Only ftps with proftpd on debian

Question

Is there a way to block all normal ftp traffic, and only allow the sftp protocol in sftp?

edit: sorry my bad!

for secure ftp i must use the ftpes protocol...

I don't have edit rights, but please note that the poster re-stated the question as FTPES rather than SFTP in the answer stream below. — Dominic D, Jan 19 '10 at 18:53

score 4 · Answer 1 · answered Jan 19 '10 at 18:04

You don't need proftpd to do SFTP, you can do that natively with ssh.

If for some reason you want to use proftpd (i.e. you want to integrated with non-system accounts easier). You'll want to deny access to the login verb for the server, then create a specific virtual host with the sftp engine on and allow the login verb.

To accomplish that your proftpd.conf will look something like this.

  <Limit LOGIN>
    DenyAll
  </Limit>

  <VirtualHost 1.2.3.4>
    SFTPEngine on
    <Limit LOGIN>
      AllowAll
    </Limit>
    <all your other crap...>
  </VirtualHost>

Much better answer than mine. I did not know that you can do that. +1 from me. — Sunny, Jan 19 '10 at 18:08

score 3 · Accepted Answer · answered Jan 19 '10 at 18:32

If you want to do FTPES with proftpd you basically need to follow 4 steps.

1) Install proftpd and openssl

apt-get install proftpd openssl

2) Generate a cert (assuming you are going to self sign, make sure to match the common name to the ftp site dns name to make clients complain less)

mkdir /etc/proftpd/ssl
openssl req -new -x509 -days 365 -nodes -out /etc/proftpd/ssl/proftpd.cert.pem -keyout /etc/proftpd/ssl/proftpd.key.pem

3) Edit proftpd.conf replace the mod_tls module section of your config with the text below (note the TLSRequired on directive)

<IfModule mod_tls.c>
  TLSEngine                  on
  TLSLog                     /var/log/proftpd/tls.log
  TLSProtocol                SSLv23
  TLSOptions                 NoCertRequest
  TLSRSACertificateFile      /etc/proftpd/ssl/proftpd.cert.pem
  TLSRSACertificateKeyFile   /etc/proftpd/ssl/proftpd.key.pem
  TLSVerifyClient            off
  TLSRequired                on
</IfModule>

4) Restart proftpd

/etc/init.d/proftpd restart

score 2 · Answer 3 · edited Dec 24 '15 at 06:59

2

when you only want to allow ftps with proftpd, TLSRequired is the option your are looking for.

edited Dec 24 '15 at 06:59

user9517

115,471
20
215
297

answered Jan 19 '10 at 18:06

Christian

4,703
2
24
27

score 0 · Answer 4 · answered Jan 19 '10 at 17:59

0

What do you mean by sftp? SecureFTP (AKA SSL ftp), or ftp over ssh (AKA sftp)?

For sftp - just run sshd, and do not use any ftp daemon at all.

answered Jan 19 '10 at 17:59

Sunny

5,834
3
22
24

i think SecureFTP, because in need to make a openssl certificate. To connect i must use sftp://devhouse.nl – Timo Jan 19 '10 at 18:04
sftp:// is the accepted short hand for ftp over ssh – Dominic D Jan 19 '10 at 18:06

Only ftps with proftpd on debian

4 Answers4

Linked

Related