Sweshi's Tutorials

Making a Secure ProFTPD (FTP Server) in Centos 9 Linux

Generating SSL Certificates and the private key

NB: This tutorial assumes that you have already installed proftpd on your system. If you have not Click on this link on how to do so

Install mod_ssl which is the tool that we will use to create the private and public keys needed or the SSL certificates.

sftp server part 1: installing modssl

Firstly, make sure that proftpd is not running by killing any proftpd process. I have done this using the command “killall -9 proftpd”. Create a new directory that will be used to store the SSL certificate and private key. I have used the command “mkdir /usr/local/etc/ssl”.

sftp server part 2: stop the proftpd service from running

Run the command “openssl req -new -x509 -days 360 -nodes -out /usr/local/etc/ssl/ftp.cert.pem -keyout /usr/local/etc/ssl/ftp.key.pem”.

sftp server part 3: generate the required certificate and key
  • openssl:This is the command-line tool for using the OpenSSL library, which provides cryptographic functions such encryption and hashing needed for us to create a certificate and key.
  • -req:This specifies that the OpenSSL tool should be used for certificate requests and related tasks.
  • -new:This option indicates that a new certificate request is to be created.
  • -x509:This option specifies that a self-signed certificate should be created rather than generating a certificate signing request (CSR). X509 is the standard structure for SSL certificates.
  • -days 360:This sets the validity period of the certificate to 360 days. You can adjust this value based on your needs.
  • -nodes:This option specifies that the private key should not be encrypted with a passphrase. This is practical for automated processes where manual input is not desirable.
  • -out /usr/local/etc/ssl/ftp.cert.pem:This specifies the location and filename for the output file where the generated X.509 certificate will be stored.
  • -keyout /usr/local/etc/ftp.key.pem:This specifies the location and filename for the private key file associated with the certificate.

In short, this command creates a self-signed X.509 certificate (ftp.cert.pem) and its corresponding private key (ftp.key.pem). The certificate is valid for 360 days, and the private key is not encrypted with a passphrase. The generated files are stored in the /usr/local/etc/ssl/ directory.

You will have to insert some information that will be used as part of the key and certificate. This includes a pass phrase, 2 letter country code, the state or province, city, organisation name, department name, hostname, email address and two extra attributes in the forms of a challenge password and an optional company name.

sftp server part 4:enter the required information

Make sure that the file “ftp.cert.pem” and “ftp.key.pem” are both in the directory. I have listed using the command “ls /usr/local/etc/ssl”.

sftp server part 5:List the /usr/local/etc/ssl to check for the certificate and key

If this is done successfully, we can proceed to recompile the proftpd daemon.