2

I'm aware of the following:

  • I can disable access to port 21 via the firewall
  • I can disable access to non-ssl connections to users in the admin interface of FileZilla
  • I can restrict access to the server by IP via the firewall

all of which I've done already.

However, is it possible to completely switch off port 21? I only want to enable FTP over SSL and not standard FTP on port 21 regardless of the above points.

Improve this question
0

2 Answers 2

Reset to default
1

I ran into the exact same requirement, and it turns out to be really easy. Under Settings > General settings of the Admin Interface, simply empty the "Listen on these ports:". Additionally go to "FTP over TLS settings" and uncheck "Allow explicit FTP over TLS" since that won't work without anyway.

After hitting Ok, it'll say the following in the log: "Creating listen socket on port 990..." or whatever port you set for implicit FTP. Whereas before this change, it would list both :)

Improve this answer
3

Check the box for "Disallow plain unencrypted FTP", that will do exactly what you are looking for.

enter image description here

Now if a user connects on port 21 they are required to use "explicit FTP over TLS" and non encrypted connections will be rejected.

Improve this answer
5
  • But I want to turn off port 21 - not force them to do anything else, but not actually be able to connect in the first place.
    – Leonard Challis
    Jun 13, 2013 at 22:42
  • So you want them to only allow implicit SSL/TLS connections? (only can connect on 990?) I am not understanding what you are trying to do. I have a feeling you are having a XY problem, can you explain why you are trying to "turn off" port 21? Not allowing ftp on port 21 and not allowing unencrypted SSL connections are two separate issues. You can still have port 21 open but have it not work for unencrpyted connections, which is kind of "turning it off", you need to explain more what you are trying to accomplish.
    – Scott Chamberlain
    Jun 14, 2013 at 4:10
  • Because we don't want any more ports open than is needed, less ports to scan and less entry points for attacks, less reliance on X software not having an exploit on port 21. We were using freeFTPd which simply allowed us to turn on 990 or 21 as we wished which is exactly what I want, but it's flakey and the service kept failing.
    – Leonard Challis
    Jun 14, 2013 at 6:06
  • Then I would reword your question to (or add to it) "How to I make FileZilla Server allow only implicit SSL/TLS connections?". However I think the answer to that is, "you can disable all non TLS connections but you can't have only implicit TLS connections, filezilla requires you to have a port open for explicit TLS connections (by default port 21) but you can change that port to a non standard port"
    – Scott Chamberlain
    Jun 14, 2013 at 6:10
  • My question is "How do I disable port 21" - wihch is exactly what I want. I want to disable port 21. But thanks for that answer I will mark it as correct as I think this is as close as we get.
    – Leonard Challis
    Jun 14, 2013 at 7:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .