin \
  | sudo tee /usr/local/bin/unftp > /dev/null && sudo chmod +x /usr/local/bin/unftp
```

--------------------------------

### Install unFTP Binary on macOS (ARM)

Source: https://github.com/bolcom/unftp/blob/master/docs/server/installation.md

Installs the unFTP binary for macOS (ARM architecture) using curl. Ensure you have sudo privileges.

```sh
curl -L https://github.com/bolcom/unFTP/releases/download/v0.15.2/unftp_aarch64-apple-darwin \
  | sudo tee /usr/local/bin/unftp > /dev/null && sudo chmod +x /usr/local/bin/unftp
```

--------------------------------

### Connect with FTP Client

Source: https://github.com/bolcom/unftp/blob/master/docs/server/http-usr.md

Use an FTP client to connect to unFTP. The example shows connecting as 'bob' and performing an `ls` command, which should trigger a request to the HTTP user configuration server.

```shell
lftp localhost -p 2121 -u bob
```

--------------------------------

### Basic Redis Log Drain Setup

Source: https://github.com/bolcom/unftp/blob/master/crates/redislog/README.md

Configure and build a slog-redis drain with an async wrapper. Use this to initialize your logger for sending messages to Redis.

```rust
use slog::*;
use slog_redis::Builder;

let redis_drain = Builder::new("my-app-name")
  .redis_host("localhost")
  .redis_key("my_redis_list_key")
  .build()
  .unwrap();

let drain = slog_async::Async::new(redis_drain.fuse()).build().fuse();

let log = Logger::root(drain, o!());
info!(log, "Send me to {}!", "Redis"; "msg" => "Hello World!");
```

--------------------------------

### Go HTTP Server for User Config

Source: https://github.com/bolcom/unftp/blob/master/docs/server/http-usr.md

Implement a simple Go HTTP server to serve user configuration JSON. This server reads a local JSON file and responds to GET requests.

```go
package main

import (
	"fmt"
	"net/http"
	"os"
)

func main() {
	// Specify the path to the JSON file containing user details
	jsonFilePath := "./user-options.json"

	// Create a simple HTTP handler function
	http.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {

    fmt.Println("Requested URL: ", r.URL)

		// Check if the request method is GET
		if r.Method == http.MethodGet {
			// Read the contents of the JSON file
			jsonData, err := os.ReadFile(jsonFilePath)
			if err != nil {
				http.Error(w, fmt.Sprintf("Error reading JSON file: %s", err), http.StatusInternalServerError)
				return
			}

			// Set the Content-Type header to indicate JSON content
			w.Header().Set("Content-Type", "application/json")

			// Write the JSON data to the response writer
			w.Write(jsonData)
		} else {
			// If the request method is not GET, respond with a 405 Method Not Allowed status
			http.Error(w, "Method Not Allowed", http.StatusMethodNotAllowed)
		}
	})

	// Start the web server on port 8080
	fmt.Println("Server is running on http://localhost:8080")
	err := http.ListenAndServe(":8080", nil)
	if err != nil {
		fmt.Printf("Error starting server: %s\n", err)
	}
}
```

--------------------------------

### REST Authentication Successful Response Example

Source: https://github.com/bolcom/unftp/blob/master/docs/server/rest.md

An example of a successful response from the authentication server. unFTP uses the configured selector and regex to determine authentication status.

```json
{"message":"User logged in.","status":"successful"}
```

--------------------------------

### Start unFTP with JSON Authentication

Source: https://github.com/bolcom/unftp/blob/master/docs/server/jsonconfig.md

Configure unFTP to use a JSON file for authentication. Ensure the --auth-type is set to 'json' and provide the path to your credentials file.

```sh
unftp \
    --auth-type=json \
    --auth-json-path=credentials.json
```

--------------------------------

### REST Authentication Request Body Example

Source: https://github.com/bolcom/unftp/blob/master/docs/server/rest.md

This is an example of the JSON request body unFTP constructs for authentication. Placeholders like {USER} and {PASS} are replaced with actual credentials.

```json
{"username":"alice","password":"abc1234"}
```

--------------------------------

### Build unFTP from Source

Source: https://github.com/bolcom/unftp/blob/master/docs/server/installation.md

Builds and installs unFTP from source using Cargo, the Rust package manager. Requires Rust 1.67.1 or higher. The binary will be located in ~/.cargo/bin.

