2

I am using Pure-FTPD from the epel repository on CentOS 6. Now I have configured to enable TLS which works fine however for some reason it wont make use of the certificate file I have placed in /etc/ssl/private/pure-ftpd.pem. For some reason I always get CN localhost.localdomain, O SomeOrganisation etc. Now even if I remove the certificate I still get this response.

So my guess would be that another certificate path was specified during compile time. However also /etc/pki/tls/private/pure-ftpd.pem or /etc/pki/tls/certs/pure-ftpd.pem did not provide the expected result. Oh I also tried /etc/pure-ftpd/pure-ftpd.pem and /etc/pure-ftpd/ssl/pure-ftpd.pem.

Any other suggestions? Or anybody got SSL + FTP with his own certificate to work on Centos + pure-ftpd from EPEL.

Just to be sure this is the package and repository info from the installed package.

Installed Packages
Name        : pure-ftpd
Arch        : x86_64
Version     : 1.0.30
Release     : 1.el6
Size        : 602 k
Repo        : installed
From repo   : epel
Summary     : Lightweight, fast and secure FTP server
URL         : http://www.pureftpd.org
License     : BSD
Description : Pure-FTPd is a fast, production-quality, standard-comformant FTP server,
            : based upon Troll-FTPd. Unlike other popular FTP servers, it has no known
            : security flaw, it is really trivial to set up and it is especially designed
            : for modern Linux and FreeBSD kernels (setfsuid, sendfile, capabilities) .
            : Features include PAM support, IPv6, chroot()ed home directories, virtual
            : domains, built-in LS, anti-warez system, bandwidth throttling, FXP, bounded
            : ports for passive downloads, UL/DL ratios, native LDAP and SQL support,
            : Apache log files and more.
            : Rebuild switches:
            : --without ldap     disable ldap support
            : --without mysql    disable mysql support
            : --without pgsql    disable postgresql support
            : --without extauth  disable external authentication
            : --without tls      disable SSL/TLS

And repository

[epel]
mirrorlist=http://mirrors.fedoraproject.org/mirrorlist?repo=epel-6&arch=x86_64
enabled=1
gpgcheck=1
failovermethod=priority
name=Extra Packages for Enterprise Linux 6 - x86_64
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-EPEL-6
Improve this question
3
  • Where did you put the private key that matches up with the public key in the certificate? For a server to use a cert, it must have access to the private key that goes along with it. That's the only way the server can prove to clients that it's the rightful owner of the cert. Also, private keys should be kept encrypted. How did you provide Pure-FTPd with the passphrase for decrypting the private key?
    – Spiff
    Feb 11, 2015 at 0:40
  • Hello, Thank you for your response. Well for as far as I can see from the documentation I need to combine the private key with the public key. Like so: openssl req -x509 -nodes -newkey rsa:1024 -keyout \ /etc/ssl/private/pure-ftpd.pem \ -out /etc/ssl/private/pure-ftpd.pem
    – Fraak
    Feb 13, 2015 at 8:11
  • I see. It's a poor design choice on Pure-FTPd's part that they don't provide a way for you to keep the private key encrypted on disk. Oh well. Did you make sure to make that .pem chmod 600, and owned by the same account that Pure-FTPd runs as? I know that as a security precaution, OpenSSH will refuse to use a private key file that has group or world read access. Maybe OpenSSL behaves similarly?
    – Spiff
    Feb 14, 2015 at 1:10

1 Answer 1

Reset to default
2

I have the same setup and had same issue. I fixed it by placing the key/certificate in:

/etc/pki/pure-ftpd/pure-ftpd.pem

You probably have the default 'localhost.localdomain' certificate installed there. Just replace the content of this file by your key/certificate. Then restart the pure-ftp service. My FileZilla client is happy now.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .