> ----- Original Message -----
> From: "Tom MÍler-Kortkamp"
>
>> Hi,
>>
>> i've just one include-line in the <global>-part like
>> include /etc/proftpd.conf.tls
>>
>> with the following content (I use the dovecot-certs):
>> # cat /etc/proftpd.conf.tls
>> <IfModule mod_tls.c>
>> TLSEngine on
>> TLSLog /var/log/ftp-tls.log
>> TLSRequired off
>> TLSRSACertificateFile /etc/pki/dovecot/certs/dovecot.pem
>> TLSRSACertificateKeyFile /etc/pki/dovecot/private/dovecot.pem
>> TLSVerifyClient off
>> TLSOptions NoCertRequest
>> TLSRenegotiate required off
>> </IfModule>
>>
>> So I just have to add one line when prefs got lost/deleted.
>>
>> Just my 5 ct ...
>>
>> tmueko
>>
>> Am 29.05.2008 um 06:56 schrieb Jim Scott:
>>
>>> I had to make a correction to my last post. It seems that the
>>> configuration I was showing only enabled TLS/SSL on the main IP
>>> address. If you have multiple IP's bound to a box it would not work on
>>> any of the virutalhosts.
>>>
>>> I changed the configuration to put most of the config in <Global></
>>> Global> and the directive TSLProtocol is not allowed in Global so had
>>> to be put outside. I tested after these changes and I can now connect
>>> on any IP address that is on my box. Also the blog was updated with the
>>> new instructions.
>>>
>>> <IfModule mod_tls.c>
>>> TLSProtocol TLSv1
>>> </IfModule>
>>>
>>> # Restore file permissions capability to site administrator
>>> <Global>
>>> # Report localtime, not GMT
>>> TimesGMT off
>>> ServerIdent on "FTP Server"
>>> IdentLookups off
>>>
>>> <IfModule mod_tls.c>
>>> TLSEngine on
>>> TLSLog /var/log/tls.log
>>>
>>> # Are clients required to use FTP over TLS when talking to this
>>> server?
>>> TLSRequired off
>>>
>>> # Server's certificate
>>> TLSRSACertificateFile /etc/proftpd/ssl/proftpd.cert.pem
>>> TLSRSACertificateKeyFile /etc/proftpd/ssl/proftpd.key.pem
>>>
>>> # Authenticate clients that want to use FTP over TLS?
>>> TLSVerifyClient off
>>>
>>> # Allow SSL/TLS renegotiations when the client requests them, but
>>> # do not force the renegotations. Some clients do not support
>>> # SSL/TLS renegotiations; when mod_tls forces a renegotiation, these
>>> # clients will close the data connection, or there will be a timeout
>>> # on an idle data connection.
>>> TLSRenegotiate required off
>>>
>>> </IfModule>
>>>
>>> </Global>
>>>
>
>>
>>
>
> I was able to get this to work finally. In case anyone else had trouble
> with it, here is the info.
>
> The code I inserted into the <global> section of the /etc/proftpd.conf
> was:
>
> <IfModule mod_tls.c>
> TLSEngine on
> TLSLog /var/log/tls.log
> TLSRequired off
> TLSOptions NoCertRequest
> TLSRSACertificateFile /etc/admserv/certs/certificate
> TLSRSACertificateKeyFile /etc/admserv/certs/key
> TLSVerifyClient off
> TLSRenegotiate required off
> </IfModule>
>
>
> I previously had used a different template that did not have the
> "TLSOptions NoCertRequest"
> in the code.
> Now that I added "TLSOptions NoCertRequest", it does work.
>
> Since I use a cert (for the siteadmin login) on my servers that is already
> at
> /etc/admserv/certs/certificate
> then I used that path.
>
> In my FTP software, Secure FX, since I use a wildcard cert, I set it to
> "Disable Certificate Validation"
> And, also in my FTP software, Secure FX,
> I set it to "FTP over SSL (explicit)"
>
> The "FTP over SSL (implicit)" does not work.
>
>
>
> ----
> Ken Marcus
> Ecommerce Web Hosting by
> Precision Web Hosting, Inc.
> http://www.precisionweb.net
>
>
>
>
>
>