How To Configure PureFTPd To Accept TLS Sessions On Debian Squeeze

Discussion in 'HOWTO-Related Questions' started by GarGamel55, Jul 23, 2011.

  1. GarGamel55

    GarGamel55 New Member

  2. falko

    falko Super Moderator Howtoforge Staff Moderator HowtoForge Supporter ISPConfig Developer

    Yes, it should work for Squeeze as well. :)
     
  3. MaddinXx

    MaddinXx Member HowtoForge Supporter

    Hi Guys

    First, thank you very much for your site. It is awesome, as ISPConfig is too. I really appreciate all the work of you. Thanks!

    I am really new in root server business, but with your site I got my "Perfect ISPConfig Server" working. Now, I have some problems (lots according to this topic so I write here), some others.

    First: I followed the TSL steps already in the tutorial and tried it again with the link provided here. However FileZilla times-out. I have absolutly no idea why and how I can fix this.

    If you could give me a hint here?

    Since I am, as I said, very new to this business please tell me which logs you need since I have no idea :)

    Second: How do I enable IMAP over SSL? I got it running with normal IMAP but not with SSL. What do I have to do?

    Third: In general I would like to run ISPConfig/RoundCube/phpMyAdmin over SSL.

    My situation is the following: I set up my server according to the "Perfect Server" and followed also the "Extendind the perfect server" tutorial. OS is Debain 6 64-bit.

    I use those IP's as nameserver:

    31.214.136.34 + 31.214.136.35

    The "primary domain" is rackster.ch, where everything works on. I would also like to install SSL for the domain itself. https://www.rackster.ch.

    Is this possible? Since I always used rackster.ch during the tutorials I had to use * as IP in ISPConfig for Domain Setup as I wanted this domain to have it's own directory as a client has (ssl, web etc.)

    Now, I signed a SSL Cert with GlobalSign. Can I use this with all services? (TSL/IMAP SSL/WEBSITE)?

    Thank you very very much for your help as I really don't know how I should fix all this by my own.

    Kindly Regards,
    Michel
     
  4. falko

    falko Super Moderator Howtoforge Staff Moderator HowtoForge Supporter ISPConfig Developer

    What are the outputs of
    Code:
    netstat -tap
    and
    Code:
    iptables -L
    ? Is the server located in a data center, or do you run it at home (behind a router)?
     
  5. MaddinXx

    MaddinXx Member HowtoForge Supporter

    Hi Falko

    Thanks for helping :) The server is located in a data center.

