Setup Secure FTP File Transfer Using SSL/TLS in RHEL 8

[‘

n

In our last article, we have described in detail on how to install and configure an FTP server in RHEL 8 Linux. In this article, we will explain how to secure an FTP server using SSL/TLS to enable data encryption services for secure file transfer between systems.

n

We hope you already have an FTP server installed and running properly. If not, please use the following guide to install it on your system.

n

    n

  1. How to Install, Configure and Secure FTP Server in RHEL 8
  2. n

n

Step 1. Generating SSL/TLS Certificate and Private Key

n

1. Create the following directory to store the SSL/TLS certificate and key files.

n

# mkdir -p /etc/ssl/vsftpdrn

n

2. Next, generate a self-signed SSL/TLS certificate and private key using the following command.

n

# openssl req -x509 -nodes -keyout /etc/ssl/vsftpd/vsftpd.pem -out /etc/ssl/vsftpd/vsftpd.pem -days 365 -newkey rsa:2048rn

n

Following is the explanation of each flag used in the above command.

n

    n

  1. req – is a command for X.509 Certificate Signing Request (CSR) management.
  2. n

  3. x509 – means X.509 certificate data management.
  4. n

  5. days – defines a number of days certificate is valid for.
  6. n

  7. newkey – specifies certificate key processor.
  8. n

  9. rsa:2048 – RSA key processor, will generate a 2048 bit private key.
  10. n

  11. keyout – sets the key storage file.
  12. n

  13. out – sets the certificate storage file, note that both certificate and key are stored in the same file: /etc/ssl/vsftpd/vsftpd.pem.
  14. n

n

The above command will prompt you to answer the questions below, remember to use values that apply to your scenario.

n

Country Name (2 letter code) [XX]:INrnState or Province Name (full name) []:Lower ParelrnLocality Name (eg, city) [Default City]:MumbairnOrganization Name (eg, company) [Default Company Ltd]:TecMint.comrnOrganizational Unit Name (eg, section) []:Linux and Open SourcernCommon Name (eg, your name or your server's hostname) []:tecmintrnEmail Address []:[emailxa0protected]rn

n

Create SSL Certificate for FTP Server
Create SSL Certificate for FTP Server

n

Step 2. Configuring VSFTPD To Use SSL/TLS

n

3. Open the VSFTPD configuration file for editing using your favorite command line editor.

n

# vi /etc/vsftpd/vsftpd.confrn

n

Add the following configuration parameters to enable SSL, then select the version of SSL and TLS to use, at the end of the file.

n

ssl_enable=YESrnssl_tlsv1_2=YESrnssl_sslv2=NOrnssl_sslv3=NOrn

n

4. Next, add the rsa_cert_file and rsa_private_key_file options to specify the location of the SSL certificate and key file respectively.

n

rsa_cert_file=/etc/ssl/vsftpd/vsftpd.pemrnrsa_private_key_file=/etc/ssl/vsftpd/vsftpd.pemrn

n

5. Now add these parameters to disable anonymous connections from using SSL and force all non-anonymous connections over SSL.

n

allow_anon_ssl=NOttt# disable anonymous users from using SSLrnforce_local_data_ssl=YEStt# force all non-anonymous logins to use a secure SSL connection for data transferrnforce_local_logins_ssl=YEStt# force all non-anonymous logins  to send the password over SSLrn

n

6. Next, add these option to disable all reuse of SSL data connections and set the SSL ciphers HIGH to allow encrypted SSL connections.

n

require_ssl_reuse=NOrnssl_ciphers=HIGHrn

n

7. You also have to specify the port range (min and max port) of passive ports to be used by vsftpd for secure connections, using the pasv_min_port and pasv_max_port parameters respectively. In addition, you can optionally enable SSL debugging for troubleshooting purposes, using the debug_ssl option.

n

pasv_min_port=40000rnpasv_max_port=50000rndebug_ssl=YESrn

n

8. Finally, save the file and restart the vsftpd service for the above changes to take effect.

n

# systemctl restart vsftpdrn

n

9. One more critical task to perform before you can securely access the FTP server is to open the ports 990 and 40000-50000 in the system firewall. This will allow TLS connections to vsftpd service and open the port range of passive ports defined in the VSFTPD configuration file respectively, as follows.

n

# firewall-cmd --zone=public --permanent –add-port=990/tcprn# firewall-cmd --zone=public --permanent –add-port=40000-50000/tcprn# firewall-cmd --reloadrn

n

Step 3: Install FileZilla to Securely Connect to the FTP Server

n

10. To securely connect to the FTP server, you need an FTP client that supports SSL/TLS connections such as FileZilla – is an open source, widely-used, cross-platform FTP, SFTP, and FTPS client that supports SSL/TLS connections by default.

n

Install FileZilla in Linux using your default package manager as follows:

n

$ sudo apt-get install filezilla   tt#Debian/Ubunturn# yum install epel-release filezillatt#On CentOS/RHELrn# dnf install filezillattt        #Fedora 22+rn$ sudo zypper install filezillattt#openSUSErn

n

11. After the Filezilla package is installed, search for it in the system menu and open it. To quickly connect the remote FTP server, from the main interface, provide the Host IP address, Username, and user’s Password. Then click QuickConnect.

n

Connect to FTP Server Using Filezilla
Connect to FTP Server Using Filezilla

n

12. Then the application will ask you to allow secure connection using the unknown, self-signed certificate. Click OK to proceed.

n

Accept SSL Certificate to Connect FTP
Accept SSL Certificate to Connect FTP

n

If the configuration at the server is fine, the connection should be successful as shown in the following screenshot.

n

Connected FTP Server
Connected FTP Server

n

13. Finally, test the FTP secure connection status by trying to upload files from your machine to the server as shown in the next screenshot.

n

Securely Transfer Files via Filezilla
Securely Transfer Files via Filezilla

n

That’s all! In this article, we showed how to secure an FTP server using SSL/TLS for secure file transfer in RHEL 8. This is the second part of our comprehensive guide to install, configure and secure an FTP server in RHEL 8. To share any queries or thoughts, use the feedback form below.

n

‘]