UNIX for Dummies Questions & Answers

Hello all

I need a little advice on securing my VSFTPD server. I currently have it setup and working using a self signed certificate by following instructions on the net and im happy with it to a certain extent.

One of my clients is not... He said he cannot connect to the server unless he has the certificate to add to his client. I sent him the vsftpd.pem file i had created using the online tutorial but he told me this was not what he was looking for. So im stuck, im not sure what i should be sending him and if thats not what he was looking for what the hell have i just sent him? Have i just given him a confidential file?

I also thought that it could be because the certificate is self signed and he might require a signed certificate?

in my vsftpd.conf the certificate section looks like this...

Code:

ssl_enable=YES
allow_anon_ssl=NO
force_local_data_ssl=YES
force_local_logins_ssl=YES
ssl_tlsv1=NO
ssl_sslv2=YES
ssl_sslv3=YES
rsa_cert_file=/etc/vsftpd/vsftpd.pem
rsa_private_key_file=/etc/vsftpd/vsftpd.key
pam_service_name=vsftpd

Can someone who knows a bit more about this fill me in? Thank you in advance.

---------- Post updated at 07:15 AM ---------- Previous update was at 04:30 AM ----------

I believe i might of found what i need to do.

I think i need to extract the public key and crt from the .pem file. How can this be achived?

Apparently the file the client needs is either a .key and a .crt (im guessing these must be public) or a .p12 / .pfk

Can someone please help, time is not on my side.

This will extract the public key from your .pem to stdout:

Code:

openssl x509 -inform pem -in /path/to/your/vstftp.pem -noout -pubkey

To generate a .key and .crt, good for one year, use the following syntax

Code:

openssl req -x509 -new -out vsftpd.key -keyout vsftpd.key -days 365