1

I'm done with the insecure FTP and serve only FTP over SSL in my VSFTPD on Debian 10 Buster.


The man page is not clear at all as per my question:

How do I disable the 20 years old TLSv1.0 and also the 13 years old TLSv1.1 in my VSFTPD on Debian 10 Buster and keep only TLSv1.2?


PS: With the new coming up standard - TLSv1.3 - it also comes to my mind how to enable it?

1

The following might look strange as it does not allow any protocol; But it actually does allow TLSv1.2 + TLSv1.3:

Disallow the the oldest SSLv2 and SSLv3 protocols with:

ssl_sslv2=NO
ssl_sslv3=NO

Disallow the already being deprecated TLSv1.0 protocol with:

ssl_tlsv1=NO

This will automatically enable the newer protocol TLSv1.2 and even the latest TLSv1.3! (If that is supported by your system.)

Note, that you also need to specify ciphers which are to be used, I use only AES-256 ciphers, so feel free to tune this to your needs:

ssl_ciphers=ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES256-SHA

You might need to verify your setup afterwards. I personally use High-Tech Bridge SSL tester for FTP since you can specify the port there.


Example result with the above settings:

High-Tech Bridge example FTP result

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.