```rust
cargo install unftp
```

--------------------------------

### unFTP Startup Event Notification

Source: https://github.com/bolcom/unftp/blob/master/docs/server/pubsub.md

This event is emitted when the unFTP server starts. It includes library and server version information.

```json
{
  "source_instance": "unFTP",
  "hostname": "MYMAC-XYZ",
  "payload": {
    "Startup": {
      "libunftp_version": "0.19.1",
      "unftp_version": "v0.15.2"
    }
  }
}
```

--------------------------------

### Run unFTP with Anonymous Authentication

Source: https://github.com/bolcom/unftp/blob/master/docs/server/starting.md

Start unFTP with anonymous authentication and default settings. The `--auth-type` switch is required; anonymous is used here for demonstration. Note that the control channel binds to `0.0.0.0:2121` and data channels use ports `49152` to `65535` by default.

```sh
unftp --auth-type anonymous
```

--------------------------------

### Adjust Max Failed Login Attempts

Source: https://github.com/bolcom/unftp/blob/master/docs/server/anti-brute.md

Configures the number of subsequent unsuccessful login attempts before an account is blocked. This example sets the limit to 5 attempts.

```sh
unftp --failed-logins-policy --failed-max-attempts 5
```

--------------------------------

### Configure Comprehensive Failed Logins Policy

Source: https://github.com/bolcom/unftp/blob/master/docs/server/anti-brute.md

An example combining multiple failed login policy configurations: blocking by source IP, setting max attempts to 5, and a block duration of 1800 seconds (30 minutes).

```sh
unftp \
  --failed-logins-policy ip \
  --failed-max-attempts 5 \
  --failed-expire-after 1800
```

--------------------------------

### Configure Redis Logging

Source: https://github.com/bolcom/unftp/blob/master/docs/server/logging.md

Send structured JSON logs to a Redis instance using the RPUSH command. This example configures logging to a local Redis instance on the default port.

```sh
unftp -v \
  --log-redis-host=localhost \
  --log-redis-port=6379 \
  --log-redis-key=logging 
```

--------------------------------

### unFTP Get Event Notification (FTP RETR)

Source: https://github.com/bolcom/unftp/blob/master/docs/server/pubsub.md

This event signifies a file retrieval operation (FTP RETR command). It includes the path of the file being retrieved.

```json
{
  "source_instance": "unFTP",
  "hostname": "MYMAC-XYZ",
  "payload": {
    "Get": {
      "path": "hello.txt"
    }
  },
  "username": "hannes",
  "trace_id": "0x687ee52555459a9c",
  "sequence_number": 2
}
```

--------------------------------

### Adjust Failed Login Block Duration

Source: https://github.com/bolcom/unftp/blob/master/docs/server/anti-brute.md

Sets the duration, in seconds, for which a user account is blocked after exceeding the maximum failed login attempts. This example sets the block duration to 1800 seconds (30 minutes).

```sh
unftp --failed-logins-policy --failed-expire-after 1800
```

--------------------------------

### Show unFTP Help

Source: https://github.com/bolcom/unftp/blob/master/docs/server/starting.md

Use the `--help` argument to display a list of all available command-line arguments for unFTP.

```sh
unftp --help
```

--------------------------------

### Show available make commands

Source: https://github.com/bolcom/unftp/blob/master/README.md

Run this command to see a list of available commands for building and managing unFTP Docker images.

```sh
make help
```

--------------------------------

### View unFTP Key Generator Help

Source: https://github.com/bolcom/unftp/blob/master/docs/server/jsonconfig.md

Display advanced options and usage instructions for the unFTP key generator Docker image by running it with the -h flag.

```shell
docker run -ti bolcom/unftp-key-generator -h
```

--------------------------------

### Define User Configuration JSON

Source: https://github.com/bolcom/unftp/blob/master/docs/server/http-usr.md

Create a JSON file to define user-specific configurations, including permissions, root directories, and account status.

```json
[
  {
    "username": "alice",
    "vfs_perms": [
      "-mkdir",
      "-rmdir",
      "-del",
      "-ren",
      "-md5"
    ],
    "root": "alice",
    "account_enabled": true
  },
  {
    "username": "bob",
    "vfs_perms": [
      "none",
      "+put",
      "+list",
      "+md5"
    ],
    "root": "bob"
  }
]
```

--------------------------------

### Configure unFTP with User JSON Settings

Source: https://github.com/bolcom/unftp/blob/master/docs/server/jsonconfig.md

Instruct unFTP to use a JSON file for both authentication and user-specific settings. Both --auth-json-path and --usr-json-path should point to the same file.

