208 lines
8.5 KiB
HTML
208 lines
8.5 KiB
HTML
<!DOCTYPE html>
|
|
<html>
|
|
<head>
|
|
<title>ProFTPD: Redis</title>
|
|
</head>
|
|
|
|
<body bgcolor=white>
|
|
|
|
<hr>
|
|
<center><h2><b>ProFTPD: Redis</b></h2></center>
|
|
<hr>
|
|
|
|
<p>
|
|
<b>What is Redis?</b><br>
|
|
<a href="https://redis.io/">Redis</a> is an open-source, high performance
|
|
memory object caching system. A simple (and effective) key/value store
|
|
accessible, efficiently, over the network.
|
|
|
|
<p>
|
|
<b>How Can Redis Be Useful for ProFTPD?</b><br>
|
|
Like any high-performance object store, Redis offers several possibilities to a
|
|
server like ProFTPD. Many sites use Redis for caching; it can <i>also</i> be
|
|
used as an efficient shared storage mechanism, for sharing data among many
|
|
different servers. And for ProFTPD specifically, the shared storage aspect is
|
|
what is most useful. Things like SSL/TLS sessions can be cached and shared
|
|
across a cluster of <code>proftpd</code> servers, as can ban lists for
|
|
badly-behaved clients.
|
|
|
|
<p>
|
|
<b>Enabling Redis Support for ProFTPD</b><br>
|
|
OK, so you are interested enough in the possibilities that Redis offers that
|
|
you want to try it out. Excellent! To do this, you will first need to make
|
|
sure to build your <code>proftpd</code> executable using the
|
|
<code>--enable-redis</code> configure option. The <code>--enable-redis</code>
|
|
configure option automatically adds the
|
|
<code><a href="../modules/mod_redis.html">mod_redis</a></code> module to
|
|
your <code>proftpd</code> build.
|
|
|
|
<p>
|
|
The <code>mod_redis</code> module uses the <code><a href="https://github.com/redis/hiredis">hiredis</a></code> library for talking to Redis servers. If your
|
|
<code>hiredis</code> library is installed in a non-standard location, you may
|
|
need to tell the ProFTPD build system where to find the <code>hiredis</code>
|
|
header files and libraries using the <code>--with-includes</code> and
|
|
<code>--with-libraries</code> configure options.
|
|
|
|
<p>
|
|
There are other modules which make use of Redis support when available, such as
|
|
<code><a href="../contrib/mod_tls_redis.html">mod_tls_redis</a></code>.
|
|
Thus to take advantage of modules like this, putting everything together, your
|
|
configure command might look like this:
|
|
<pre>
|
|
$ ./configure --enable-redis \
|
|
--with-modules=...:mod_tls_redis:... \
|
|
--with-includes=/path/to/hiredis/include \
|
|
--with-libraries=/path/to/hiredis/lib
|
|
</pre>
|
|
|
|
<p>
|
|
<b>Configuring <code>mod_redis</code></b><br>
|
|
Now that you have compiled <code>proftpd</code> with the <code>mod_redis</code>
|
|
module, you need to add the necessary <code>mod_redis</code> directives to
|
|
your <code>proftpd.conf</code>. The following example demonstrates this:
|
|
<pre>
|
|
<IfModule mod_redis.c>
|
|
# Enable mod_redis
|
|
RedisEngine on
|
|
|
|
# Tell mod_redis where to log its messages
|
|
RedisLog /path/to/proftpd/redis.log
|
|
|
|
# Tell mod_redis where to find the Redis server
|
|
RedisServer 192.168.0.10:6379
|
|
</IfModule>
|
|
</pre>
|
|
If you wish to see more detailed logging, at least while you are setting up
|
|
your Redis servers for ProFTPD, you can enable trace logging for the
|
|
<code>redis</code> trace channel using <i>e.g.</i>:
|
|
<pre>
|
|
TraceLog /path/to/proftpd/trace.log
|
|
Trace DEFAULT:10 redis:20
|
|
</pre>
|
|
|
|
<p>
|
|
<b>Using Redis for Shared Storage</b><br>
|
|
You have now compiled support for Redis into ProFTPD, and you have told the
|
|
<code>mod_redis</code> module where to find your Redis servers. Is that all
|
|
you need to do? No. Now you need to tell <code>proftpd</code> modules which
|
|
bits of data to store in your Redis server.
|
|
|
|
<p>
|
|
Currently, only two modules can take advantage of Redis support:
|
|
<code><a href="../contrib/mod_ban.html">mod_ban</a></code> and
|
|
<code><a href="../contrib/mod_tls_redis.html">mod_tls_redis</a></code>.
|
|
|
|
<p>
|
|
First, let us examine <code>mod_ban</code> and how it would use Redis. The
|
|
<code>mod_ban</code> module manages ban lists, lists of clients/users which
|
|
have been banned for various reasons. These lists are stored in shared memory
|
|
by default; this works for a single <code>proftpd</code> server, but if a badly
|
|
behaved client is banned by one <code>proftpd</code> server in pool of servers,
|
|
that client can then connect to a different server which might not have a ban
|
|
for that client -- and the client then gets another chance to be naughty. To
|
|
configure <code>mod_ban</code> so that it stores its ban lists in Redis,
|
|
simply use the following in your <code>proftpd.conf</code>:
|
|
<pre>
|
|
<IfModule mod_ban.c>
|
|
BanEngine on
|
|
|
|
# ...other mod_ban directives...
|
|
|
|
# Tell mod_ban to store its ban lists using Redis
|
|
BanCache redis
|
|
</IfModule>
|
|
</pre>
|
|
With this, <code>mod_ban</code> will use Redis (as well as shared memory) for
|
|
reading/writing its ban lists. And this, in turn, means that other
|
|
<code>proftpd</code> servers' <code>mod_ban</code> modules can see those bans,
|
|
and reject the badly behaved clients across the pool/cluster.
