Gabriele.vivinetto: Created page with "* Si hanno a disposizione, ad esempio i certificati generati da StartSSL: certificato server server.example.com.crt private key server.example.com.key ** Certificati ..."

2016-01-15T18:14:49Z

Created page with "* Si hanno a disposizione, ad esempio i certificati generati da StartSSL: ** certificato server server.example.com.crt ** private key server.example.com.key ** Certificati ..."

New page

* Si hanno a disposizione, ad esempio i certificati generati da StartSSL:

** certificato server
server.example.com.crt
** private key
server.example.com.key
** Certificati sub ca
startcom-sub.class1.server.ca.crt

* Installare il certificato server e la private key:
sudo cp server.example.com.crt /etc/ssl/certs

sudo cp server.example.com.key /etc/ssl/private/
sudo chmod 600 /etc/ssl/private/server.example.com.key

sudo cp startcom-sub.class1.server.ca.crt /usr/local/share/ca-certificates
sudo update-ca-certificates

* '''IMPORTANTE''': concatenare il certificato server con la subCA. Se non lo si fa, i client non riconosceranno come valido il certificato:
cat server.example.com.crt startcom-sub.class1.server.ca.crt | sudo tee /etc/ssl/certs/server.example.com-bundle.crt

* Configurare vsftpd:

sudoedit /etc/vsftpd.conf

<pre>
rsa_cert_file=/etc/ssl/certs/cloud01.rvmgroup.it-bundle.crt
rsa_private_key_file=/etc/ssl/private/cloud01.rvmgroup.it.key
ssl_enable=YES
allow_anon_ssl=YES
force_local_data_ssl=NO
force_local_logins_ssl=NO
ssl_tlsv1=YES
ssl_sslv2=NO
ssl_sslv3=NO
require_ssl_reuse=NO
ssl_ciphers=HIGH
#debug_ssl=YES
#log_ftp_protocol=YES
#vsftpd_log_file=/var/log/vsftpd.log
#dual_log_enable=YES
</pre>

* Riavviare:
sudo /etc/init.d/vsftpd restart

* Provare a connettersi con curl. '''Attenzione:''': se non riconosce il certificato, verificare che in locale sia installata la catenza StartSSL:
curl --ftp-ssl --capatch /etc/ssl/certs ftp://username:password@server.example.com

* Nel caso, decommentare le righe di loggin, riavviare vsftpd e fare il tail di
sudo tail -f /var/log/vsftpd.log

sudo tail -f /var/log/xferlog

* '''ATTENZIONE''': se non si connette, attenzione al firewall: non usa solo la porta 21 !!!

=Riferimenti=
*[http://www.liberiangeek.net/2014/09/enable-secure-vsftpd-ubuntu-14-04-ssltls/ How To Enable Secure VSFTPD On Ubuntu 14.04 With SSL/TLS | Liberian Geek]
*[https://www.digitalocean.com/community/tutorials/how-to-configure-vsftpd-to-use-ssl-tls-on-an-ubuntu-vps How To Configure vsftpd to Use SSL/TLS on an Ubuntu VPS | DigitalOcean]
*[http://wiki.vpslink.com/Configuring_vsftpd_for_secure_connections_(TLS/SSL/SFTP) Configuring vsftpd for secure connections (TLS/SSL/SFTP) - VPSLink Wiki]
*[https://winscp.net/forum/viewtopic.php?t=12627 Cannot access vsFTPd service via WinSCP :: Support Forum :: WinSCP]
*[http://www.howsyournetwork.com/index.php/cID/49dc4e37/ID/46313c25b3e1cb6ccc4b7dc48b403215/fuseaction/base.detail.htm HowsYourNetwork.com]
*[http://www.linuxquestions.org/questions/linux-server-73/vsftpd-cannot-list-directory-in-ssl-4175429353/ vsftpd cannot list directory in SSL]
*[http://ubuntuforums.org/archive/index.php/t-1901964.html [ubuntu] Can't get SSL to work over vsftpd [Archive] - Ubuntu Forums]
*[http://www.unixlore.net/articles/using-curl-for-ftp-over-ssl-file.html Unixlore.net - Linux and Unix Commandline tips, hacks and howtos]
*[http://forum.debianizzati.org/viewtopic.php?f=19&t=50888 [RISOLTO] VSFTPD non si avvia con certificato SSL valido • Debianizzati.Org]
*[http://curl.haxx.se/docs/sslcerts.html cURL - SSL CA Certificates]
*[http://site4fast.blogspot.it/2011/10/vsftpd-ssl-how-to.html SSL how to: install ssl on vsftpd]
*[https://access.redhat.com/solutions/3436 How to configure vsftpd with SSL/TLS on Red Hat Enterprise Linux ? - Red Hat Customer Portal]
*[https://www.thatsgeeky.com/2011/01/configuring-vsftpd-to-use-tls/ Configuring vsFTPd to use TLS « That's Geeky]
*[http://serverfault.com/questions/661870/vsftpd-does-not-give-a-valid-certificate-using-ca-cert ssl - vsftpd does not give a valid certificate using CA cert. - Server Fault]

Configurazione di vsftpd con SSL - Revision history

Gabriele.vivinetto: Created page with "* Si hanno a disposizione, ad esempio i certificati generati da StartSSL: ** certificato server server.example.com.crt ** private key server.example.com.key ** Certificati ..."

Gabriele.vivinetto: Created page with "* Si hanno a disposizione, ad esempio i certificati generati da StartSSL: certificato server server.example.com.crt private key server.example.com.key ** Certificati ..."