Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Is there a way to block all normal ftp traffic, and only allow the sftp protocol in sftp?

edit: sorry my bad!

for secure ftp i must use the ftpes protocol...

share|improve this question
    
I don't have edit rights, but please note that the poster re-stated the question as FTPES rather than SFTP in the answer stream below. –  Dominic D Jan 19 '10 at 18:53
add comment

4 Answers

up vote 2 down vote accepted

If you want to do FTPES with proftpd you basically need to follow 4 steps.

1) Install proftpd and openssl

apt-get install proftpd openssl

2) Generate a cert (assuming you are going to self sign, make sure to match the common name to the ftp site dns name to make clients complain less)

mkdir /etc/proftpd/ssl
openssl req -new -x509 -days 365 -nodes -out /etc/proftpd/ssl/proftpd.cert.pem -keyout /etc/proftpd/ssl/proftpd.key.pem

3) Edit proftpd.conf replace the mod_tls module section of your config with the text below (note the TLSRequired on directive)

<IfModule mod_tls.c>
  TLSEngine                  on
  TLSLog                     /var/log/proftpd/tls.log
  TLSProtocol                SSLv23
  TLSOptions                 NoCertRequest
  TLSRSACertificateFile      /etc/proftpd/ssl/proftpd.cert.pem
  TLSRSACertificateKeyFile   /etc/proftpd/ssl/proftpd.key.pem
  TLSVerifyClient            off
  TLSRequired                on
</IfModule>

4) Restart proftpd

/etc/init.d/proftpd restart
share|improve this answer
add comment

You don't need proftpd to do SFTP, you can do that natively with ssh.

If for some reason you want to use proftpd (i.e. you want to integrated with non-system accounts easier). You'll want to deny access to the login verb for the server, then create a specific virtual host with the sftp engine on and allow the login verb.

To accomplish that your proftpd.conf will look something like this.

  <Limit LOGIN>
    DenyAll
  </Limit>

  <VirtualHost 1.2.3.4>
    SFTPEngine on
    <Limit LOGIN>
      AllowAll
    </Limit>
    <all your other crap...>
  </VirtualHost>
share|improve this answer
    
Much better answer than mine. I did not know that you can do that. +1 from me. –  Sunny Jan 19 '10 at 18:08
add comment

What do you mean by sftp? SecureFTP (AKA SSL ftp), or ftp over ssh (AKA sftp)?

For sftp - just run sshd, and do not use any ftp daemon at all.

share|improve this answer
    
i think SecureFTP, because in need to make a openssl certificate. To connect i must use sftp://devhouse.nl –  Timo Jan 19 '10 at 18:04
    
sftp:// is the accepted short hand for ftp over ssh –  Dominic D Jan 19 '10 at 18:06
add comment

when you only want to allow ftps with proftpd, this is the option your are looking for.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.