dotlinux blog

Secure ProFTPD Connections Using TLS/SSL Protocol on RHEL/CentOS 7

In today's digital landscape, security is of utmost importance. When it comes to file transfer protocols like ProFTPD, ensuring secure connections is crucial to protect sensitive data. The TLS/SSL (Transport Layer Security/Secure Sockets Layer) protocol provides a means to encrypt data during transfer. This blog will guide you through the process of configuring ProFTPD to use TLS/SSL on RHEL/CentOS 7, step by step.

2026-06

Table of Content#

  1. Prerequisites
  2. Installing ProFTPD
  3. Generating SSL/TLS Certificates
  4. Configuring ProFTPD for TLS/SSL
  5. Testing the Secure Connection
  6. Troubleshooting Common Issues
  7. Conclusion
  8. References

1. Prerequisites#

  • A server running RHEL/CentOS 7.
  • Root or sudo access to the server.
  • Basic knowledge of Linux commands and text editors (e.g., vi or nano).

2. Installing ProFTPD#

First, update the system packages:

sudo yum update -y

Then, install the EPEL repository (required for ProFTPD packages on RHEL/CentOS 7):

sudo yum install epel-release -y

Next, install ProFTPD:

sudo yum install proftpd -y

After installation, install the TLS module:

sudo yum install proftpd-mod_tls -y

After installation, start the ProFTPD service and enable it to start on boot:

sudo systemctl start proftpd
sudo systemctl enable proftpd

3. Generating SSL/TLS Certificates#

Using OpenSSL (Self - Signed Certificate)#

  1. Create a directory to store the certificates (if not already present):
sudo mkdir /etc/proftpd/ssl
  1. Generate a private key:
sudo openssl genrsa -out /etc/proftpd/ssl/proftpd.key 2048
  1. Generate a self - signed certificate. You will be prompted to enter various details (e.g., country name, common name). For a self - signed certificate, the common name should match the domain or IP address of your server.
sudo openssl req -new -x509 -key /etc/proftpd/ssl/proftpd.key -out /etc/proftpd/ssl/proftpd.crt -days 365

Using Let's Encrypt (for a more trusted certificate)#

  1. Install the certbot utility (if not already installed):
sudo yum install certbot -y
  1. If your server has a domain name associated with it, you can use the following command to obtain a certificate. For example, if your domain is example.com:
sudo certbot certonly --standalone -d example.com

The certificates will be stored in /etc/letsencrypt/live/example.com/ (replace example.com with your actual domain). You can copy the fullchain.pem (certificate) and privkey.pem (private key) to the ProFTPD SSL directory:

sudo cp /etc/letsencrypt/live/example.com/fullchain.pem /etc/proftpd/ssl/proftpd.crt
sudo cp /etc/letsencrypt/live/example.com/privkey.pem /etc/proftpd/ssl/proftpd.key

4. Configuring ProFTPD for TLS/SSL#

  1. Open the ProFTPD configuration file. The main configuration file is usually /etc/proftpd/proftpd.conf.
sudo vi /etc/proftpd/proftpd.conf
  1. Add the following lines to enable TLS/SSL. If you are using a self - signed certificate:
TLSEngine on
TLSLog /var/log/proftpd/tls.log
TLSProtocol TLSv1.2
TLSRSACertificateFile /etc/proftpd/ssl/proftpd.crt
TLSRSACertificateKeyFile /etc/proftpd/ssl/proftpd.key
TLSVerifyClient off
TLSRequired on

If you are using a Let's Encrypt certificate (and assuming the paths are correct as in the previous step):

TLSEngine on
TLSLog /var/log/proftpd/tls.log
TLSProtocol TLSv1.2
TLSRSACertificateFile /etc/proftpd/ssl/proftpd.crt
TLSRSACertificateKeyFile /etc/proftpd/ssl/proftpd.key
TLSVerifyClient off
TLSRequired on
  1. Save and close the file. Then, restart the ProFTPD service:
sudo systemctl restart proftpd

5. Testing the Secure Connection#

  1. On a client machine, you can use an FTP client that supports TLS/SSL (e.g., FileZilla).
  2. In the client, enter the server address, username, and password. For the protocol, select "FTPES - FTP over explicit TLS/SSL".
  3. Try to connect. If everything is configured correctly, you should see a secure connection (usually indicated by a lock icon or a message about a secure connection).

6. Troubleshooting Common Issues#

Certificate Errors#

  • Error: "Certificate is not trusted":
    • If using a self - signed certificate, the client may need to be configured to trust the certificate. In some FTP clients, you can import the self - signed certificate.
    • If using Let's Encrypt, make sure the certificate has not expired. Check the expiration date using openssl x509 -in /etc/proftpd/ssl/proftpd.crt -noout -dates.
  • Error: "Certificate hostname mismatch":
    • Ensure that the common name in the certificate matches the server's domain or IP address. You may need to regenerate the certificate.

Connection Issues#

  • Error: "Connection refused":
    • Check the firewall settings. Make sure port 21 (FTP control port) and the passive ports (if using passive mode) are open. For example, if using firewalld:
sudo firewall-cmd --add-service=ftp --permanent
sudo firewall-cmd --reload
  • Error: "Login failed":
    • Double - check the username and password. Also, ensure that the user has the appropriate permissions to access the FTP server.

7. Conclusion#

By following the steps in this blog, you have learned how to secure ProFTPD connections using the TLS/SSL protocol on RHEL/CentOS 7. This helps protect your data during file transfer, making your FTP server more secure. Remember to regularly update your certificates (especially if using Let's Encrypt) and monitor the server for any security - related issues.

8. References#