|
|
|
|
<p>
|
|
The <code>mod_tls_redis</code> module uses Redis servers for storing SSL/TLS
|
|
sessions; SSL/TLS session caching can greatly improve SSL/TLS session handshake
|
|
times, particularly for data transfers using SSL/TLS. If you have a pool of
|
|
<code>proftpd</code> servers, and you have FTPS clients which may connect to a
|
|
different node every time, caching the SSL/TLS session data in a shared storage
|
|
mechanism like Redis can be quite beneficial.
|
|
|
|
<p>
|
|
To use Redis for SSL/TLS session caching, then, you use the <a href="../contrib/mod_tls.html#TLSSessionCache"><code>TLSSessionCache</code></a> directive of the <code>mod_tls</code> module, using something like this
|
|
in your <code>proftpd.conf</code>:
|
|
<pre>
|
|
<IfModule mod_tls.c>
|
|
TLSEngine on
|
|
|
|
# ...other mod_tls directives...
|
|
|
|
<IfModule mod_tls_redis.c>
|
|
# Tell mod_tls to cache sessions using Redis
|
|
TLSSessionCache redis:
|
|
</IfModule>
|
|
</IfModule>
|
|
</pre>
|
|
That's it. The <code>mod_tls</code> module now knows to give the SSL/TLS
|
|
session data to <code>mod_tls_redis</code>, and <code>mod_tls_redis</code>
|
|
knows how to talk to the Redis server using <code>mod_redis</code>.
|
|
|
|
<p><a name="FAQ">
|
|
<b>Frequently Asked Questions</b><br>
|
|
<font color=red>Question</font>: If I don't use Redis, are there other
|
|
ways for sharing data (such as ban lists) among different <code>proftpd</code>
|
|
instances?<br>
|
|
<font color=blue>Answer</font>: It might be possible using <code>mod_sql</code>
|
|
and some <code>SQLLogInfo</code> directives, but that would only work for very
|
|
specific information. For sharing things like ban lists and SSL/TLS sessions
|
|
across a cluster of <code>proftpd</code> servers, Redis (or
|
|
<a href="Memcache.html">Memcache</a>) support is <em>recommended</em>.
|
|
|
|
<p>
|
|
<font color=red>Question</font>: Can I use <code>mod_redis</code> to cache
|
|
frequently accessed files, similar to <code><a href="http://wiki.nginx.org/HttpMemcachedModule">nginx+memcache</a></code>?<br>
|
|
<font color=blue>Answer</font>: No. And in reality, caching of files like that
|
|
will probably not give you the same performance gain for FTP transfers as it
|
|
can for HTTP transfers.
|
|
|
|
<p>
|
|
Why not? Many HTTP transfers are for dynamically generated pages; the cost of
|
|
generating each page is expensive, and the generated content may not change
|
|
that frequently (relative to the rate of requests). FTP transfers, by contrast,
|
|
are for <b>static</b> files; FTP servers do not (usually) dynamically generate
|
|
the bytes of the files being downloaded. The cost of reading files from disk
|
|
is probably <i>less</i> than reading files from Redis, over the network, even
|
|
a LAN.
|
|
|
|
<p>
|
|
Now the above may not be true in <b>all</b> cases -- there may be FTP servers
|
|
serving files from network-mounted filesystems (<i>e.g.</i> NFS, CIFS
|
|
<i>et al</i>). And for these very specific cases, having a cache of frequently
|
|
access files on closer storage such as local disk (or Redis) could make a big
|
|
difference; please contact the ProFTPD Project if you find yourself in this
|
|
situation, and we will see what can be done to help.
|
|
|
|
<p>
|
|
<font color=red>Question</font>: Why do I see the following error when
|
|
<code>proftpd</code> starts up?<br>
|
|
<pre>
|
|
mod_tls_redis/0.1: notice: unable to register 'redis' SSL session cache: Redis support not enabled
|
|
</pre>
|
|
<font color=blue>Answer</font>: This message means that your
|
|
<code>proftpd</code> server has <code>mod_tls_redis</code> built and
|
|
loaded, <b>but</b> your <code>proftpd</code> server was <b>not</b> built
|
|
with Redis support (<i>i.e.</i> the <code>--enable-redis</code> configure
|
|
option was not used when compiling <code>proftpd</code>).
|
|
|
|
<p>
|
|
The above is not a fatal or worrisome error; it is merely pointing out that
|
|
some of your modules want to use a feature that was not enabled.
|
|
|
|
<p>
|
|
<hr>
|
|
<font size=2><b><i>
|
|
© Copyright 2017 The ProFTPD Project<br>
|
|
All Rights Reserved<br>
|
|
</i></b></font>
|
|
<hr>
|
|
|
|
</body>
|
|
</html>
|