Having access to your file through FTP is very convenient and reliable.<\/p>\n
FTP has some awesome applications for backup and permits resume download or upload of big files that were interrupted.<\/p>\n
The problem is, FTP is a plain text protocol and it is very recommended to implement another layer for security.<\/p>\n
One is allowing your firewall to receive FTP connections only from your local network or VPN.<\/p>\n
sudo ufw allow from 10.0.0.0\/24 to any port 21<\/pre>\nIn this case, I am permitting access to the whole network 10.0.0.0 (from 10.0.0.1 to 10.0.0.254) for the port 21 (default FTP port).<\/p>\n
Another solution is to use the same SSL\/TLS key that you may have created for your HTTP server [Read It<\/a>].<\/p>\n
I also realized ProFTPd does not work well with Fail2Ban [Read It<\/a>], so I prefer to use the native FTP server of Ubuntu, VSFTPD [Read It<\/a>].<\/p>\n
Assuming your FTP server is the ProFTPd and it is already up and running, let’s add the encryption.<\/p>\n
sudo nano \/etc\/proftpd\/tls.conf<\/pre>\nLook for the lines and add the path to the SSL\/TLS key:<\/p>\n
TLSEngine\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 on<\/strong>\r\nTLSProtocol\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 TLSv1.2<\/strong>\r\n\r\nTLSRSACertificateFile \/etc\/apache2\/md\/domains\/domain.com<\/strong>\/pubcert.pem\r\nTLSRSACertificateKeyFile \/etc\/apache2\/md\/domains\/domain.com<\/strong>\/privkey.pem<\/pre>\nNote:<\/strong> for this tutorial we assumed the server already has the certificate issued by Let’s Encrypt using the module MD of Apache. If it was generated in another way, search for these files in your system or purchase them. If this is your case, they might located as described above and probably only the domain name needs to be changed.<\/p>\n
Confirm that your keys are there, then change the domain name.<\/p>\n
TLSOptions NoCertRequest EnableDiags NoSessionReuseRequired<\/strong><\/pre>\nUncomment the line that ends with “NoSessionReuseRequired”. It is not required but for some reason, my FTP client (FileZilla) was not able to connect because they do not reuse the session.<\/p>\n
And uncomment this line to only accept encrypted connections:<\/p>\n
TLSRequired\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 on<\/strong><\/pre>\nEdit the configuration file:<\/p>\n
sudo nano \/etc\/proftpd\/proftpd.conf<\/pre>\nUncomment the following line:<\/p>\n
Include\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \/etc\/proftpd\/tls.conf<\/strong><\/pre>\nVerify the range of ports you need to allow in your firewall:<\/p>\n
PassivePorts\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 40000\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 50000<\/strong><\/pre>\nIn my case, I reduced to only 500 ports. Originally was much more.<\/p>\n
Create the rules in your firewall:<\/p>\n
sudo ufw allow 21<\/strong>\r\nsudo ufw allow 40000:50000<\/strong>\/tcp<\/pre>\nRestart the server and test a remote connection:<\/p>\n
sudo systemctl restart proftpd<\/pre>\nIn case of connection fail you can look at the log file to troubleshoot:<\/p>\n
sudo tail -n 20 \/var\/log\/proftpd\/tls.log<\/pre>\n","protected":false},"excerpt":{"rendered":"Having access to your file through FTP is very convenient and reliable. FTP has some […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[],"class_list":["post-377","post","type-post","status-publish","format-standard","hentry","category-linux"],"_links":{"self":[{"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/posts\/377","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/dft.wiki\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=377"}],"version-history":[{"count":10,"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/posts\/377\/revisions"}],"predecessor-version":[{"id":5499,"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/posts\/377\/revisions\/5499"}],"wp:attachment":[{"href":"https:\/\/dft.wiki\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=377"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/dft.wiki\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=377"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/dft.wiki\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=377"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}