```sh
unftp \
    --auth-type=json \
    --auth-json-path=users.json \
    --usr-json-path=users.json \
    ...
```

--------------------------------

### Run Tests and Linters

Source: https://github.com/bolcom/unftp/blob/master/CONTRIBUTING.md

Execute all tests, clippy, and rustfmt in the project root to ensure code quality before submitting a pull request.

```sh
cargo test --all-features
```

```sh
cargo clippy --all-features
```

```sh
cargo rustfmt
```

--------------------------------

### Configure unFTP with GCS Backend

Source: https://github.com/bolcom/unftp/blob/master/docs/server/cloud-storage.md

Enable the GCS backend by specifying the storage type and providing bucket, root path, and authentication details (key file or workload identity).

```sh
unftp \
  --sbe-type=gcs \
  --sbe-gcs-bucket=mybucket \
  --sbe-gcs-root=ftp-base \
  --sbe-gcs-key-file=/path/to/file
```

--------------------------------

### Configure unFTP with Azure Blob Storage (Account Key)

Source: https://github.com/bolcom/unftp/blob/master/docs/server/cloud-storage.md

Set up unFTP to use Azure Blob Storage with account key authentication. Requires container, account name, and account key. An optional root path can be specified.

```sh
unftp \
  --sbe-type=azblob \
  --sbe-opendal-azblob-container=mycontainer \
  --sbe-opendal-azblob-account-name=mystorageaccount \
  --sbe-opendal-azblob-account-key=your-account-key \
  --sbe-opendal-azblob-root=ftp-data
```

--------------------------------

### Enable INFO Level Logging

Source: https://github.com/bolcom/unftp/blob/master/docs/server/logging.md

Use the `-v` argument to increase the log level to INFO. This provides more detailed output during server startup and operation.

```bash
➜ unftp -v
module: main
 Jan 29 12:54:17.129 INFO Starting unFTP server., sbe-type: filesystem, auth-type: anonymous, home: /var/folders/dt/tmsf_k596295mkh5md67vb840000gp/T/, http-address: 0.0.0.0:8080, ftp-address: 0.0.0.0:2121, libunftp-version: 0.18.3, version:
 Jan 29 12:54:17.130 INFO Using passive port range 49152..65535
 Jan 29 12:54:17.130 INFO Using passive host option 'FromConnection'
 Jan 29 12:54:17.130 INFO Idle session timeout is set to 600 seconds
 Jan 29 12:54:17.130 INFO Starting HTTP service., address: 0.0.0.0:8080
 Jan 29 12:54:17.130 INFO Exposing unFTP service home., path: /
 Jan 29 12:54:17.130 INFO Exposing Prometheus unFTP exporter endpoint., path: /metrics
 Jan 29 12:54:17.149 INFO Exposing readiness endpoint., path: /ready
 Jan 29 12:54:17.149 INFO Exposing liveness endpoint., path: /health
 Jan 29 12:54:17.149 WARN FTPS not enabled
```

--------------------------------

### Run with tokio-console Feature

Source: https://github.com/bolcom/unftp/blob/master/docs/server/tokio-console.md

Execute unFTP with the `tokio_console` feature enabled and the `tokio_unstable` configuration flag. This allows runtime analysis via tokio-console.

```shell
RUSTFLAGS="--cfg tokio_unstable" cargo run --features tokio_console -- -vv --auth-type=anonymous
```

--------------------------------

### Configure unFTP with REST Authentication

Source: https://github.com/bolcom/unftp/blob/master/docs/server/rest.md

Use these command-line arguments to set up unFTP for REST authentication. Specify the HTTP method, URL, request body format, and response parsing details.

```sh
unftp \
    --auth-type rest \
    --auth-rest-method POST \
    --auth-rest-url http://localhost:5000/v1/ftp-auth \
    --auth-rest-body '{"username":"{USER}","password":"{PASS}"}' \
    --auth-rest-selector /status \
    --auth-rest-regex successful
```

--------------------------------

### Create Credentials JSON

Source: https://github.com/bolcom/unftp/blob/master/docs/server/http-usr.md

Define a JSON file for user authentication, containing usernames and passwords. This file is used in conjunction with the HTTP user configuration.

