Forum Debian Users Gang

#
# Proftpd sample configuration for FTPS connections.
#
# Note that FTPS impose some limitations in NAT traversing.
# See http://www.castaglia.org/proftpd/doc/contrib/ProFTPD-mini-HOWTO-TLS.html
# for more information.
#

<IfModule mod_tls.c>
TLSEngine                               on
TLSLog                                  /etc/proftpd/tls.log
TLSProtocol                             SSLv23
#
# Server SSL certificate. You can generate a self-signed certificate using 
# a command like:
#
# openssl req -x509 -newkey rsa:1024 \
#          -keyout /etc/ssl/private/proftpd.key -out /etc/ssl/certs/proftpd.crt \
#          -nodes -days 365
#
# The proftpd.key file must be readable by root only. The other file can be
# readable by anyone.
#
# chmod 0600 /etc/ssl/private/proftpd.key 
# chmod 0640 /etc/ssl/private/proftpd.key
# 
TLSRSACertificateFile                   /etc/proftpd/ssl/certyfikat.cert
TLSRSACertificateKeyFile                /etc/proftpd/ssl/klucz.key
#
# CA the server trusts
#TLSCACertificateFile              /etc/ssl/certs/CA.pem
# or avoid CA cert and be verbose
#TLSOptions                             NoCertRequest EnableDiags 
TLSOptions AllowPerUser
#
# Per default drop connection if client tries to start a renegotiate
# This is a fix for CVE-2009-3555 but could break some clients.
#
#TLSOptions                             AllowClientRenegotiations
#
# Authenticate clients that want to use FTP over TLS?
#
TLSVerifyClient                         yes
#
# Are clients required to use FTP over TLS when talking to this server?
#
TLSRequired                             on

<Anonymous /home/ftp>
User guest
Group ftpguests
AnonRequirePassword on
RequireValidShell off
HideGroup root ftpadmin
HideUser root
HideNoAccess on
MaxClients 10 "Server przeciazony ! Sproboj pozniej !"
MaxClientsPerHost 5 "Za duzo polaczen z jednego IP !"

DirFakeMode 0640
DirFakeGroup on

TLSRequired off

<Directory /home/ftp>
HideFiles (^\.)
</Directory>

<Limit WRITE MKD DELE RMD STOR>
DenyAll
</Limit>
<Limit LIST DIRS READ>
AllowAll
IgnoreHidden on
</Limit>

</Anonymous>

#
# Allow SSL/TLS renegotiations when the client requests them, but
# do not force the renegotations.  Some clients do not support
# SSL/TLS renegotiations; when mod_tls forces a renegotiation, these
# clients will close the data connection, or there will be a timeout
# on an idle data connection.
#
#TLSRenegotiate                          required off
</IfModule>

550 SSL/TLS required on the control channel

530 Login incorrect.
Login failed.
421 Service not available, remote server has closed connection