| Version 1 (modified by iva, 14 years ago) (diff) |
|---|
Configure VSFTPD For FTP/SSL
NOTES:
- Intermediate certificates were incorporated in VSFTPD vers. 2.0.5
http://bugs.donarmstrong.com/cgi-bin/bugreport.cgi?bug=307498
- Version 2.0.7 solved TLS disconnect problems experienced by FileZilla users
http://forum.filezilla-project.org/viewtopic.php?f=2&t=7688
http://forum.filezilla-project.org/viewtopic.php?t=7580&f=2
http://forums.proftpd.org/smf/index.php?topic=3501.0
- VSFTPD 2.2.x requires OpenSSL 0.9.8
Configure FTP/SSL server
- Update default configuration.
# rpm -q vsftpd openssl vsftpd-2.2.2-8.el4 openssl-0.9.8n-1.el4 # # cd /etc/vsftpd # cp -a vsftpd.conf vsftpd.conf.orig # vi vsftpd.conf # # diff vsftpd.conf.orig vsftpd.conf 110a111,120 > > ssl_enable=YES > ssl_sslv2=NO > ssl_sslv3=YES > ssl_tlsv1=YES > ssl_ciphers=HIGH:!MD5:!ADH > rsa_cert_file=/etc/vsftpd/server.pem > force_local_logins_ssl=YES > force_local_data_ssl=YES > require_ssl_reuse=NO #
- Combine private key and public SSL certificate, that were created for Apache web server, into a PEM file.
# ls -lg /etc/httpd/conf/ssl.???/server.???
-rw-r--r-- 1 root 1151 Oct 16 2009 /etc/httpd/conf/ssl.crt/server.crt
-rw------- 1 root 887 Oct 16 2009 /etc/httpd/conf/ssl.key/server.key
#
# cat /etc/httpd/conf/ssl.key/server.key \
/etc/httpd/conf/ssl.crt/server.crt > /etc/vsftpd/server.pem
# chmod 400 /etc/vsftpd/server.pem
# ls -lg /etc/vsftpd/server.pem
-r-------- 1 root 2038 Jun 10 2010 /etc/vsftpd/server.pem
#
#
NOTE:
- If intermediate (chain) certificate is involved, it should be added to the server.pem file as well.
- Start the service.
# chkconfig vsftpd on # service vsftpd start Starting vsftpd for vsftpd: [ OK ] #
Test from a client
$ openssl s_client -connect punkts.org:ftp -starttls ftp -showcerts
CONNECTED(00000003)
depth=1 /C=US/O=Equifax/OU=Equifax Secure Certificate Authority
verify return:1
depth=0 /C=US/O=punkts.org/OU=GT96579082/OU=See www.rapidssl.com/resources/cps (c)09/OU=Domain Control Validated - RapidSSL(R)/CN=punkts.org
verify return:1
---
Certificate chain
0 s:/C=US/O=punkts.org/OU=GT96579082/OU=See www.rapidssl.com/resources/cps (c)09/OU=Domain Control Validated - RapidSSL(R)/CN=punkts.org
i:/C=US/O=Equifax/OU=Equifax Secure Certificate Authority
-----BEGIN CERTIFICATE-----
MIIDJjCCAo+gAwIBAgIDDW7zMA0GCSqGSIb3DQEBBQUAME4xCzAJBgNVBAYTAlVT
MRAwDgYDVQQKEwdFcXVpZmF4MS0wKwYDVQQLEyRFcXVpZmF4IFNlY3VyZSBDZXJ0
aWZpY2F0ZSBBdXRob3JpdHkwHhcNMDkxMDE2MDczMzMxWhcNMTAxMDE3MTgyNDQ3
WjCBsDELMAkGA1UEBhMCVVMxEzARBgNVBAoTCnB1bmt0cy5vcmcxEzARBgNVBAsT
CkdUOTY1NzkwODIxMTAvBgNVBAsTKFNlZSB3d3cucmFwaWRzc2wuY29tL3Jlc291
cmNlcy9jcHMgKGMpMDkxLzAtBgNVBAsTJkRvbWFpbiBDb250cm9sIFZhbGlkYXRl
ZCAtIFJhcGlkU1NMKFIpMRMwEQYDVQQDEwpwdW5rdHMub3JnMIGfMA0GCSqGSIb3
DQEBAQUAA4GNADCBiQKBgQDVTLBP4XpLQWbKhSr/7m4IgQNf9EdYYMvTtwGHIoGA
I76H71PbQJJTXTvcgJS4ypVQJdfsU7dIEr9vgHn11KxFP7qzxeEiGmcKZWLoaDEm
3orhFT3+bVgL8XEH4/6shPqB2+fhK12jrqxVwZL4dGzoi2c7qyiVzvEMRNM5+1tp
8wIDAQABo4GuMIGrMA4GA1UdDwEB/wQEAwIE8DAdBgNVHQ4EFgQUn0DBj7z9DbuM
Z5whzEVPLqg9bTMwOgYDVR0fBDMwMTAvoC2gK4YpaHR0cDovL2NybC5nZW90cnVz
dC5jb20vY3Jscy9zZWN1cmVjYS5jcmwwHwYDVR0jBBgwFoAUSOZo+SvSspXXR9gj
IBBPM5iQn9QwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMA0GCSqGSIb3
DQEBBQUAA4GBAKxpvZglrhYCYWasqWLKdYmb2Ir7Vtt4HQCGAa7Vv57QRY+PpuDj
iI62ld9KBz31P7jxVoKwwU+6BfbVEpQdLQkWmHgHkk/4EhhQSdk/CtnIdwI3HeYH
NScmKfiFZFRnesnzCXCpcJE28riv2QqtO4acPPZF75YYHvW5iYhmLx93
-----END CERTIFICATE-----
---
Server certificate
subject=/C=US/O=punkts.org/OU=GT96579082/OU=See www.rapidssl.com/resources/cps (c)09/OU=Domain Control Validated - RapidSSL(R)/CN=punkts.org
issuer=/C=US/O=Equifax/OU=Equifax Secure Certificate Authority
---
No client certificate CA names sent
---
SSL handshake has read 1039 bytes and written 341 bytes
---
New, TLSv1/SSLv3, Cipher is AES256-SHA
Server public key is 1024 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
SSL-Session:
Protocol : TLSv1
Cipher : AES256-SHA
Session-ID: 6C9C5C8D9C8339C4AE44E59F9B10AE977858F9D02B87C6C9E9F9F425B33C1CFB
Session-ID-ctx:
Master-Key: ADEF2203EC51D84E6F023AF7C958C17F4D0953109618BB9D2970F9CC26452AE5A581324A63106DE481D811DBF7EA497A
Key-Arg : None
Krb5 Principal: None
Start Time: 1276197181
Timeout : 300 (sec)
Verify return code: 0 (ok)
---
220 (vsFTPd 2.2.2)
QUIT
DONE
$
