Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I'm aware of the following:

  • I can disable access to port 21 via the firewall
  • I can disable access to non-ssl connections to users in the admin interface of FileZilla
  • I can restrict access to the server by IP via the firewall

all of which I've done already.

However, is it possible to completely switch off port 21? I only want to enable FTP over SSL and not standard FTP on port 21 regardless of the above points.

share|improve this question

1 Answer 1

up vote 2 down vote accepted

Check the box for "Disallow plain unencrypted FTP", that will do exactly what you are looking for.

enter image description here

Now if a user connects on port 21 they are required to use "explicit FTP over TLS" and non encrypted connections will be rejected.

share|improve this answer
    
But I want to turn off port 21 - not force them to do anything else, but not actually be able to connect in the first place. –  Leonard Challis Jun 13 '13 at 22:42
    
So you want them to only allow implicit SSL/TLS connections? (only can connect on 990?) I am not understanding what you are trying to do. I have a feeling you are having a XY problem, can you explain why you are trying to "turn off" port 21? Not allowing ftp on port 21 and not allowing unencrypted SSL connections are two separate issues. You can still have port 21 open but have it not work for unencrpyted connections, which is kind of "turning it off", you need to explain more what you are trying to accomplish. –  Scott Chamberlain Jun 14 '13 at 4:10
    
Because we don't want any more ports open than is needed, less ports to scan and less entry points for attacks, less reliance on X software not having an exploit on port 21. We were using freeFTPd which simply allowed us to turn on 990 or 21 as we wished which is exactly what I want, but it's flakey and the service kept failing. –  Leonard Challis Jun 14 '13 at 6:06
    
Then I would reword your question to (or add to it) "How to I make FileZilla Server allow only implicit SSL/TLS connections?". However I think the answer to that is, "you can disable all non TLS connections but you can't have only implicit TLS connections, filezilla requires you to have a port open for explicit TLS connections (by default port 21) but you can change that port to a non standard port" –  Scott Chamberlain Jun 14 '13 at 6:10
    
My question is "How do I disable port 21" - wihch is exactly what I want. I want to disable port 21. But thanks for that answer I will mark it as correct as I think this is as close as we get. –  Leonard Challis Jun 14 '13 at 7:08

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.