```json
[
  {
    "username": "alice",
    "password": "12345678"
  },
  {
    "username": "bob",
    "password": "secret"
  }
]
```

--------------------------------

### Configure unFTP with HTTP User URL

Source: https://github.com/bolcom/unftp/blob/master/docs/server/http-usr.md

Run unFTP using the `--usr-http-url` argument to specify the address of the HTTP server providing user configurations. This complements `--auth-type=json` and `--auth-json-path`.

```shell
unftp \
    --root-dir=. \
    --auth-type=json \
    --auth-json-path=credentials.json \
    --usr-http-url='http://localhost:8080/users/'
```

--------------------------------

### Build with tokio-console Feature

Source: https://github.com/bolcom/unftp/blob/master/docs/server/tokio-console.md

Compile unFTP with the `tokio_console` feature enabled and the `tokio_unstable` configuration flag. This prepares the binary for debugging with tokio-console.

```sh
RUSTFLAGS="--cfg tokio_unstable" cargo build --features tokio_console
```

--------------------------------

### Run Project Checks Locally

Source: https://github.com/bolcom/unftp/blob/master/crates/redislog/CONTRIBUTING.md

Execute these commands to ensure your code adheres to project standards and passes tests before submitting a pull request. This includes formatting, linting, building, and testing.

```sh
cargo fmt --all

```

```sh
cargo clippy

```

```sh
cargo build --all

```

```sh
cargo test --all

```

```sh
cargo doc --no-deps

```

--------------------------------

### Build Alpine Docker image

Source: https://github.com/bolcom/unftp/blob/master/README.md

Use this command to build the default unFTP Docker image based on Alpine Linux. Pre-built images are also available on Docker Hub.

```sh
make docker-image-alpine
```

--------------------------------

### Enable unFTP Pub/Sub Notifier

Source: https://github.com/bolcom/unftp/blob/master/docs/server/pubsub.md

Use these arguments to enable the unFTP Pub/Sub notifier. Workload identity is the only supported authentication mechanism.

```sh
unftp \
  --ntf-pubsub-project="my-project" \
  --ntf-pubsub-topic="unftp-events"
```

--------------------------------

### Run unFTP Docker Container

Source: https://github.com/bolcom/unftp/blob/master/docs/server/docker.md

Launches an unFTP container with configured environment variables for root directory, log level, FTPS certificates, passive ports, and cloud storage backend (GCS). Maps ports for FTP, passive FTP, and an optional management interface. Mounts local files for certificates and GCS keys into the container.

```sh
docker run \
  -e UNFTP_ROOT_DIR=/ \
  -e UNFTP_LOG_LEVEL=info \
  -e UNFTP_FTPS_CERTS_FILE='/unftp.crt' \
  -e UNFTP_FTPS_KEY_FILE='/unftp.key' \
  -e UNFTP_PASSIVE_PORTS=50000-50005 \
  -e UNFTP_SBE_TYPE=gcs \
  -e UNFTP_SBE_GCS_BUCKET=the-bucket-name \
  -e UNFTP_SBE_GCS_KEY_FILE=/key.json \
  -p 2121:2121 \
  -p 50000-50020:50000-50020 \
  -p 8080:8080 \
  -v /Users/xxx/unftp/unftp.key:/unftp.key  \
  -v /Users/xxx/unftp/unftp.crt:/unftp.crt \
  -v /Users/xxx/unftp/the-key.json:/key.json \
  -ti \
  bolcom/unftp:v0.15.2-alpine
```

--------------------------------

### Configure unFTP Root Directory and Passive Ports

Source: https://github.com/bolcom/unftp/blob/master/docs/server/starting.md

Run unFTP with a specified root directory and a limited range for passive data ports. The `-v` flag enables verbose logging.

```sh
unftp \
  -v \
  --root-dir=/home/unftp/data \
  --bind-address=0.0.0.0:2121 \
  --passive-ports=50000-51000
```

--------------------------------

### Configure Google Cloud Logging

Source: https://github.com/bolcom/unftp/blob/master/docs/server/logging.md

Send logs to Google Cloud Logging by setting the log name and resource type using command-line arguments or environment variables. Authentication is handled via Application Default Credentials.

```bash
➜ unftp \
   --log-google-logname projects/my-gcp-project/logs/my-log-id \
   --log-google-resource-type k8s_container
```

--------------------------------

### Advanced Per-User JSON Settings

Source: https://github.com/bolcom/unftp/blob/master/docs/server/jsonconfig.md

Extend the JSON configuration to include per-user settings like file system permissions (vfs_perms), home directory (root), account status (account_enabled), and client certificate requirements.

