issue with new ssl key and vsftpd

replica88 · 04-14-2010, 10:39 AM

I have just generated a new ssl key on my ftp server with the following command

Code:

openssl req -x509 -nodes -days 365 -newkey rsa:1024 \
 -keyout /etc/ssl/certs/vsftpd.pem \
 -out /etc/ssl/certs/vsftpd.pem

I then put my new key onto my file server and attempted to connect to the FTP and it failed (this did work before with the default key).. I use curlFTPfs to mount the FTP directory locally as /ftpbackup, below is the command and the output.

Code:

root@Fileserver:/# curlftpfs -v -o ssl -o cacert=/certificate/vsftpd.pem -o no_verify_hostname ftp://ftpaccount:ftppassword@192.168.1.254 /ftpbackup
* Couldn't find host 192.168.1.254 in the .netrc file, using defaults
* About to connect() to 192.168.1.254 port 21 (#0)
*   Trying 192.168.1.254... * connected
* Connected to 192.168.1.254 (192.168.1.254) port 21 (#0)
< 220 (vsFTPd 2.0.6)
> AUTH SSL
< 234 Proceed with negotiation.
* found 1 certificates in /certificate/vsftpd.pem
*        server certificate verification OK
*        common name: ###### (does not match '192.168.1.254')
*        server certificate expiration date OK
* server certificate not activated yet.
* Closing connection #0
Error connecting to ftp: server certificate not activated yet.

As you see it gives an error about the certificate not being activated, I have looked this up and cant find a way to activate it. Do you have any idea what the problem is?

Below is the contents of vsftpd.conf on the ftp server

Code:

listen=YES
anonymous_enable=NO
local_enable=YES
write_enable=YES
dirmessage_enable=YES
connect_from_port_20=YES
chroot_local_user=YES
secure_chroot_dir=/var/run/vsftpd
pam_service_name=vsftpd
rsa_cert_file=/etc/ssl/certs/vsftpd.pem
rsa_private_key_file=/etc/ssl/certs/vsftpd.pem
ssl_enable=YES

Many thanks

replica88 · 04-14-2010, 12:14 PM

I just tried it again and it worked???? seems abit of patience was in order

Code:

root@Fileserver:/# curlftpfs -v -o ssl -o cacert=/certificate/vsftpd.pem -o no_verify_hostname ftp://ftpaccount:ftppassword@192.168.1.254 /ftpbackup
* Couldn't find host 192.168.1.254 in the .netrc file, using defaults
* About to connect() to 192.168.1.254 port 21 (#0)
*   Trying 192.168.1.254... * connected
* Connected to 192.168.1.254 (192.168.1.254) port 21 (#0)
< 220 (vsFTPd 2.0.6)
> AUTH SSL
< 234 Proceed with negotiation.
* found 1 certificates in /certificate/vsftpd.pem
*        server certificate verification OK
*        common name: ##### (does not match '192.168.1.254')
*        server certificate expiration date OK
*        server certificate activation date OK
*        certificate public key: RSA
*        certificate version: #3
*        subject: C=###,ST=###,L=###,O=####,OU=###,CN=#####,EMAIL=#####
*        start date: Wed, 14 Apr 2010 16:10:21 GMT
*        expire date: Thu, 14 Apr 2011 16:10:21 GMT
*        issuer: C=GB,ST=###,L=###,O=###,OU=###,CN=###,EMAIL=#####
*        compression: DEFLATE
*        cipher: 3DES 168 CBC
*        MAC: SHA
> USER ftpaccount
< 331 Please specify the password.
> PASS ftppassword
< 230 Login successful.
> PBSZ 0
< 200 PBSZ set to 0.
> PROT P
< 200 PROT now Private.
> PWD
< 257 "/"
* Entry path is '/'
* Remembering we are in dir ""
* Connection #0 to host 192.168.1.254 left intact