117笔记问答在Ubuntu上为FTPServer（FTP over SSL）设置SSL加密，可以按照以下步骤进行：
1. 安装必要的软件包
首先，确保你的系统是最新的，并安装vsftpd和ssl-cert包。
sudo apt update sudo apt install vsftpd ssl-cert
2. 配置vsftpd
编辑vsftpd的配置文件/etc/vsftpd.conf。
sudo nano /etc/vsftpd.conf
在文件中添加或修改以下配置项：
# 启用SSL ssl_enable=YES # 强制使用SSL force_local_data_ssl=YES force_local_logins_ssl=YES # SSL证书和密钥文件路径 rsa_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem rsa_private_key_file=/etc/ssl/private/ssl-cert-snakeoil.key # 允许匿名用户使用SSL allow_anon_ssl=NO # 允许本地用户使用SSL local_enable=YES # 允许写操作 write_enable=YES # 其他常用配置项 listen=YES listen_ipv6=NO pam_service_name=vsftpd userlist_enable=YES tcp_wrappers=YES
3. 重启vsftpd服务
保存并关闭配置文件后，重启vsftpd服务以应用更改。
sudo systemctl restart vsftpd
4. 验证SSL连接
你可以使用openssl命令来验证FTPServer是否正确配置了SSL。
openssl s_client -connect your_server_ip:21 -starttls ftp
你应该会看到类似以下的输出，表示SSL连接成功：
CONNECTED(00000003) depth=2 O = Digital Signature Trust Co., CN = DST Root CA X3 verify error:num=19:self signed certificate in certificate chain verify return:1 depth=2 O = Digital Signature Trust Co., CN = DST Root CA X3 verify return:1 depth=0 CN = your_server_hostname verify return:1 --- Certificate chain 0 s:CN = your_server_hostname i:C = US, O = Let's Encrypt, CN = R3 1 s:C = US, O = Let's Encrypt, CN = R3 i:O = Digital Signature Trust Co., CN = DST Root CA X3 --- Server certificate -----BEGIN CERTIFICATE----- MIIDdzCCAl+gAwIBAgIEbTJ9MzANBgkqhkiG9w0BAQsFADBhMQswCQYDVQQGEwJV ... -----END CERTIFICATE----- subject=CN=your_server_hostname issuer=C = US, O = Let's Encrypt, CN = R3 --- No client certificate CA names sent Peer signing digest: SHA256 Peer signature type: RSA-PSS Server Temp Key: X25519, 253 bits --- SSL handshake has read 3546 bytes and written 434 bytes Verification error: self signed certificate in certificate chain --- New, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384 Server public key is 2048 bit Secure Renegotiation IS NOT supported Compression: NONE Expansion: NONE No ALPN negotiated Early data was not sent Verify return code: 19 (self signed certificate in certificate chain) ---
5. 配置防火墙
确保你的防火墙允许FTP和FTPS流量。
sudo ufw allow 21/tcp sudo ufw allow 990/tcp # FTPS数据连接端口 sudo ufw reload
6. 客户端配置
在客户端上，使用支持FTPS的FTP客户端（如FileZilla）连接到服务器，并选择使用SSL/TLS。
通过以上步骤，你应该能够在Ubuntu上成功配置FTPServer以使用SSL加密。