Use OpenSSL in Linux to create a secure vsftp

Vsftpd is one of the FTP server software on Linux. It supports many options, one of which allows OpenSSL to encrypt data, to some extent, this can make up for the defects of the inscription transmitted when ftp transfers the account password information, which can make the FTP account more secure.

1. First, install vsftpd

# yum install vsftpd

2. Create a ca

# Cd/etc/pki/CA # mkdir certs newcerts CRL # Touch index.txt serial # echo 01> serial # Vim/etc/pki/tls/OpenSSL. conf # modify the following fields, in this way, it is convenient to issue a certificate [ca_default] dir =/etc/pki/CA # specify the CA path [req_distinguished_name] countryname_default = cn # default country name stateorprovincename_default = HN # province localityname _ # Region 0. organizationname_default = rhce # company name # OpenSSL genrsa 1024> private/cakey. PEM # OpenSSL req-ne W X509-key private/cakey. pem-out cacert. pem Press enter. Be sure to configure the domain name! Chmod 600 private/cakey. pem cacert. pem has been created for the CA certificate.

3. issue a certificate to vsftpd

# Cd/etc/vsftpd/# mkdir SSL # OpenSSL genrsa 1024> SSL/FTP. key # OpenSSL req-New-key SSL/FTP. key-out SSL/FTP. REQ is another carriage return, vsfptd request certificate application number # OpenSSL ca-in SSL/FTP. REQ-out SSL/FTP. CRT confirm signing # rm SSL/FTP. REQ-F # chmod 600 SSL/FTP. *

4. Edit the configuration file and add the following lines:

# Vim/etc/vsftpd. add the following line to the conf: # SSL configuressl_enable = yesssl_tlsv1 = Yes // we recommend that you enable this line. ssl_sslv2 = nossl_sslv3 = noallow_anon_ssl = Yes // enable Anonymous users to use authorization = Yes // use encrypted force_local_logins_ssl = Yes // sslrsa_cert_file =/etc/vsftpd/SSL/FTP for forced logon. CRT rsa_private_key_file =/etc/vsftpd/SSL/FTP. key

5. Enable the vsftpd service and use SSL encryption to access FTP on the client.
# Service vsftpd start

6. Run the command to capture packets on the server to check whether the data is encrypted.
# Tcpdump-I eth0-A DST 192.168.0.48