1

I am trying to secure my proftpd server but I cannot see what I do wrong.

My tls.conf

<IfModule mod_tls.c>
    TLSEngine                               on
TLSLog                                  /var/log/proftpd/tls.log
TLSProtocol                             TLSv1
TLSCipherSuite AES128+EECDH:AES128+EDH
TLSOptions                 NoCertRequest AllowClientRenegotiations

TLSRSACertificateFile                   /etc/ssl/certs/mailserver.pem
TLSRSACertificateKeyFile                /etc/ssl/private/mailserver.pem
TLSCACertificateFile                     /etc/apache2/ssl.crt/1_root_bundle.crt
TLSVerifyClient                         off
TLSRequired                             on
RequireValidShell                       no
TLSRenegotiate                          none
</IfModule>

I use the same certificate files for the https connection and that works all fine. When I do this:

openssl s_client -connect 127.0.0.1:21 -starttls ftp

I get a well working ssl connection. But when I do the same with my external ip address, I get this message:

CONNECTED(00000003) 140567084144296:error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol:s23_clnt.c:774:

no peer certificate available

No client certificate CA names sent

SSL handshake has read 91 bytes and written 300 bytes

New, (NONE), Cipher is (NONE) Secure Renegotiation IS NOT supported Compression: NONE Expansion: NONE

In the TLS log is no message when I do the external connection and in the proftpd.log is only this message:

Mar 02 13:22:38 domain.tld proftpd[31274] domain.tld (domain.tld[ip.addr.es.s]): FTP session opened.

Mar 02 13:22:38 domain.tld proftpd[31274] domain.tld (domain.tld[ip.addr.es.s]): FTP session closed.

I checked the firewall but that should not be the problem

Does someone know what I can do to get this working?

EDIT

My proftpd.conf

Include /etc/proftpd/modules.conf
UseIPv6                         on
IdentLookups off
ServerName                      "Debian"
ServerType                      standalone
DeferWelcome off
MultilineRFC2228                on
DefaultServer on
ShowSymlinks on
TimeoutNoTransfer               600
TimeoutStalled                  600
TimeoutIdle                     1200
DisplayLogin                    welcome.msg
DisplayChdir .message true
ListOptions "-l"
DenyFilter                      \*.*/
Port 0
<IfModule mod_dynmasq.c>
</IfModule>
MaxInstances                    30
User                            proftpd
Group                           nogroup
Umask 022 022
AllowOverwrite                  on
TransferLog /var/log/proftpd/xferlog
SystemLog   /var/log/proftpd/proftpd.log
<IfModule mod_quotatab.c>
QuotaEngine off
</IfModule>
<IfModule mod_ratio.c>
Ratios off
</IfModule>
<IfModule mod_delay.c>
DelayEngine on
</IfModule>
<IfModule mod_ctrls.c>
ControlsEngine        off
ControlsMaxClients    2
ControlsLog           /var/log/proftpd/controls.log
ControlsInterval      5
ControlsSocket        /var/run/proftpd/proftpd.sock
</IfModule>
<IfModule mod_ctrls_admin.c>
AdminControlsEngine off
</IfModule>
Include /etc/proftpd/tls.conf
Include /etc/proftpd/conf.d/
<Global>
DefaultRoot ~
RootLogin off
</Global>
DefaultRoot ~
ServerIdent on "FTP Server ready."
DefaultAddress domain.tld

My virtualhosts, they were automatically written in tls.conf by virtualmin

<VirtualHost ftp.domain1.tld>
Group domain1
User domain1
DefaultRoot ~
</VirtualHost>
<VirtualHost ftp.domain1.tld>
ServerName "domain1.tld"
<Anonymous /home/domain1/ftp>
User domain1
Group domain1
UserAlias anonymous ftp
<Limit WRITE>
DenyAll
</Limit>
ExtendedLog /home/domain1/logs/ftp.log
</Anonymous>
</VirtualHost>
<VirtualHost 1.2.3.4>
ServerName ftp.domain2.tld
<Anonymous /home/domain2/ftp>
User domain2
Group domain2
UserAlias anonymous ftp
<Limit WRITE>
DenyAll
</Limit>
RequireValidShell off
ExtendedLog /home/domain2/logs/ftp.log
<Directory />
AllowOverwrite on
</Directory>
</Anonymous>
</VirtualHost>

Ofcourse I replaced my domain and ip address with fake ones

  • Why not just use sftp? – EEAA Mar 2 '16 at 12:47
  • Is non-ssl connecting working from outside? – user1700494 Mar 2 '16 at 12:53
  • @EEAA I will yield it to a client, who will use it with others. I would rather focus on using ftp for they might be more used to it. – Hendrik Hamming Mar 2 '16 at 12:59
  • @user1700494 yes non-ssl connection is working fine – Hendrik Hamming Mar 2 '16 at 13:02
  • Are you using the same openssl versions in both cases? – user1700494 Mar 2 '16 at 13:08
1

It looks like your tls.conf configuration directives are applied only to the default "server config" vhost, and not to all vhosts in the server. Unlike Apache, ProFTPD configuration directives, outside of a <VirtualHost> section, are not applied globally. So you will need to explicitly make those mod_tls configurations global by using a <Global> section, i.e.:

<IfModule mod_tls.c>
  # Apply these configurations globally, to all vhosts
  <Global>
    TLSEngine on
    TLSLog /var/log/proftpd/tls.log
    TLSProtocol TLSv1
    TLSCipherSuite AES128+EECDH:AES128+EDH
    TLSOptions NoCertRequest AllowClientRenegotiations

    TLSRSACertificateFile /etc/ssl/certs/mailserver.pem
    TLSRSACertificateKeyFile /etc/ssl/private/mailserver.pem
    TLSCACertificateFile /etc/apache2/ssl.crt/1_root_bundle.crt
    TLSVerifyClient off
    TLSRequired on

    # Note: This particular directive is not specific to mod_tls;
    # I'm not sure why it's here, versus elsewhere.
    RequireValidShell no

    TLSRenegotiate none
  </Global>
</IfModule>

This behavior is covered in more detail in ProFTPD's Vhost howto.

Hope this helps!

  • It surely helped, thank you! Right now I get other errors but that has nothing to do with this topic. So thank you very much! – Hendrik Hamming Mar 3 '16 at 22:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.