I'm using the Ubuntu 10.4 build in ProFTPD and don't understand why I have to "verify" the password I enter as it's checked immediately. (This reminds me on entering Wifi passwords twice in Windows where it's also nonsense.)

Prompt message:

ftpadmin@ftp:~$ sudo /etc/init.d/proftpd restart
  * Stopping ftp server proftpd                                           [ OK ] 
  * Starting ftp server proftpd                                                  
Please provide passphrases for these encrypted certificate keys:
RSA key for the x.x.x.x#21 (ftp.foo.bar) server: 
Verifying - RSA key for the x.x.x.x#21 (ftp.foo.bar) server: 
                                                                          [ OK ]

TLS config:

<IfModule mod_tls.c>
 TLSEngine                   on
 TLSLog                      /var/log/proftpd/tls.log
 TLSProtocol                 SSLv23
 TLSRSACertificateFile       /etc/ssl/private/server.crt
 TLSRSACertificateKeyFile    /etc/ssl/private/server.key
 TLSOptions                  AllowClientRenegotiations NoCertRequest EnableDiags 
 TLSVerifyClient             off
  • SSL? Please give us the prompt message?
    – quanta
    Aug 16, 2011 at 7:42
  • @quanta - I updated my question. Aug 16, 2011 at 7:54
  • and the options related to TLS in your proftpd.conf?
    – quanta
    Aug 16, 2011 at 8:13
  • @quanta - again I updated the question - Thanks for your help! Aug 16, 2011 at 8:37
  • Are you sure you don't have a challenge password on both the crt and the key? I don't think it remembers the password and tries to apply it to the second file.
    – polynomial
    Aug 21, 2011 at 8:12

1 Answer 1

TLSRSACertificateKeyFile    /etc/ssl/private/server.key

You get this dialog because the RSA private key inside your server.key is stored in encrypted format. You need a passphrase to parse this file.

You can remove the encryption from the RSA private key with:

cd /etc/ssl/private/
mv server.key server.key.bak
openssl rsa -in server.key.bak -out server.key
chmod 400 server.key

Now server.key will contain an uncrypted copy of the key, point TLSRSACertificateKeyFile to this file, it will not prompt you for a passphrase.

But, NOTICE that, if anyone gets this key, they will be able to impersonate you.

  • I'm aware that it's encrypted. My question is why I have to enter it TWICE? Once should be enough, not? Aug 16, 2011 at 8:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.