```json
[
  {
    "username": "alice",
    "password": "12345678",
    "vfs_perms": ["-mkdir","-rmdir","-del","-ren", "-md5"],
    "root": "alice",
    "account_enabled": true
  },
  {
    "username": "bob",
    "password": "secret",
    "client_cert": {
      "allowed_cn": "bob-the-builder"
    }
  },
  {
    "username": "vincent",
    "root": "vincent",
    "vfs_perms": ["none", "+put", "+md5"],
    "client_cert": {}
  }
]
```

--------------------------------

### Enable HTTP Interface for Prometheus Metrics

Source: https://github.com/bolcom/unftp/blob/master/docs/server/monitoring.md

Configure the HTTP bind address to expose Prometheus metrics. Metrics will be available at the /metrics endpoint.

```sh
unftp \
  --bind-address=0.0.0.0:2121 \
  --bind-address-http=0.0.0.0:8080 \
  --root-dir=/home/unftp/data
```

--------------------------------

### Run with Custom tokio-console Bind Address

Source: https://github.com/bolcom/unftp/blob/master/docs/server/tokio-console.md

Run unFTP with the `tokio_console` feature enabled, specifying a custom bind address for tokio-console connections. This is useful for running multiple unFTP instances on the same host.

```shell
RUSTFLAGS="--cfg tokio_unstable" cargo run --features tokio_console -- --bind-address-tokio-console 127.0.0.1:6670 --auth-type=anonymous
```

--------------------------------

### unFTP Make Directory Event Notification (FTP MKD)

Source: https://github.com/bolcom/unftp/blob/master/docs/server/pubsub.md

This event is emitted when a new directory is created (FTP MKD command). It specifies the path of the new directory.

```json
{
  "source_instance": "unFTP",
  "hostname": "MYMAC-XYZ",
  "payload": {
    "MakeDir": {
      "path": "/x"
    }
  },
  "username": "hannes",
  "trace_id": "0x687ee52555459a9c",
  "sequence_number": 3
}
```

--------------------------------

### Download unFTP Docker Images

Source: https://github.com/bolcom/unftp/blob/master/docs/server/docker.md

Pulls the latest unFTP Docker images from Docker Hub. Use specific tags for version control.

```sh
docker pull bolcom/unftp:v0.15.2-alpine
docker pull bolcom/unftp:v0.15.2-scratch
```

--------------------------------

### Enable DEBUG Level Logging

Source: https://github.com/bolcom/unftp/blob/master/docs/server/logging.md

Specify `-vv` to enable DEBUG level logging for the most verbose output.

```bash
➜ unftp -vv
```

--------------------------------

### Generate Server Root Key and Certificate for mTLS

Source: https://github.com/bolcom/unftp/blob/master/docs/server/ftps.md

Create a server root key and certificate to act as a Certificate Authority (CA) for signing client certificates.

```sh
openssl genrsa -out unftp_client_ca.key 2048
openssl req -new -x509 -days 365 \
	-key unftp_client_ca.key \
        -subj '/CN=unftp-ca.mysite.com/O=bol.com/C=NL' \
	-out unftp_client_ca.crt
```

--------------------------------

### Enable Default Failed Logins Policy

Source: https://github.com/bolcom/unftp/blob/master/docs/server/anti-brute.md

Enables the default failed logins policy. By default, 3 subsequent unsuccessful login attempts block further attempts for that user originating from that source IP for 5 minutes.

```sh
unftp --failed-logins-policy
```

--------------------------------

### Run unFTP with Proxy Protocol Enabled

Source: https://github.com/bolcom/unftp/blob/master/docs/server/proxy-protocol.md

Configure unFTP to listen on an external control port when running in proxy protocol mode. This is necessary for load balancers or reverse proxies to forward client IP information correctly.

```sh
unftp \
    --proxy-external-control-port=2121
```

--------------------------------

### Configure unFTP with Azure Blob Storage (SAS Token)

Source: https://github.com/bolcom/unftp/blob/master/docs/server/cloud-storage.md

Configure unFTP for Azure Blob Storage using a SAS token for authentication. This method requires the container, account name, and the SAS token itself.