    Here is the output of netstat -tap:
    Code:
    Aktive Internetverbindungen (Server und stehende Verbindungen)
    Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
    tcp        0      0 *:sunrpc                *:*                     LISTEN      1686/portmap
    tcp        0      0 *:50000                 *:*                     LISTEN      24067/perl
    tcp        0      0 *:ftp                   *:*                     LISTEN      3531/pure-ftpd (SER
    tcp        0      0 31.214.136.62:domain    *:*                     LISTEN      6262/named
    tcp        0      0 31.214.136.61:domain    *:*                     LISTEN      6262/named
    tcp        0      0 31.214.136.60:domain    *:*                     LISTEN      6262/named
    tcp        0      0 31.214.136.59:domain    *:*                     LISTEN      6262/named
    tcp        0      0 31.214.136.58:domain    *:*                     LISTEN      6262/named
    tcp        0      0 31.214.136.57:domain    *:*                     LISTEN      6262/named
    tcp        0      0 31.214.136.56:domain    *:*                     LISTEN      6262/named
    tcp        0      0 31.214.136.55:domain    *:*                     LISTEN      6262/named
    tcp        0      0 31.214.136.54:domain    *:*                     LISTEN      6262/named
    tcp        0      0 31.214.136.53:domain    *:*                     LISTEN      6262/named
    tcp        0      0 31.214.136.52:domain    *:*                     LISTEN      6262/named
    tcp        0      0 31.214.136.51:domain    *:*                     LISTEN      6262/named
    tcp        0      0 31.214.136.50:domain    *:*                     LISTEN      6262/named
    tcp        0      0 31.214.136.49:domain    *:*                     LISTEN      6262/named
    tcp        0      0 31.214.136.48:domain    *:*                     LISTEN      6262/named
    tcp        0      0 31.214.136.47:domain    *:*                     LISTEN      6262/named
    tcp        0      0 31.214.136.46:domain    *:*                     LISTEN      6262/named
    tcp        0      0 31.214.136.45:domain    *:*                     LISTEN      6262/named
    tcp        0      0 31.214.136.44:domain    *:*                     LISTEN      6262/named
    tcp        0      0 31.214.136.43:domain    *:*                     LISTEN      6262/named
    tcp        0      0 31.214.136.42:domain    *:*                     LISTEN      6262/named
    tcp        0      0 31.214.136.41:domain    *:*                     LISTEN      6262/named
    tcp        0      0 31.214.136.40:domain    *:*                     LISTEN      6262/named
    tcp        0      0 31.214.136.39:domain    *:*                     LISTEN      6262/named
    tcp        0      0 31.214.136.38:domain    *:*                     LISTEN      6262/named
    tcp        0      0 31.214.136.37:domain    *:*                     LISTEN      6262/named
    tcp        0      0 mail.rackster.ch:domain *:*                     LISTEN      6262/named
    tcp        0      0 31.214.136.35:domain    *:*                     LISTEN      6262/named
    tcp        0      0 rs1500001.ffm.mt:domain *:*                     LISTEN      6262/named
    tcp        0      0 localhost:domain        *:*                     LISTEN      6262/named
    tcp        0      0 localhost:953           *:*                     LISTEN      6262/named
    tcp        0      0 *:smtp                  *:*                     LISTEN      3115/master
    tcp        0      0 *:48002                 *:*                     LISTEN      1698/rpc.statd
    tcp        0      0 *:50022                 *:*                     LISTEN      25725/sshd
    tcp        0      0 localhost:10024         *:*                     LISTEN      1321/amavisd (ch1-a
    tcp        0      0 localhost:10025         *:*                     LISTEN      3115/master
    tcp        0      0 localhost:mysql         *:*                     LISTEN      2584/mysqld
    tcp       53      0 localhost:58190         localhost:10025         CLOSE_WAIT  1321/amavisd (ch1-a
    tcp        0      0 localhost:mysql         localhost:34845         VERBUNDEN   2584/mysqld
    tcp        0   1176 rs1500001.ffm.mte:50022 zux221-139-219.ad:58051 VERBUNDEN   2674/0
    tcp        0      0 localhost:34845         localhost:mysql         VERBUNDEN   1321/amavisd (ch1-a
    tcp6       0      0 [::]:pop3               [::]:*                  LISTEN      2016/couriertcpd
    tcp6       0      0 [::]:imap2              [::]:*                  LISTEN      2061/couriertcpd
    tcp6       0      0 [::]:http-alt           [::]:*                  LISTEN      1012/apache2
    tcp6       0      0 [::]:www                [::]:*                  LISTEN      1012/apache2
    tcp6       0      0 [::]:tproxy             [::]:*                  LISTEN      1012/apache2
    tcp6       0      0 [::]:ftp                [::]:*                  LISTEN      3531/pure-ftpd (SER
    tcp6       0      0 [::]:domain             [::]:*                  LISTEN      6262/named
    tcp6       0      0 ip6-localhost:953       [::]:*                  LISTEN      6262/named
    tcp6       0      0 [::]:https              [::]:*                  LISTEN      1012/apache2
    tcp6       0      0 [::]:imaps              [::]:*                  LISTEN      21793/couriertcpd
    tcp6       0      0 [::]:pop3s              [::]:*                  LISTEN      21815/couriertcpd
    tcp6       0      0 [::]:50022              [::]:*                  LISTEN      25725/sshd
    And this for iptables -L:
    Code:
    Chain INPUT (policy DROP)
    target     prot opt source               destination
    DROP       tcp  --  anywhere             loopback/8
    ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED
    ACCEPT     all  --  anywhere             anywhere
    DROP       all  --  base-address.mcast.net/4  anywhere
    PUB_IN     all  --  anywhere             anywhere
    PUB_IN     all  --  anywhere             anywhere
    PUB_IN     all  --  anywhere             anywhere
    PUB_IN     all  --  anywhere             anywhere
    DROP       all  --  anywhere             anywhere
    
    Chain FORWARD (policy DROP)
    target     prot opt source               destination
    ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED
    DROP       all  --  anywhere             anywhere
    
    Chain OUTPUT (policy ACCEPT)
    target     prot opt source               destination
    PUB_OUT    all  --  anywhere             anywhere
    PUB_OUT    all  --  anywhere             anywhere
    PUB_OUT    all  --  anywhere             anywhere
    PUB_OUT    all  --  anywhere             anywhere
    
    Chain INT_IN (0 references)
    target     prot opt source               destination
    ACCEPT     icmp --  anywhere             anywhere
    DROP       all  --  anywhere             anywhere
    
    Chain INT_OUT (0 references)
    target     prot opt source               destination
    ACCEPT     icmp --  anywhere             anywhere
    ACCEPT     all  --  anywhere             anywhere
    
    Chain PAROLE (14 references)
    target     prot opt source               destination
    ACCEPT     all  --  anywhere             anywhere
    
    Chain PUB_IN (4 references)
    target     prot opt source               destination
    ACCEPT     icmp --  anywhere             anywhere            icmp destination-unreachable
    ACCEPT     icmp --  anywhere             anywhere            icmp echo-reply
    ACCEPT     icmp --  anywhere             anywhere            icmp time-exceeded
    ACCEPT     icmp --  anywhere             anywhere            icmp echo-request
    PAROLE     tcp  --  anywhere             anywhere            tcp dpt:ftp-data
    PAROLE     tcp  --  anywhere             anywhere            tcp dpt:ftp
    PAROLE     tcp  --  anywhere             anywhere            tcp dpt:smtp
    PAROLE     tcp  --  anywhere             anywhere            tcp dpt:domain
    PAROLE     tcp  --  anywhere             anywhere            tcp dpt:www
    PAROLE     tcp  --  anywhere             anywhere            tcp dpt:pop3
    PAROLE     tcp  --  anywhere             anywhere            tcp dpt:imap2
    PAROLE     tcp  --  anywhere             anywhere            tcp dpt:https
    PAROLE     tcp  --  anywhere             anywhere            tcp dpt:mysql
    PAROLE     tcp  --  anywhere             anywhere            tcp dpt:http-alt
    PAROLE     tcp  --  anywhere             anywhere            tcp dpt:tproxy
    PAROLE     tcp  --  anywhere             anywhere            tcp dpt:webmin
    PAROLE     tcp  --  anywhere             anywhere            tcp dpt:50000
    PAROLE     tcp  --  anywhere             anywhere            tcp dpt:50022
    ACCEPT     udp  --  anywhere             anywhere            udp dpt:domain
    ACCEPT     udp  --  anywhere             anywhere            udp dpt:mysql
    DROP       icmp --  anywhere             anywhere
    DROP       all  --  anywhere             anywhere
    
    Chain PUB_OUT (4 references)
    target     prot opt source               destination
    ACCEPT     all  --  anywhere             anywhere
    
    Chain fail2ban-courierimap (0 references)
    target     prot opt source               destination
    RETURN     all  --  anywhere             anywhere
    
    Chain fail2ban-courierimaps (0 references)
    target     prot opt source               destination
    RETURN     all  --  anywhere             anywhere
    
    Chain fail2ban-courierpop3 (0 references)
    target     prot opt source               destination
    RETURN     all  --  anywhere             anywhere
    
    Chain fail2ban-courierpop3s (0 references)
    target     prot opt source               destination
    RETURN     all  --  anywhere             anywhere
    
    Chain fail2ban-pureftpd (0 references)
    target     prot opt source               destination
    RETURN     all  --  anywhere             anywhere
    
    Chain fail2ban-roundcube (0 references)
    target     prot opt source               destination
    RETURN     all  --  anywhere             anywhere
    
    Chain fail2ban-sasl (0 references)
    target     prot opt source               destination
    RETURN     all  --  anywhere             anywhere
    
    Chain fail2ban-ssh (0 references)
    target     prot opt source               destination
    RETURN     all  --  anywhere             anywhere
    
    Chain fail2ban-webmin-auth (0 references)
    target     prot opt source               destination
    RETURN     all  --  anywhere             anywhere
    Regards,
    Michel
     
  6. falko

    falko Super Moderator Howtoforge Staff Moderator HowtoForge Supporter ISPConfig Developer

    Ok, regarding IMAPS, you must allow port 993 in your firewall (995 if you want to use POP3S also).

    Regarding FTP, did you try active and passive mode in your FTP client? Firewall settings and netstat output seem to be ok.
     
  7. MaddinXx

    MaddinXx Member HowtoForge Supporter

    Hi falko :)

    IMAP/POP is now working fine, thank you very much for the help.

    With FTP I tried both, active and passive - with different FTP clients etc. :S

    Transmit on Mac is saying:

    Server meldete: I won't open a connection to 192.168.1.13 (only to 81.221.139.219)

    Fehler -162: PORT failed

    Thanks,
    Michel
     
  8. falko

    falko Super Moderator Howtoforge Staff Moderator HowtoForge Supporter ISPConfig Developer

    Did you try from within and from outside your LAN?
     
  9. MaddinXx

    MaddinXx Member HowtoForge Supporter

    Hi Falko

    I tried from outside my LAN, still no success. The FTP Clients are stocking after:

    Entering Passive Mode

    Would it help if I would create you an FTP User so you can check?

    Kindly Regards,
    Michel
     
  10. Mark_NL

    Mark_NL New Member

    Try adding this in your tls config:
    Code:
    TLSOptions                              NoCertRequest NoSessionReuseRequired
    Transmit doesn't keep itself to the "correct" rules about tls usage, it doesn't reuse it's tls session, but requests a new one. proftpd doesn't allow that by default.
    adding "TLSOptions NoCertRequest NoSessionReuseRequired" and you will be able to connect with transmit.
     
  11. MaddinXx

    MaddinXx Member HowtoForge Supporter

    Hey Mark

    I am using pure ftp and not pro ftp, so I don't think this will work?

    Here what FileZilla is showing me:

    Code:
    220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------
    Antwort:	220-You are user number 2 of 50 allowed.
    Antwort:	220-Local time is now 03:06. Server port: 21.
    Antwort:	220-This is a private system - No anonymous login
    Antwort:	220-IPv6 connections are also welcome on this server.
    Antwort:	220 You will be disconnected after 15 minutes of inactivity.
    Befehl:	AUTH TLS
    Antwort:	234 AUTH TLS OK.
    Status:	Initialisiere TLS...
    Status:	Überprüfe Zertifikat...
    Befehl:	USER mkaeser0001
    Status:	TLS/SSL-Verbindung hergestellt.
    Antwort:	331 User mkaeser0001 OK. Password required
    Befehl:	PASS ********************
    Antwort:	230-User mkaeser0001 has group access to:  client2    sshusers  
    Antwort:	230 OK. Current restricted directory is /
    Befehl:	SYST
    Antwort:	215 UNIX Type: L8
    Befehl:	FEAT
    Antwort:	211-Extensions supported:
    Antwort:	 EPRT
    Antwort:	 IDLE
    Antwort:	 MDTM
    Antwort:	 SIZE
    Antwort:	 REST STREAM
    Antwort:	 MLST type*;size*;sizd*;modify*;UNIX.mode*;UNIX.uid*;UNIX.gid*;unique*;
    Antwort:	 MLSD
    Antwort:	 AUTH TLS
    Antwort:	 PBSZ
    Antwort:	 PROT
    Antwort:	 UTF8
    Antwort:	 ESTA
    Antwort:	 PASV
    Antwort:	 EPSV
    Antwort:	 SPSV
    Antwort:	 ESTP
    Antwort:	211 End.
    Befehl:	OPTS UTF8 ON
    Antwort:	200 OK, UTF-8 enabled
    Befehl:	PBSZ 0
    Antwort:	200 PBSZ=0
    Befehl:	PROT P
    Antwort:	200 Data protection level set to "private"
    Status:	Verbunden
    Status:	Empfange Verzeichnisinhalt...
    Befehl:	PWD
    Antwort:	257 "/" is your current location
    Befehl:	TYPE I
    Antwort:	200 TYPE is now 8-bit binary
    Befehl:	PASV
    Antwort:	227 Entering Passive Mode (31,214,136,39,208,121)
    Befehl:	MLSD
    Fehler:	Zeitüberschreitung der Verbindung
    Fehler:	Verzeichnisinhalt konnte nicht empfangen werden
    I think my whole server is holy crap -.- ;D was also trying to install varnish as a reverse proxy but that didn't work (yeah we let this beside for now.)
     
  12. falko

    falko Super Moderator Howtoforge Staff Moderator HowtoForge Supporter ISPConfig Developer

    Can you disable the firewall for testing purposes and test again (active/passive and from inside/outside your network)?
     

Share This Page