ProFTPD
Set up in UbuntuVirtual Box
ProFTPD Installation Steps on Ubuntu:
Install and Start ProFTPD using the below Commands:
“sudo systemctl start proftpd”
“sudo systemctl enable proftpd”
This should install and start the ProFTPD.We can check
whether the ProFTPD is running or not using the below command:
“sudo systemctl status proftpd”
1)
Active Mode
2)
Passive Mode
If we connect to the FTP without SSL then the communication
will happen over the internet, this will make things easier for Man in the Middle
Attacks. We can use SSL in Passive mode.
So we should set up our FTP to allow connections only in
Passive Mode.We need to Secure ProFTPD with TLS.
Install OpenSSL to your server using the below command:
Install OpenSSL to your server using the below command:
“sudo apt-get install openssl –y”
Once the installation has been completed, generate SSL certificates for ProFTPd with the following command:
“sudo openssl req -x509 -newkey rsa:1024 -keyout
/etc/ssl/private/proftpd.key -out /etc/ssl/certs/proftpd.crt -nodes -days 365”
Answer
all the questions in the next step.
The
above command will generate two files “/etc/ssl/private/proftpd.key”
and “/etc/ssl/certs/proftpd.crt”
Next,
provide proper permissions to the generated files with the following command:
“sudo chmod 600 /etc/ssl/certs/proftpd.crt”
The
Default configuration files of ProFTPD is located at “/etc/proftpd/proftpd.conf”
Configure ProFTPD to Use SSL
“sudo vi /etc/proftpd/proftpd.conf”
Uncomment the following line:
“Include /etc/proftpd/tls.conf”
Save and close the file, when you are finished. Then, open “/etc/proftpd/tls.conf”
file:
Change
the following lines:
TLSRSACertificateFile /etc/ssl/certs/proftpd.crt
TLSEngine on
TLSLog
/var/log/proftpd/tls.log
TLSRequired on
TLSOptions NoCertRequest
EnableDiags NoSessionReuseRequired
TLSVerifyClient off
Save
and close the file, when you are finished. Then, restart the ProFTPD service
with the following command:
“systemctl restart proftpd”
Create User for ProFTPD
Next, you will need to create a ProFTPD user to access
the server. You can do it with the following command:
“adduser ftpuser”
Answer all the questions(This includes setting a password)
Now try to connect to the FTP using any client. In Passive
mode first a connection will be established on Port 21 of the Guest Machine.
Then Guest machine will open a port for Data Connection. This port is called “Passive
Port”. We can configure a range of Passive Ports in the proftpd.conf file.
Ex: We can add the below line to use a range between 49934
and 60000 for the data Connection.
Passive Ports 49934 60000
Add the below rules in ufw to Open the required ports(i.e 21
and 49934 - 60000).
sudo ufw allow 21/tcp
sudo ufw allow 49934:60000/tcp
And Allow the IP Address of the machine that needs to
communicate with the Guest Machine.
sudo ufw allow out to "IPAddress"
Network Settings in Virtual Box:
Virtual Box Network Modes:
NAT is used to setup an isolated Guest Machine. NAT will be
useful for setting up clients instead of Servers. If we want to use the Virtual
Box as a Server we need to use Port Forwarding. NAT will allow the Guest
Machine to have Internet Connection. The Guest machine can communicate with the
host but Host Machine can’t identify the guest. If the host or the Internet
needs to communicate with the Guest Machine then we need to add Port forwarding
rules. In Port forwarding we Map the Ports of the Host Machine with the Ports
in the Guest Machine.
Ex Scenario for port
forwarding:
If we want to Setup a Web Server in NAT Mode
then we need to use port forwarding rule.
Now whichever request is sent to the Host Machine on Port
8800 will be redirected to the Port 80 of the Guest Machine.
However if our requirement is to set up an FTP and connect
to it in passive mode , NAT with port forwarding rules also won’t be sufficient
as there will be a second connection(Data Connection) that needs to be
established between the Host and the Guest Machine. And the host machine will
try to make the data connection using the NAT IP address that it can’t
recognize. Hence the connection won’t be established. Below screenshot is an
example for this.
If we use Bridged Adapter then the Guest Machine will become
a part of our network. However if we are doing this on our laptop then our
office network’s firewall doesn’t allow the Guest machine to become a part of the
network. We can see this in the below screenshots.
Inet Address of Guest Machine when the host is connected to
Office Network:
Here we can see that there is no Inet Address assigned to
the guest machine as the firewall doesn’t allow it.
If we connect to our personal Wifi we can see that both the Host
Machine and the Guest Machine will be part of the Same Network.
Inet Address of Guest Machine in Personal Network:
IP Address of Host Machine:
Ping Status from Command Prompt
Inet Address of the Guest Machine on the Server where the
firewall allows assigning Network ip to the VM:
Ip Address of the Host :
Network Settings inside the Virtual Box : (Enable the
Bridged Adapter Network if its disabled and Disable the NAT)
Now we should be able to Connect to the FTP in Passive Mode
from FileZilla:
No comments:
Post a Comment