Ubuntu FTP如何启用SSL加密

Here’s a concise guide to enabling SSL encryption for Ubuntu FTP (using vsftpd):

1. Install vsftpd and OpenSSL

First, update your package list and install the required software:

sudo apt update
sudo apt install vsftpd openssl

2. Generate an SSL Certificate

Create a self-signed certificate (replace /etc/ssl/private/vsftpd.pem with your preferred path if needed):

sudo openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
  -keyout /etc/ssl/private/vsftpd.pem \
  -out /etc/ssl/private/vsftpd.pem

Follow the prompts to enter details (country, organization, etc.). The certificate will be valid for 365 days.

3. Configure vsftpd for SSL

Edit the vsftpd configuration file:

sudo nano /etc/vsftpd.conf

Add or modify these lines to enable SSL and enforce secure connections:

ssl_enable=YES
allow_anon_ssl=NO
force_local_data_ssl=YES
force_local_logins_ssl=YES
ssl_tlsv1=YES
ssl_sslv2=NO
ssl_sslv3=NO
rsa_cert_file=/etc/ssl/private/vsftpd.pem
rsa_private_key_file=/etc/ssl/private/vsftpd.pem

Key settings explained:

• ssl_enable=YES: Turns on SSL/TLS encryption.
• force_local_data_ssl=YES/force_local_logins_ssl=YES: Requires all data and login connections to use SSL.
• ssl_tlsv1=YES: Enables TLSv1 (secure protocol); disable SSLv2/3 for security.

4. Restart vsftpd

Apply changes by restarting the service:

sudo systemctl restart vsftpd

5. Configure the Firewall

Allow FTP (port 21) and FTPS (port 990) traffic. For UFW:

sudo ufw allow 21/tcp
sudo ufw allow 990/tcp
sudo ufw reload

6. Test the Connection

Use an FTP client like FileZilla:

• Enter your server’s IP, username, and password.
• Select FTPS as the protocol and Explicit FTP over TLS as the encryption method.
• Connect to verify the SSL connection (you may see a certificate warning for self-signed certs).

Optional: Use SFTP Instead (Recommended for Simplicity)

If you don’t need traditional FTP, SFTP (built into SSH) is easier to set up:

sudo apt install openssh-server
sudo nano /etc/ssh/sshd_config

Ensure these lines are present/uncommented:

Subsystem sftp /usr/lib/openssh/sftp-server
PasswordAuthentication YES  # Or use key-based auth for better security

Restart SSH and connect using an SFTP client (port 22 by default). SFTP encrypts all traffic by default.