ServerName "FTP server"
ServerType standalone
DefaultServer on
Port 21
Umask 022
DefaultTransferMode binary
LoadModule mod_tls.c
MaxInstances 30
User nobody
Group nobody
IdentLookups off
AuthOrder mod_auth_file.c mod_auth_pam.c* mod_auth_unix.c
AuthUserFile "/usr/local/apps/proftpd/etc/proftpd.passwd"
AuthGroupFile "/usr/local/apps/proftpd/etc/proftpd.group"
DefaultRoot ~
DebugLevel 9
SystemLog "/var/log/proftpd/proftpd.log"
DelayEngine off
AllowOverwrite on
<Limit SITE_CHMOD>
DenyAll
</Limit>
<IfModule mod_tls.c>
TLSEngine on
TLSLog /var/log/proftpd/tls.log
TLSProtocol TLSv1
TLSOptions AllowPerUser
# Are clients required to use FTP over TLS when talking to this server?
# it is possible to force tls only for specified users with TLSOptions AllowPerUser
# but, it seems that it is currently broken
# so TLSRequired is off and each users, that needs higher security level
# should explicitly enable SSL/TLS
TLSRequired on
# Server's certificate
TLSRSACertificateFile /usr/local/apps/proftpd/etc/server.cert.pem
TLSRSACertificateKeyFile /usr/local/apps/proftpd/etc/server.key.pem
# CA the server trusts
# TLSCACertificateFile /etc/ftpd/root.cert.pem
# Authenticate clients that want to use FTP over TLS?
TLSVerifyClient on
# Allow SSL/TLS renegotiations when the client requests them, but
# do not force the renegotations. Some clients do not support
# SSL/TLS renegotiations; when mod_tls forces a renegotiation, these
# clients will close the data connection, or there will be a timeout
# on an idle data connection.
# TLSRenegotiate required off
TLSRenegotiate none
<Anonymous ~ftp>
User ftp
Group ftp
# AnonRequirePassword off
UserAlias anonymous ftp
MaxClients 10
DisplayLogin welcome.msg
DisplayChdir .message true
# uncomment if TLSOptions has ALlowPerUser
TLSRequired off
# <Limit WRITE>
# DenyAll
# </Limit>
</Anonymous>
</IfModule>