Very Secure FTP daemon, or simply vsFTPd is a lightweight piece of software with great ability to customize. In this tutorial we are going to secure an already existing installation on a Debian system using our own self-signed SSL/TLS certificate. Despite it's written for Debian it should work on most Linux distributions such as Ubuntu and CentOS for instance.
On a fresh Linux VPS you need to install vsFTPd first. Although you will find the basic steps to install vsFTPd in this tutorial I recommend you to read these two more detailed tutorials as well: Setup vsFTPd on Debian/Ubuntu and Installing vsFTPd on CentOS. All steps regarding the installation are more carefully explained there.
Installation on Debian/Ubuntu:
apt-get install vsftpd
Installation on CentOS:
yum install epel-release yum install vsftpd
Open the configuration file: /etc/vsftpd.conf in your favorite text editor, in this tutorial we use
Paste the following lines into the configuration:
anonymous_enable=NO local_enable=YES write_enable=YES chroot_local_user=YES
Finish up by restarting your vsFTPd daemon:
You should now be able to login as any local user over FTP, now let's move on and secure this software.
A self signed certificate is typically used in a public key agreement protocol, you will now use
openssl to generate a public key and a corresponding private key. First of all we need to make a directory to store these two key files, preferably in a safe location normal users can not access.
mkdir -p /etc/vsftpd/ssl
Now to the actual generation of the certificate, we are going to store both the keys in the same file (/etc/vsftpd/ssl/vsftpd.pem):
openssl req -x509 -nodes -days 365 -newkey rsa:4096 -keyout /etc/vsftpd/ssl/vsftpd.pem -out /etc/vsftpd/ssl/vsftpd.pem
After executing the command you will be asked a few questions such as country code, state, city, organization name etc. use your own or your organizations information. Now the most important line is the Common name which must match the IP address of your VPS, alternatively a domain name pointing at it.
This certificate will be valid for 365 days (~1 year), it will use the RSA key agreement protocol with a key length of 4096 bits, and the file containing both the keys will be stored in the new directory we just created. For more details about key length and it's relation to security see this: Encryption II recomendations.
To start using our new certificate and thus provide encryption, we need to open up the configuration file again:
We need to add the paths to our new certificate and key files. Since they are stored in the same file it should be the same inside the configuration as well.
We must add this line to make sure SSL will be enabled:
Optionally we may block anonymous users from using SSL, since encryption isn't needed on a public FTP server.
Next we need to specify when to use SSL/TLS, this will enable encryption both for data transfer and login credentials
We may also specify what versions and protocols to be used. TLS is generally more secure than SSL and thus we may allow TLS and at the same time block older versions of SSL.
ssl_tlsv1=YES ssl_sslv2=NO ssl_sslv3=NO
Require SSL reuse and the usage of high ciphers will also help improve the security. From vsFTPd's man pages:
If set to yes, all SSL data connections are required to exhibit SSL session reuse (which proves that they know the same master secret as the control
channel). Although this is a secure default, it may break many FTP clients, so you may want to disable it. For a discussion of the consequences, see
http://scarybeastsecurity.blogspot.com/2009/02/vsftpd-210-released.html (Added in v2.1.0).
This option can be used to select which SSL ciphers vsftpd will allow for encrypted SSL connections. See the ciphers man page for further details. Note
that restricting ciphers can be a useful security precaution as it prevents malicious remote parties forcing a cipher which they have found problems with.
Finish up by restart the
And that's it, you should now be able to connect to your server and confirm that everything works. If you are using FileZilla a dialog containing your organization information (or whatever you entered when generating the certificate earlier) should open upon connection. The output should then look similar to this:
Status: Connection established, waiting for welcome message... Status: Initializing TLS... Status: Verifying certificate... Status: TLS connection established.
To learn more about vsFTPd, check out it's manual pages: