HOWTO : Create a FTP server with user access (proftpd)

[Tavathlon]

I don't really think most users will have any need of remotelly starting/stopping/restarting their servers. But on the other hand, if the information is available, it is more of a free choice for every user - most probably don't even know you could do that, but when they hear it's possible, they might want to have it that way.

*Note - Use TLSRequired ON to force the use of TLS. OFF means that the use of TLS is optional.

Is there any downside of forcing the use of TLS?

[frodon]

Is there any downside of forcing the use of TLS?

You will only be able to login the server if you use a FTP client which support TLS/SSL, for example gFTP don't support it.
If you wish to get quickly a FTP client which support SSL/TLS install the "fireftp" extention of firefox, you just need firefox for that (the OS you use is not important).

[whatalotta]

Hi Frodon,

Thanks for the response. I will have a look at the link you posted and I will be able to figure out for myself how to set up the key without encryption.

BTW, I have everything setup and working using the configuration parameters that you provide in the howto except for encryption. Works great! Thanks for the Howto!

I tried using gproftpd and found it to be a little restrictive, so I went back to your howto.

I found that the 503 error can be fixed simply by typing:

passwd userftp

and typing in the password desired when prompted after the user is created. Not sure why the command string provided does not work. I think that with the command string provided, the password is not being taken when the user is created, so that when people try to authorize, they get the 503 error because the passwords do not match.

With respect to posting instructions for how to set up the certs and reboot without being asked for passwords, I think that this is completely up to you. My vote would obiously be yes, but clearly, my use of my system is different than a lot of other users. Is it worth it posting the instructions for one person? Probably not.

Thanks for the awesome howto!

-whata

[whatalotta]

Hi all,

Thanks to Frodon and the link provided, I have been able to remove the password requirement when using SSL certs. I know it can be done a little simpler by not requiring the password in the first place, but as Frodon pointed out, it is more secure than not requiring it. In other words, you are better off sticking to the howto as it is.

If you are looking for the easiest way to not end up with the password requirement, just go to the cert directory and follow most any howto on setting up SSL for an Apache web server. I haven't come across one that had made me type in a password when shutting down and starting up the server.

If you want to remove the password requirement after implementing it per the howto, here's how:

cd /etc/ftpcert
cp server.key server.key.org
openssl rsa -in server.key.org -out server.key

Enter the password, restart your server and enjoy.

-whata

[nix4me]

I would recommend that the instructions to remove the required password be added or change the way certificates are created. Having to enter a password is too intrusive for the average user.

nix4me

[frodon]

It's documented in the guide now, each user will have to make his own choice now

Thanks again whatalotta and nix4me for the feedback.

[Tavathlon]

You will only be able to login the server if you use a FTP client which support TLS/SSL, for example gFTP don't support it.
If you wish to get quickly a FTP client which support SSL/TLS install the "fireftp" extention of firefox, you just need firefox for that (the OS you use is not important).

Ah, I see... Thanks! =)

[whatalotta]

Frodon,

Actually, thank you. This is one of the better guides I've used. You are also very involved with the users of the howto and very responsive to their queries. Please keep up the great work!

-whata

[dmizer]

I found that the 503 error can be fixed simply by typing:

passwd userftp

and typing in the password desired when prompted after the user is created.

i was in agony over this 503 error because i administer 4 linux servers that have no gui interface. the above quoted fix worked to get past the 503 error via cli interface.

thank you so much. this was the only hangup i encountered in the howto.

[whatalotta]

Great! I'm glad it helped someone.

-whata