Secure ProFTPD Server Configruation in Linux
Making a Secure ProFTPD (FTP Server) in Centos 9 Linux
Generating SSL Certificates and the private key
NB: This tutorial assumes that you have already installed proftpd on your system. If you have not Click on this link on how to do so
Install mod_ssl which is the tool that we will use to create the private and public keys needed or the SSL certificates.
Firstly, make sure that proftpd is not running by killing any proftpd process. I have done this using the command “killall -9 proftpd”. Create a new directory that will be used to store the SSL certificate and private key. I have used the command “mkdir /usr/local/etc/ssl”.
Run the command “openssl req -new -x509 -days 360 -nodes -out /usr/local/etc/ssl/ftp.cert.pem -keyout /usr/local/etc/ssl/ftp.key.pem”.
- openssl:This is the command-line tool for using the OpenSSL library, which provides cryptographic functions such encryption and hashing needed for us to create a certificate and key.
- -req:This specifies that the OpenSSL tool should be used for certificate requests and related tasks.
- -new:This option indicates that a new certificate request is to be created.
- -x509:This option specifies that a self-signed certificate should be created rather than generating a certificate signing request (CSR). X509 is the standard structure for SSL certificates.
- -days 360:This sets the validity period of the certificate to 360 days. You can adjust this value based on your needs.
- -nodes:This option specifies that the private key should not be encrypted with a passphrase. This is practical for automated processes where manual input is not desirable.
- -out /usr/local/etc/ssl/ftp.cert.pem:This specifies the location and filename for the output file where the generated X.509 certificate will be stored.
- -keyout /usr/local/etc/ftp.key.pem:This specifies the location and filename for the private key file associated with the certificate.
In short, this command creates a self-signed X.509 certificate (ftp.cert.pem) and its corresponding private key (ftp.key.pem). The certificate is valid for 360 days, and the private key is not encrypted with a passphrase. The generated files are stored in the /usr/local/etc/ssl/ directory.
You will have to insert some information that will be used as part of the key and certificate. This includes a pass phrase, 2 letter country code, the state or province, city, organisation name, department name, hostname, email address and two extra attributes in the forms of a challenge password and an optional company name.
Make sure that the file “ftp.cert.pem” and “ftp.key.pem” are both in the directory. I have listed using the command “ls /usr/local/etc/ssl”.
If this is done successfully, we can proceed to recompile the proftpd daemon.