Sstrutt: /* Enable TLS Encryption (FTPS) */ typo fix

2012-05-22T09:15:56Z

Enable TLS Encryption (FTPS): typo fix

← Older revision		Revision as of 09:15, 22 May 2012
Line 31:		Line 31:
	Unlike [[Acronyms#H\|HTTPS]], where a different TCP port is used to differentiate from [[Acronyms#H\|HTTPS]]; this is not required for [[Acronyms#F\|FTPS]], which can use the same default ports as for [[Acronyms#F\|FTP]] (TCP 20 and 21).		Unlike [[Acronyms#H\|HTTPS]], where a different TCP port is used to differentiate from [[Acronyms#H\|HTTPS]]; this is not required for [[Acronyms#F\|FTPS]], which can use the same default ports as for [[Acronyms#F\|FTP]] (TCP 20 and 21).

	# Obtain / create appropriate certificates (see [[Secure_Website#Create_Self-Signed_Certificate\|Create		# Obtain / create appropriate certificates (see [[Secure_Website#Create_Self-Signed_Certificate\|Create Self-Signed Certificate]] for info), required files...

	Self-Signed Certificate] for info), required files...
	#* Certificate Authority certificate (eg <code> self-ca.crt </code>)		#* Certificate Authority certificate (eg <code> self-ca.crt </code>)
	#* Server Private Key (eg <code> my-server.key </code>)		#* Server Private Key (eg <code> my-server.key </code>)

Sstrutt: Initial creation

2012-05-01T16:14:15Z

Initial creation

New page

All procedures etc on this page have been created by me, with usage of the [http://www.proftpd.org/localsite/Userguide/linked/userguide.html ProFTPD manual], unless otherwise stated.

== Installation ==
On Ubuntu the basic install is incredibly taxing, as you'd expect...
# Start installation
#* <code> apt-get install proftpd </code>
# When prompted, select the following options
#* Accept "unable to authenticate"
#* Select "standalone"

This will provide access to existing users of the server (no anonymous access). Users will be directed to their home directory, but able to change into any other directory on the system (so the same permissions as is they were SSH'ed to the system).

Suggested config changes (edit <code> /etc/proftpd/proftpd.conf </code>)...
* <code> ServerName "name"</code>
** This is displayed during login, and can be useful to remind/verify that you've logged into the correct server (though isn't shown if you enable <code> DeferWelcome </code>)
* <code> DeferWelcome on</code>
** Prevents welcome message being displayed until after successful login, which restricts what information might be given away to unwanted probers, such as local IP address. Note that the fact that its a ProFTPD serer and the running version is still displayed unless you set in <code>ServerIdent</code>!
* <code> ServerIdent on "FTP Server ready" </code>
** Sets the message displayed on initial connect (on by default)
* <code> DefaultRoot ~ </code>
** Locks users into their home directory (this is NOT infallible and can, with quite a bit of effort, be broken out from, see http://www.bpfh.net/simes/computing/chroot-break.html)

To limit which systems users are allowing to login, use the following in <code> /etc/proftpd/proftpd.conf </code>...
<Limit LOGIN>
AllowUser usera, userb
DenyAll
</Limit>

=== Enable TLS Encryption (FTPS) ===
Unlike [[Acronyms#H|HTTPS]], where a different TCP port is used to differentiate from [[Acronyms#H|HTTPS]]; this is not required for [[Acronyms#F|FTPS]], which can use the same default ports as for [[Acronyms#F|FTP]] (TCP 20 and 21).

# Obtain / create appropriate certificates (see [[Secure_Website#Create_Self-Signed_Certificate|Create

Self-Signed Certificate] for info), required files...
#* Certificate Authority certificate (eg <code> self-ca.crt </code>)
#* Server Private Key (eg <code> my-server.key </code>)
#* Server Site Certificate (eg <code> ftp-my-server.crt </code>)
# Edit master config file, <code> /etc/proftpd/tls.conf </code> and uncomment TLS config include
#* <code> Include /etc/proftpd/tls.conf </code>
# Edit <code> /etc/proftpd/tls.conf </code> as shown below
# Restart the ProFTPD service
#* <code> service proftpd restart </code>

<pre>
TLSEngine on
TLSLog /var/log/proftpd/tls.log
TLSProtocol SSLv3 TLSv1

TLSRSACertificateFile /etc/proftpd/ftp-my-server.crt
TLSRSACertificateKeyFile /etc/apache2/ssl/web2-server.key
TLSCACertificateFile /etc/apache2/ssl/self-ca.crt

TLSVerifyClient off
TLSRequired off
</pre>

== Create Locked Down User ==
The following example creates a user with access to a specific (home) directory only.

The example creates the user <code> ftp-user </code>, with access tied to an existing folder <code>/var/www/wp</code> (which could be the root of a [http://wordpress.org/ WordPress] blog, allowing one-click updating of the software from the WordPress interface)

# Create a dummy (non existent) shell, by editing <code> /etc/shells </code>
#* <code> /bin/false </code>
# Create user account with home dir, and no shell
#* <code> useradd ftp-user -p ftp-password -d /var/www/wp -s /bin/false </code>

Note that unless the user (<code>ftp-user</code> in the above example) has access to write in the folder already, that user will not be able to write. Assuming that the group ownership for the files in folder is <code>www-data</code>, then the user will need to be added to the <code>www-data</code> group. To determine which group has rights over the files, do a <code> ls -l </code> in the directory, the second name is the group, so in the example below, the user is <code>me</code> and the group is <code>www-data</code>...

root@server:/var/www/wp# ls -l
total 332
-rw-rw-r-- 1 me www-data 4268 2010-10-20 15:40 wp-activate.php
drwxrwxr-x 9 me www-data 4096 2011-01-03 20:53 wp-admin
-rw-rw-r-- 1 me www-data 40272 2010-10-28 16:48 wp-app.php
-rw-rw-r-- 1 me www-data 274 2010-11-20 21:44 wp-blog-header.php
....

To add user <code>ftp-user</code> to group <code>www-data</code>...
# Edit <code> vi /etc/group </code>
# Append <code>www-data</code> to the end of the line for <code>www-data</code>
#* EG <code> www-data:x:34:wibble,ftp-user </code>

Source: http://ubuntuforums.org/showthread.php?t=79588

[[Category:ProFTPD]]
[[Category:Ubuntu]]

ProFTPD - Revision history

Sstrutt: /* Enable TLS Encryption (FTPS) */ typo fix

Sstrutt: Initial creation