```sh
unftp \
  --sbe-type=azblob \
  --sbe-opendal-azblob-container=mycontainer \
  --sbe-opendal-azblob-account-name=mystorageaccount \
  --sbe-opendal-azblob-sas-token="?sv=2021-06-08&ss=bfqt&srt=sco&sp=rwdlacupx&se=..."
```

--------------------------------

### Run unFTP with mTLS Enabled

Source: https://github.com/bolcom/unftp/blob/master/docs/server/ftps.md

Configure unFTP to require client authentication using the CA certificate. This enables mutual TLS.

```sh
unftp \
  --root-dir=/home/unftp/data \
  --ftps-certs-file=/home/unftp/unftp.crt \
  --ftps-key-file=/home/unftp/unftp.key \
  --ftps-required-on-control-channel=all \
  --ftps-client-auth=require \
  --ftps-trust-store=/Users/xxx/unftp/unftp_client_ca.crt
```

--------------------------------

### JSON Credentials with Secure Passwords

Source: https://github.com/bolcom/unftp/blob/master/docs/server/jsonconfig.md

Integrate securely generated passwords using PBKDF2 salt, key, and iteration count into your JSON credentials file. This replaces the plain 'password' field.

```json
[
  {
    "username": "alice",
    "password": "12345678"
  },
  {
    "username": "bob",
    "password": "secret"
  },
  {
    "username": "carol",
    "pbkdf2_salt": "Hp1WZRnzOUM=",
    "pbkdf2_key": "BOipkps/qYxlMLiuFcRjYUKivclvVXsc8f0T2pIvG6U=",
    "pbkdf2_iter": 500000
  }
]
```

--------------------------------

### Sign Client Certificate with CA

Source: https://github.com/bolcom/unftp/blob/master/docs/server/ftps.md

Use the generated CA key and certificate to sign the client's CSR, creating a trusted client certificate.

```sh
openssl x509 -req \
  -in client.csr \
  -CA unftp_client_ca.crt \
  -CAkey unftp_client_ca.key \
  -CAcreateserial \
  -extfile <(printf "subjectAltName=DNS:localhost") \
  -out client.crt \
  -days 1024 \
  -sha256
```

--------------------------------

### Create Client Key and CSR for mTLS

Source: https://github.com/bolcom/unftp/blob/master/docs/server/ftps.md

Generate a private key for the client and a Certificate Signing Request (CSR) including Subject Alternative Name (SAN) for localhost.

```sh
openssl genrsa -out client.key 2048
```

```sh
openssl req -new -sha256 \
    -key client.key \
    -subj '/CN=unftp-client.mysite.com/O=bol.com/C=NL' \
    -reqexts SAN \
    -config <(cat /etc/ssl/openssl.cnf \
        <(printf "\n[SAN]\nsubjectAltName=DNS:localhost")) \
    -out client.csr
```

--------------------------------

### Connect with CURL using Client Certificate

Source: https://github.com/bolcom/unftp/blob/master/docs/server/ftps.md

Use curl to connect to the unFTP server using FTPS and providing the client certificate and key for authentication. Ensure TLS 1.2 is used.

```sh
curl -v \
  --insecure \
  --user 'test:test' \
  --ftp-ssl --ssl-reqd \
  --ftp-pasv --disable-epsv \
  --cacert unftp_client_ca.crt \
  --cert client.crt \
  --key client.key \
  --cert-type PEM \
  --pass '' \
  --tlsv1.2 \
  ftp://localhost:2121/
```

--------------------------------

### Generate Secure Password with unFTP Key Generator

Source: https://github.com/bolcom/unftp/blob/master/docs/server/jsonconfig.md

Use the unFTP key generator Docker image to create secure, salted, and iterated passwords. This output can be directly added to your JSON credentials file.

```shell
➜ docker run -ti bolcom/unftp-key-generator -u

Enter username or press ENTER to finish: hannes
Enter password or press ENTER to generate one:
Generated password: 4?KH[FN=W@bztq%[
[
  {
    "username": "hannes",
    "pbkdf2_salt": "+uhutJYSS7Y=",
    "pbkdf2_key": "sXdS1w0cH+bsNLKwW/Mek0hGXoJr+hrBJ1AjkubePiM=",
    "pbkdf2_iter": 500000
  }
]
```

--------------------------------

### Default unFTP Logging

Source: https://github.com/bolcom/unftp/blob/master/docs/server/logging.md

By default, unFTP outputs only Error and Warning messages to STD OUT.

