Requiring encrypted FTP

FTP is encrypted with "explicit FTP over TLS": clients connect on port 21 and switch to TLS before signing in. The Encryption (FTPS) card at the top of Server → Services → FTP shows whether plain FTP is still allowed, which certificate clients see, and why the last change was refused, if it was. Customers find the matching settings on their own FTP accounts page; send them to connecting to FTP securely.

Require encryption or allow plain FTP

The badge on the card reads:

• Required: a client that doesn't switch to TLS can't sign in, and file transfers must be encrypted too. Passwords and files never cross the network in the clear. New servers start here.
• Offered, plain FTP allowed: encryption works, but a client that doesn't ask for it signs in unencrypted. A server whose customers were already using FTP may start here, so their existing clients keep working.
• Not set up: encryption isn't in place yet. Press Set up.

Press Require encryption to refuse plain FTP, or Allow plain FTP too (you're asked to confirm) to accept it again. New connections follow the change straight away; sessions already open aren't dropped. Before requiring encryption, check that customers' clients are set to explicit FTP over TLS, or they'll see "530" when they next sign in.

Which certificate FTP serves

FTP serves one certificate for the whole server, not one per domain:

• The server's trusted certificate, when there is one. The card says "Uses the trusted certificate for" the name and its expiry date, and clients should connect to that name. It's the certificate mail uses for the server mail hostname, and renewals reach FTP by themselves.
• A self-signed certificate for the machine's hostname otherwise. Clients ask to trust it once, and again when it's replaced, 30 days before it expires or when the hostname changes. The card says why the trusted one isn't used, such as that it isn't there yet or doesn't name the server's hostname.

Getting a trusted certificate

1. Install Email Server under Server → System → Features, if it isn't already. The server certificate comes from mail.
2. Open Server → Services → Mail delivery & DNS, enter the Server mail hostname under Mail certificates, and press Save and request. Its A or AAAA record must point at this server.
3. Once the certificate is issued, FTP switches to it within about 15 minutes. Reload the FTP page to check the card.

Setting up the mail server explains the certificate states if it doesn't arrive.

"TLS there was set up by hand"

If the card says the last change was refused because vsftpd.conf "isn't Hostctl's FTP setup, or TLS there was set up by hand", Hostctl found encryption already turned on in /etc/vsftpd.conf in a way it didn't write, and left the file alone rather than overwrite it.

To let Hostctl manage it, turn the hand-made TLS off and set it up again:

sudo sed -i 's/^ssl_enable=YES$/ssl_enable=NO/' /etc/vsftpd.conf

Then press Try again on the card. Hostctl remembers the earlier values of the settings it takes over and puts them back if FTP Server is ever uninstalled. Every other line in the file stays as it is.

The same message appears when /etc/vsftpd.conf isn't the virtual-user setup that Hostctl's FTP Server writes. Hostctl doesn't manage encryption for a vsftpd setup it didn't make.

A change was interrupted

If the refusal persists after the steps above, an earlier change may have been interrupted halfway. Put the file back the way it was, then press Set up again:

sudo /usr/bin/python3 -I /usr/lib/hostctl-privd/ftp_tls.py recover