vsftpd support SSL / TLS encryption support?

[cronner]

Thanks

 

[octopus]

This is a smarter way to do it, no need to edit vsftpd.conf file.

Put it here "/jffs/scripts/vsftpd.postconf" and "chmod a+rx /jffs/scripts/vsftpd.postconf"

#!/bin/sh
CONFIG=$1

source /usr/sbin/helper.sh

pc_replace "local_umask=000" "local_umask=022" "$CONFIG"
pc_replace "connect_from_port_20=YES" "connect_from_port_20=NO" "$CONFIG"
pc_replace "ssl_enable=NO" "ssl_enable=YES" "$CONFIG"
pc_replace "ftpd_banner=Welcome to ASUS RT-AC68U FTP service." "ftpd_banner=Welcome to Router man's unbelievable FTP service." "$CONFIG"
pc_append "max_per_ip=5" "$CONFIG"
pc_append "use_sendfile=NO" "$CONFIG"
pc_append "ssl_ciphers=HIGH" "$CONFIG"
pc_append "pasv_min_port=10500" "$CONFIG"
pc_append "pasv_max_port=10520" "$CONFIG"
pc_append "require_ssl_reuse=NO" "$CONFIG"
pc_append "force_local_data_ssl=YES" "$CONFIG"
pc_append "force_local_logins_ssl=YES" "$CONFIG"
pc_append "rsa_cert_file=/jffs/configs/vsftpd.pem" "$CONFIG"

If ftp server dont start remove, pc_append "require_ssl_reuse=NO" "$CONFIG" that only working in 3.0.2

 

[MichaelR64]

I stumbled upon this thread because i was searching for a graphical tool to do the SCP transfers to and from the router with my mac.
I tried and tested every client i could find.(Transmit/CyberDuck/ForkLift/Fugu/Yummy/Flow/InterArchy)
Even though everbody thinks SCP is the seem as SFTP and thus say client X supports SCP, none of them except InterArchy supports SCP.
And InterArchy is a bit pricey...
Fugu supports SCP but not in a GUI navigational way.

So .... does anybody know of a OSX GUI SCP tool ?
Or even better, is it possible to have FTP running on RMerlins FW?

rgrds Mike

 

[ColinTaylor]

Or even better, is it possible to have FTP running on RMerlins FW?

All versions of the firmware support standard FTP. Go to USB application > Servers Center > FTP Share.

 

[MichaelR64]

True, but the jffs folder is not mapped and thus inaccessible

 

[ColinTaylor]

Hi MichaelR64,

Have a look here (http://www.snbforums.com/threads/access-jffs-scripts-through-usb-share-on-windows.25602/), perhaps you can use a smb.conf.add file to expose the jffs directory.

 

[Stefan1200]

@ octopus: Used your manual to add TLS support to the vsftpd configuration. The vsftpd service starts without problems, but after accepting my certificate FileZilla shows this:

Status:    Connecting to 192.168.1.1:21...
Status:    Connection established, waiting for welcome message...
Status:    Initializing TLS...
Status:    Verifying certificate...
Status:    TLS connection established.
Status:    Logged in
Status:    Retrieving directory listing...
Command:    PWD
Response:    257 "/"
Command:    TYPE I
Response:    200 Switching to Binary mode.
Command:    PASV
Response:    227 Entering Passive Mode (192,168,1,1,41,12)
Command:    LIST
Response:    150 Here comes the directory listing.
Error:    GnuTLS error -110: The TLS connection was non-properly terminated.
Status:    Server did not properly shut down TLS connection
Error:    Transfer connection interrupted: ECONNABORTED - Connection aborted
Response:    226 Directory send OK.
Error:    Failed to retrieve directory listing

Do you have an idea, what is going wrong? I also did the iptables command.

 

[hggomes]

Use FlashFXP client instead.

 

[Stefan1200]

Use FlashFXP client instead.

Telling other people, that they only can use FlashFXP to access my server? Not a good idea

 

[hggomes]

That's not the idea, but testing if with other client same issue happens or not...

You can choose other client to test it, did it work?

 

[Stefan1200]

You can choose other client to test it, did it work?

Not today, currently I disabled ssl for vsftpd, so everyone can access it again.

 

[hggomes]

I never said for you to tell other people they could only use FlashFXP client, it's not the first time Filezzila has issue with TLS certificate handling so definitely you should try it before blaming the Server / Config.

Remember there's always 2 parts, the client and the server, the issue can be on one side or the other, the only way for you to know is trying other client.