```bash
➜ unftp
module: main
 Jan 29 12:53:25.187 WARN FTPS not enabled
```

--------------------------------

### unFTP Put Event Notification (FTP STOR)

Source: https://github.com/bolcom/unftp/blob/master/docs/server/pubsub.md

This event is generated when a file is uploaded (FTP STOR command). It includes the path where the file is stored.

```json
{
  "source_instance": "unFTP",
  "hostname": "MYMAC-XYZ",
  "payload": {
    "Put": {
      "path": "x.yaml"
    }
  },
  "username": "hannes",
  "trace_id": "0x687ee52555459a9c",
  "sequence_number": 5
}
```

--------------------------------

### Block by Source IP

Source: https://github.com/bolcom/unftp/blob/master/docs/server/anti-brute.md

Configures the failed logins policy to block based solely on the source IP address, rather than the combination of IP and username. This is useful for blocking malicious IPs.

```sh
unftp --failed-logins-policy ip
```

--------------------------------

### unFTP Login Event Notification

Source: https://github.com/bolcom/unftp/blob/master/docs/server/pubsub.md

This event is triggered upon a successful user login. It includes username and trace ID for correlation.

```json
{
  "source_instance": "unFTP",
  "hostname": "MYMAC-XYZ",
  "payload": {
    "Login": {}
  },
  "username": "hannes",
  "trace_id": "0xe25ceb1d960303f3",
  "sequence_number": 1
}
```

--------------------------------

### Generate Self-Signed Certificate for FTPS

Source: https://github.com/bolcom/unftp/blob/master/docs/server/ftps.md

Use openssl to generate a self-signed certificate and private key for FTPS. This certificate is valid for 10 years.

```sh
openssl req \
   -x509 \
   -newkey rsa:2048 \
   -nodes \
   -keyout unftp.key \
   -out unftp.crt \
   -days 3650 \
   -subj '/CN=www.myunftp.domain/O=My Company Name LTD./C=NL'
```

--------------------------------

### unFTP Rename Event Notification (FTP RNFR/RNTO)

Source: https://github.com/bolcom/unftp/blob/master/docs/server/pubsub.md

This event captures a file or directory rename operation (FTP RNFR and RNTO commands). It includes the original and new paths.

```json
{
  "source_instance": "unFTP",
  "hostname": "MYMAC-XYZ",
  "payload": {
    "Rename": {
      "from": "/x",
      "to": "/y"
    }
  },
  "username": "hannes",
  "trace_id": "0x687ee52555459a9c",
  "sequence_number": 4
}
```

--------------------------------

### Block by Username

Source: https://github.com/bolcom/unftp/blob/master/docs/server/anti-brute.md

Configures the failed logins policy to block based solely on the username. Be aware that this may also affect legitimate login attempts for the same username from different IPs.

```sh
unftp --failed-logins-policy user
```

--------------------------------

### unFTP Logout Event Notification

Source: https://github.com/bolcom/unftp/blob/master/docs/server/pubsub.md

This event is generated when a user logs out. It contains username and trace ID.

```json
{
  "source_instance": "unFTP",
  "hostname": "MYMAC-XYZ",
  "payload": {
    "Logout": {}
  },
  "username": "hannes",
  "trace_id": "0xe25ceb1d960303f3",
  "sequence_number": 2
}
```

--------------------------------

### JSON Log Message Format

Source: https://github.com/bolcom/unftp/blob/master/crates/redislog/README.md

The expected JSON format for log messages sent to Redis. Includes timestamp, host, message, and structured fields.

```json
 {
    "@timestamp": ${timeRFC3339},
    "@source_host": ${hostname},
    "@message": ${message},
    "@fields": {
       "level": ${levelLowercase},
       "application": ${appName}
       ... // logged field 1
       ... // logged field 2
       ...
   }
}
```

--------------------------------

### Redis Log Message Format

Source: https://github.com/bolcom/unftp/blob/master/docs/server/logging.md

This is the structure of the JSON log messages sent to Redis, including timestamp, host, message, and custom fields.

```json
{
    "@timestamp": ${timeRFC3339},
    "@source_host": ${hostname},
    "@message": ${message},
    "@fields": {
       "level": ${levelLowercase},
       "application": ${appName}
       ... // logged field 1
       ... // logged field 2
       ...
   }
}
```

=== COMPLETE CONTENT === This response contains all available snippets from this library. No additional content exists. Do not make further requests.