The Redneck Geek Blog

Enable TLS/SSL encryption (FTPS) on Ubuntu

Here goes: Short, sweet, and to the point.

1. Login as root (otherwise you have to use “sudo” with all commands)
2. Paste these commands in a terminal :
   • apt-get install build-essential
   • apt-get install libssl-dev
   • mkdir /etc/ftpcert
   • cd /etc/ftpcert
   • openssl genrsa -des3 -out server.key 1024
   • openssl req -new -key server.key -out server.csr
   • openssl genrsa -des3 -out ca.key 1024
   • openssl req -new -x509 -days 365 -key ca.key -out ca.crt
   • wget http://frodubuntu.free.fr/ubuntu/sign.sh
   • chmod +x sign.sh
   • ./sign.sh server.csr
3. Then add this section to yout proftpd.conf file :<IfModule mod_tls.c>
   TLSEngine on
   TLSLog /var/ftpd/tls.log
   TLSProtocol TLSv1# Are clients required to use FTP over TLS when talking to this server?
   TLSRequired off

   # Server’s certificate
   TLSRSACertificateFile /etc/ftpcert/server.crt
   TLSRSACertificateKeyFile /etc/ftpcert/server.key

   # CA the server trusts
   TLSCACertificateFile /etc/ftpcert/ca.crt

   # Authenticate clients that want to use FTP over TLS?
   TLSVerifyClient off
   </IfModule>

Note – Use TLSRequired ON to force the use of TLS. OFF means that the use of TLS is optional.

Optional step:

• You will notice that you will be asked for the password you set for the server.key file each time you start/stop/restart the server, it is because the RSA private key is encrypted in the server.key file.
• The solution is to remove the encryption of the RSA private key but it makes the key readable in the server.key file which is obviously less secure, anyway if you do that make sure that the server.key is readable only by root.
• Once you know that it’s less secure here are the command lines to remove the encryption of the RSA private key :
  • cd /etc/ftpcert
  • cp server.key server.key.org
  • openssl rsa -in server.key.org -out server.key

Here are some links to read in case of problems or just to get more informations :

http://www.modssl.org/docs/2.7/ssl_faq.html#cert-ownca

http://www.castaglia.org/proftpd/doc/contrib/ProFTPD-mini-HOWTO-TLS.html

On the server:
(Note: this howto assumes you are logged in as “root”, and that you have a working knowledge of modifying linux from the terminal window or console)

Make sure you have the NFS Server software installed:

apt-get install nfs-kernel-server nfs-common portmap

Edit /etc/exports to add shares:

Open the file: nano /etc/exports

Add a line for each directory you wish to share:

Example #1: /files 192.168.1.1/24(rw,no_root_squash,async)

This will allow full access to the “/files” directory from any computer on the 192.168.1.0 subnet

Example #2: /files 192.168.1.2 (ro,async)

This will allow read only access to the “/files” directory from the computer at 192.168.1.2 only.

Restart NFS Server process and export new shares:

/etc/init.d/nfs-kernel-server restart

exportfs -a

On the Client:

Make sure that the NFS Client software is installed:

apt-get install portmap nfs-common

Mount a NFS Share manually:

Make sure that the target directory exists on client:

mkdir /files

Mount the share:

mount server.mydomain.com:/files /files

(Note you may need to restart above services:
/etc/init.d/portmap restart
/etc/init.d/nfs-common restart)

Mount the share permanently:

Open /etc/fstab:

nano /etc/fstab

Add a line describing the share you wish to mount:

Example: server.mydomain.com:/files /files nfs rsize=8192,wsize=8192,timeo=14,intr

(Note: It is a good idea to test this before a reboot in case a mistake was made.
type:
mount /files
in a terminal, and the mount point /files will be mounted from the server. )

Note: This information was derived from the following sources:
http://www.cyberciti.biz/tips/ubuntu…nfs-share.html (for client configuration)
http://www.redhat.com/docs/manuals/l…nfs-mount.html (for mounting using fstab)
http://czarism.com/easy-peasy-ubuntu…s-file-sharing (for server configuration)
http://www.freebsd.org/doc/en_US.ISO…twork-nfs.html (contains more info about NFS)

from the console applet type “apt-get install isomaster”

This will also allow you to modify existing ISO images.