By default, FTP transmits data — including passwords — in plain text, making it vulnerable to interception. In this guide, we'll walk you through configuring VSFTPD (Very Secure FTP Daemon) with SSL/TLS encryption to protect data in transit and harden your FTP server.
Before you proceed with the steps to configure VSFTPD with an SSL/ TLS encrypted connection, ensure that you have installed VSFTPD on your Linux machine.
For your reference, you can follow these articles –
Step 1: We will generate a self-signed certificate using OpenSSL. First, create a directory to store the public key and private key.
# sudo mkdir -p /etc/vsftpd/ssl
Step 2: Run the command given below to generate the certificate.
# sudo openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/vsftpd/ssl/vsftpd.pem -out /etc/vsftpd/ssl/vsftpd.pem
Once you execute this command, it will ask for the country name, state name, city name, organization, unit name, and the common name that must match your server's IP Address.
You can also use the domain name pointing to your server's IP Address. The certificate will utilize the RSA key agreement protocol with a 2048-bit key length; it will be valid for 365 days.
Step 3: Let us open the configuration file of VSFTPD for the certificate installation.
# sudo vim /etc/vsftpd.conf
Step 4: Add or update the following lines:
# SSL certificate and key
rsa_cert_file=/etc/vsftpd/ssl/vsftpd.pem
rsa_private_key_file=/etc/vsftpd/ssl/vsftpd.pem
# Enable SSL
ssl_enable=YES
# Disallow anonymous SSL connections
allow_anon_ssl=NO
# Force SSL for local users (both login and data)
force_local_logins_ssl=YES
force_local_data_ssl=YES
# Use TLS only, disable older SSL versions
ssl_tlsv1=YES
ssl_sslv2=NO
ssl_sslv3=NO
# Improve security with strict cipher usage
require_ssl_reuse=YES
ssl_ciphers=HIGH
Step 5: Finally, restart the VSFTPD.
# sudo systemctl restart vsftpd
Step 6: Connect using an FTP client like FileZilla or WinSCP. When SSL is properly configured, the status log should show:
Status: Connection established, waiting for welcome message... Status: Initializing TLS... Status: Verifying certificate... Status: TLS connection established.
Conclusion:
By enabling SSL/TLS in VSFTPD:
- All FTP data (including login credentials) is encrypted.
- MITM (Man-In-The-Middle) and sniffing attacks are mitigated.
- You improve overall FTP security with minimal configuration.
