How To : FTPS Server Configuration

I used to astonish all the time when I see the FTP package name. vsftpd which abrivated to Very Secure File Transfer Demon(vsftpd). But when we see the security prospective of this package there is no much security included with this package. I mean when you login to server the credentials are transfered in plain text. So by defalut root user is not allowed to login to ftp server.

To eliminate transfering data in plain text and to encrypt the entire transmission we can take help from open ssl to generate a certificate and use SSL certificate when communicating with FTP server. This is nothing but a FTPS server.

Some file transfers you should know are.
1. TFTP(Trivial File Transfer Protocol which uses UDP for transmission) –high data rates/not secure
2. (This protocol uses SSH in backend, so you no need to run an FTP server) –secure
3. FTP(This is normal ftp transfer which uses TCP) –not secure
4. FTPS(FTP+SSL certificate to encrypt data transmission)
5. Over SSH(this is a kind of ftp tunnel on SSH protocol)

In this post we will see how you can configure SSL certificate for VSFTPD.

Step1 : Check the following packages on the server and if they are not install please install them.
#yum install openssl
#yum install vsftpd

Step2 : Generate rsa key in /etc/vsftpd folder as below.
#cd /etc/vsftpd
#/usr/bin/openssl req -x509 -nodes -days 365 -newkey rsa:1024 -keyout vsftpd.pem -out vsftpd.pem

The clipped output for your reference
[root@v-itig42 vsftpd]# /usr/bin/openssl req -x509 -nodes -days 365 -newkey rsa:1024 -keyout vsftpd.pem -out vsftpd.pem

Generating a 1024 bit RSA private key

....................................................++++++

..........................................++++++

writing new private key to 'vsftpd.pem'

-----

You are about to be asked to enter information that will be incorporated.
into your certificate request.

What you are about to enter is what is called a Distinguished Name or a DN.

There are quite a few fields but you can leave some blank.

For some fields there will be a default value,

If you enter '.', the field will be left blank.

-----

Country Name (2 letter code) [GB]:IN

State or Province Name (full name) [Berkshire]:Andhra Pradesh
Locality Name (eg, city) [Newbury]:Vijaywada
Organization Name (eg, company) [My Company Ltd]:Linuxnix Systems Limited
Organizational Unit Name (eg, section) []: IT admin Group
Common Name (eg, your name or your server's hostname) []:ftp2.linuxnix.co.in

Email Address []:surendra@linuxnix.co.in

Step3 : Once the Certificate is generated, certificate is kept in /etc/vsftpd folder. We have to provide this entry in vsftpd.conf along some ssl configurations.

Step4 : Edit vsftpd.conf and give enteris at the last of the file.
#vi /etc/vsftpd/vsftpd.conf
#For SSL on specify yes to below option.
ssl_enable=YES
# To allow anonysonomous users to use SSL
allow_anon_ssl=YES
# if you want local users to use both ssl as well unsecure way of transmission of data plz specify no to below option.
force_local_data_ssl=NO
#If you want to allow all the login credentials which are transmitted should be sent with encryption #pleas use below option to force them to use only ssl connection at the time of login.
force_local_logins_ssl=YES
# Permit TLS v1 protocol connections. TLS v1 connections are preferred
ssl_tlsv1=YES
# Permit SSL v2 protocol connections. TLS v1 connections are preferred
ssl_sslv2=NO
# permit SSL v3 protocol connections. TLS v1 connections are preferred
ssl_sslv3=NO
#Please pecifies the location of the RSA certificate to use for SSL encrypted connections
, which we #created some time back.
rsa_cert_file=/etc/vsftpd/vsftpd.pem
Now save and exit the vsftpd file

Step5 : Restart the vsftpd service.
# service vsftpd restart
Shutting down vsftpd: [ OK ]
Starting vsftpd for vsftpd: [ OK ]


Start accessing the ftp server with user name credentials with filezila or some other FTP clients which will support SSL/TSL. If you want to access ftps sites through browsers its not possible. We have to have addon called fireftp. Then only we can access ftps:// site. Here in this example I used filezila.

Like the post? Please Subscribe to free RSS feed to get updates

SAMBA Server Configuration

SAMBA(SMB server) is a file sharing server. Which is used to share files between Windows, Linux and Unix Systems. SMB(Server Message Block) is a proprietary protocol which is developed by Microsoft

Lets see how we can configure SAMBA in Linux.

Step1 : Create a directory where you want to keep data and share with other remote systems(either windows/Solaris/in fact any unix flavor etc).
#mkdir /share1

Step2 : Installing Samba server
#yum install samba

Step3 : Once we install Samba server, configure it using its main configuration file(/etc/samba/smb.conf)

Step3(a) : Open smb.conf file and specify the work group where this server belongs
#vi /etc/samba/smb.conf
search for workgroup word and specify your work group name
workgroup = windows-group.

Why we require this workgroup?
Ans : When windows user try to access any network resource they first try to access my network places and then search for workgroup then to server. So definitly we have to specify this workgroup entry in smb.conf file.

Step3(b) : So now we have to give a name to this samba server, search for "server string" with out quotes then provide the samba server name(here that name is linux-share)
server string = linux-share

Step3(c):Now specify the share details, which folder you want to share. To whom you want to share? Goto last line of the smb.conf file specify your shared folder details as follows.
[myshare]
comment = "This is my Linux data want to share with my windows users"
path = /share1
valid users = user1 user2
writable = no
privatable = no
browsable =yes.

After giving this seven entries just save and exit the file.

Let me explain each and every thing what we used here.
a.[myshare] --This is my share name, so when ever any user accessed my samba server through network this will be visible as folder shared.
b.comment -- This is just a comment, which will help to know what is this share for.
c.path -- This is used to specify which folder on my samba machine to share.
d.valid users --This will specifies which user is having access on this folder.
e.writable --This will specify whether users are able to write or not, In this example the can just read the folder and copy.
f.Privatable --This will indicate whether this folder is private or not.
g.browsable -- This is used to specify whether the folder content is browsable or not.

Step4 : Now create passwords for the users who are going to access this samba share remotely.
#smbpasswd -a user1
#smbpasswd -a user2
Please specify the passwords for this 2 users and this passwords will be stored in /etc/samba/smbpasswd

Step5 : check for the syntax for your smb.conf file if in case you did any mistake
#testparm

Step6 : Restart the samba service
#service smb restart

Step7 : Permanently on the smb service, So that after rebooting the system too our server will start running.
#chkconfig smb on

Please check my other post how to mount or see the SAMBA shares here

Please comment your thoughts regarding this post:-)

Like the post? Please Subscribe to free RSS feed to get updates