0

Is there a way to block all normal ftp traffic, and only allow the sftp protocol in sftp?

edit: sorry my bad!

for secure ftp i must use the ftpes protocol...

  • I don't have edit rights, but please note that the poster re-stated the question as FTPES rather than SFTP in the answer stream below. – Dominic D Jan 19 '10 at 18:53
2

If you want to do FTPES with proftpd you basically need to follow 4 steps.

1) Install proftpd and openssl

apt-get install proftpd openssl

2) Generate a cert (assuming you are going to self sign, make sure to match the common name to the ftp site dns name to make clients complain less)

mkdir /etc/proftpd/ssl
openssl req -new -x509 -days 365 -nodes -out /etc/proftpd/ssl/proftpd.cert.pem -keyout /etc/proftpd/ssl/proftpd.key.pem

3) Edit proftpd.conf replace the mod_tls module section of your config with the text below (note the TLSRequired on directive)

<IfModule mod_tls.c>
  TLSEngine                  on
  TLSLog                     /var/log/proftpd/tls.log
  TLSProtocol                SSLv23
  TLSOptions                 NoCertRequest
  TLSRSACertificateFile      /etc/proftpd/ssl/proftpd.cert.pem
  TLSRSACertificateKeyFile   /etc/proftpd/ssl/proftpd.key.pem
  TLSVerifyClient            off
  TLSRequired                on
</IfModule>

4) Restart proftpd

/etc/init.d/proftpd restart
3

You don't need proftpd to do SFTP, you can do that natively with ssh.

If for some reason you want to use proftpd (i.e. you want to integrated with non-system accounts easier). You'll want to deny access to the login verb for the server, then create a specific virtual host with the sftp engine on and allow the login verb.

To accomplish that your proftpd.conf will look something like this.

  <Limit LOGIN>
    DenyAll
  </Limit>

  <VirtualHost 1.2.3.4>
    SFTPEngine on
    <Limit LOGIN>
      AllowAll
    </Limit>
    <all your other crap...>
  </VirtualHost>
  • Much better answer than mine. I did not know that you can do that. +1 from me. – Sunny Jan 19 '10 at 18:08
1

when you only want to allow ftps with proftpd, TLSRequired is the option your are looking for.

0

What do you mean by sftp? SecureFTP (AKA SSL ftp), or ftp over ssh (AKA sftp)?

For sftp - just run sshd, and do not use any ftp daemon at all.

  • i think SecureFTP, because in need to make a openssl certificate. To connect i must use sftp://devhouse.nl – Timo Jan 19 '10 at 18:04
  • sftp:// is the accepted short hand for ftp over ssh – Dominic D Jan 19 '10 at 18:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.