vsftpd ssl/tls 設定

Create certificate
openssl req -x509 -nodes -days 3650 -newkey rsa:1024 -keyout /etc/vsftpd/vsftpd.pem -out /etc/vsftpd/vsftpd.pem

/etc/vsftpd/vsftpd.conf 增加 ssl/tls 的部分如下：


ssl_enable=YES
allow_anon_ssl=NO
force_local_data_ssl=NO
force_local_logins_ssl=YES
ssl_tlsv1=YES
ssl_sslv2=NO
ssl_sslv3=NO
rsa_cert_file=/etc/vsftpd/vsftpd.pem
ssl_ciphers=HIGH

pasv_enable=YES
pasv_address=xx.xx.xx.xx   # your Internet public IP address
pasv_min_port=60000
pasv_max_port=60009
pasv_promiscuous=NO

port_enable=NO
port_promiscuous=NO

firewall 會去判讀 ftp passive mode 所欲使用的 port 並自動開放，但是因為經過加密了所以 firewall 就看不懂了。firewall 必須加開 port pasv_min_port to pasv_max_port 才行。(Juniper Firewall詳細設定)

如果沒有用 pasv_address=xx.xx.xx.xx 會變成內部可以連上，但是從 Internet 連不上。

參考
http://wiki.vpslink.com/Configuring_vsftpd_for_secure_connections_(TLS/SSL/SFTP)
http://wiselysong.blogspot.com/2008/07/vsftpd-ssl-in-debian.html
http://www.linuxquestions.org/questions/linux-software-2/vsftpd-ssl-passive-%3D-listing-problem-262063/
http://bubble.gritto.net/db/query.php?id=5&ty=HOWTO
http://william123617.wordpress.com/2010/11/12/vsftp-%E9%85%8D%E7%BD%AE-ftps/

2013/5/22 update:
Filezilla client and VSFTPD : GnuTLS error -12: A TLS fatal alert has been received
solution:
http://serverfault.com/questions/385286/filezilla-client-and-vsftpd-gnutls-error-12-a-tls-fatal-alert-has-been-recei
add: ssl_ciphers=HIGH in the vsftpd.conf file