How do you properly enable TLS for proftpd?

[heftigrat]

Um, see subject.

TLSEngine is "on" in "/etc/proftpd.conf"

[till]

Hvae you created the SSL Certs for proftpd? Did you get any errors when you restart proftpd or try to connect with TLS?

[heftigrat]

Originally Posted by till

Hvae you created the SSL Certs for proftpd? Did you get any errors when you restart proftpd or try to connect with TLS?

I thought the certs were already created. No errs on restarting proftpd, but when trying to FTP using TLS I get the following error:

AUTH TLS  
500 AUTH not understood  
SER user  
331 Password required for user.  
PASS **********  
230 User user logged in.

[heftigrat]

Well, I can finally connect. I had the wrong setting in my FTP client (changed from "AUTH TLS" to "SSH/FTPS".

However, the user is not in a '~' jail. How do I fix this?

EDIT: Ah, it's just like an ssh session. Whoops! So I still need TLS to work, which it doesn't currently.

[falko]

Originally Posted by heftigrat

However, the user is not in a '~' jail. How do I fix this?

Put

DefaultRoot ~

into /etc/proftpd.conf and restart ProFTPD.

[heftigrat]

Originally Posted by falko

Put

DefaultRoot ~

into /etc/proftpd.conf and restart ProFTPD.

Well, that would do it, but I figured out I was connecting over an SSH tunnel. "DefaultRoot ~" is in "/etc/proftpd_ispconfig.conf", which is included in "/etc/proftpd.conf". I still can't connect with TLS though.

[till]

Does you proftpd.conf contain these liens:

TLSEngine				on
TLSLog 					/var/log/tls.log
TLSProtocol				SSLv23
TLSOptions				NoCertRequest
TLSRSACertificateFile			/etc/ssl/certs/proftpd.cert.pem
TLSRSACertificateKeyFile		/etc/ssl/certs/proftpd.key.pem
TLSVerifyClient				off

The lines may vary a bit, depending on your linux distribution.

[heftigrat]

Nope, it certainly did not. I added those lines but I need to create the ".pem" files (I already did a "locate *.pem" and got nothing). Is there a method I should follow? Thanks!!!

[till]

Originally Posted by heftigrat

Nope, it certainly did not. I added those lines but I need to create the ".pem" files (I already did a "locate *.pem" and got nothing). Is there a method I should follow? Thanks!!!

please use this command to generate the SSL certificates.

openssl req -new -x509 -days 365 -nodes  -out /etc/ssl/certs/proftpd.cert.pem -keyout /etc/ssl/certs/proftpd.key.pem

[heftigrat]

Thanks. Did that, but I'm still getting this error:

AUTH TLS  
500 AUTH not understood  
SER user  
331 Password required for user.

I'm using CoreFTP with the attached as connection settings.

EDIT: I did also restart the proftp daemon.

/etc/init.d/proftpd restart