Ssl – How to configure public-key authentication with vsftpd

ftppublic-keysslvsftpd

The documentation of vsftpd is quite good (https://security.appspot.com/vsftpd/vsftpd_conf.html), however I cannot find some details on how to use public key authentication. I know that I need require_cert and maybe validate_cert, but where do I put the public client keys, which are accepted for authentication? I cannot find information on that.

Best Answer

vsftpd is for FTP, FTP by its very nature is not encrypted (ftp over ssl is another matter)

You can't set up public key authentication with vsftpd - you are getting confused between FTPs and SFTP which are two different protocols.

To use public key authentication for SFTP it is just a matter of installing your public key on the server, as you would for ssh as detailed here - http://www.noah.org/wiki/SSH_public_keys

With this configuration, you can use OpenSSH's implementation of SFTP authentication.

If you are talking about setting up FTPs or FTP over SSL then this guide will be useful - http://wiki.vpslink.com/Configuring_vsftpd_for_secure_connections_%28TLS/SSL/SFTP%29

This example, however, is not public key auth, its just server-side authentication and useful for encrypting your FTP connection.

Related Solutions

SSH Key – How to Create a Public Key from a Private Key

Use the -y option to ssh-keygen:

ssh-keygen -f ~/.ssh/id_rsa -y > ~/.ssh/id_rsa.pub

From the 'man ssh-keygen'

 -y      This option will read a private OpenSSH format file and print an
         OpenSSH public key to stdout.

Specify the private key with the -f option, yours might be dsa instead of rsa. The name of your private key probably contains which you used. The newly generated public key should be the same as the one you generated before.

SSH – Stop Client from Offering All Public Keys

This is expected behaviour according to the man page of ssh_config:

 IdentityFile
         Specifies a file from which the user's DSA, ECDSA or DSA authentica‐
         tion identity is read.  The default is ~/.ssh/identity for protocol
         version 1, and ~/.ssh/id_dsa, ~/.ssh/id_ecdsa and ~/.ssh/id_rsa for
         protocol version 2.  Additionally, any identities represented by the
         authentication agent will be used for authentication.  

         [...]

         It is possible to have multiple identity files specified in configu‐
         ration files; all these identities will be tried in sequence.  Mul‐
         tiple IdentityFile directives will add to the list of identities
         tried (this behaviour differs from that of other configuration
         directives).

Basically, specifying IdentityFiles just adds keys to a current list the SSH agent already presented to the client.

Try overriding this behaviour with this at the bottom of your .ssh/config file:

Host *
  IdentitiesOnly yes

You can also override this setting on the host level, e.g.:

Host foo
  User bar
  IdentityFile /path/to/key
  IdentitiesOnly yes

Best Answer

Related Solutions

SSH Key – How to Create a Public Key from a Private Key

SSH – Stop Client from Offering All Public Keys

Related Topic