Setup Secure FTP File Transfer Using SSL/TLS in RHEL 8

In our last article, we have described in detail on how to install and configure an FTP server in RHEL 8 Linux. In this article, we will explain how to secure an FTP server using SSL/TLS to enable data encryption services for secure file transfer between systems.

We hope you already have an FTP server installed and running properly. If not, please use the following guide to install it on your system.

  1. How to Install, Configure and Secure FTP Server in RHEL 8

Step 1. Generating SSL/TLS Certificate and Private Key

1. Create the following directory to store the SSL/TLS certificate and key files.

# mkdir -p /etc/ssl/vsftpd

2. Next, generate a self-signed SSL/TLS certificate and private key using the following command.

# openssl req -x509 -nodes -keyout /etc/ssl/vsftpd/vsftpd.pem -out /etc/ssl/vsftpd/vsftpd.pem -days 365 -newkey rsa:2048

Following is the explanation of each flag used in the above command.

  1. req – is a command for X.509 Certificate Signing Request (CSR) management.
  2. x509 – means X.509 certificate data management.
  3. days – defines a number of days certificate is valid for.
  4. newkey – specifies certificate key processor.
  5. rsa:2048 – RSA key processor, will generate a 2048 bit private key.
  6. keyout – sets the key storage file.
  7. out – sets the certificate storage file, note that both certificate and key are stored in the same file: /etc/ssl/vsftpd/vsftpd.pem.

The above command will prompt you to answer the questions below, remember to use values that apply to your scenario.

Country Name (2 letter code) [XX]:IN
State or Province Name (full name) []:Lower Parel
Locality Name (eg, city) [Default City]:Mumbai
Organization Name (eg, company) [Default Company Ltd]
Organizational Unit Name (eg, section) []:Linux and Open Source
Common Name (eg, your name or your server's hostname) []:tecmint
Email Address []:[email protected]
Create SSL Certificate for FTP Server
Create SSL Certificate for FTP Server

Step 2. Configuring VSFTPD To Use SSL/TLS

3. Open the VSFTPD configuration file for editing using your favorite command line editor.

# vi /etc/vsftpd/vsftpd.conf

Add the following configuration parameters to enable SSL, then select the version of SSL and TLS to use, at the end of the file.


4. Next, add the rsa_cert_file and rsa_private_key_file options to specify the location of the SSL certificate and key file respectively.


5. Now add these parameters to disable anonymous connections from using SSL and force all non-anonymous connections over SSL.

allow_anon_ssl=NO			# disable anonymous users from using SSL
force_local_data_ssl=YES		# force all non-anonymous logins to use a secure SSL connection for data transfer
force_local_logins_ssl=YES		# force all non-anonymous logins  to send the password over SSL

6. Next, add these option to disable all reuse of SSL data connections and set the SSL ciphers HIGH to allow encrypted SSL connections.


7. You also have to specify the port range (min and max port) of passive ports to be used by vsftpd for secure connections, using the pasv_min_port and pasv_max_port parameters respectively. In addition, you can optionally enable SSL debugging for troubleshooting purposes, using the debug_ssl option.


8. Finally, save the file and restart the vsftpd service for the above changes to take effect.

# systemctl restart vsftpd

9. One more critical task to perform before you can securely access the FTP server is to open the ports 990 and 40000-50000 in the system firewall. This will allow TLS connections to vsftpd service and open the port range of passive ports defined in the VSFTPD configuration file respectively, as follows.

# firewall-cmd --zone=public --permanent –add-port=990/tcp
# firewall-cmd --zone=public --permanent –add-port=40000-50000/tcp
# firewall-cmd --reload

Step 3: Install FileZilla to Securely Connect to the FTP Server

10. To securely connect to the FTP server, you need an FTP client that supports SSL/TLS connections such as FileZilla – is an open source, widely-used, cross-platform FTP, SFTP, and FTPS client that supports SSL/TLS connections by default.

Install FileZilla in Linux using your default package manager as follows:

$ sudo apt-get install filezilla   		#Debian/Ubuntu
# yum install epel-release filezilla		#On CentOS/RHEL
# dnf install filezilla			        #Fedora 22+
$ sudo zypper install filezilla			#openSUSE

11. After the Filezilla package is installed, search for it in the system menu and open it. To quickly connect the remote FTP server, from the main interface, provide the Host IP address, Username, and user’s Password. Then click QuickConnect.

Connect to FTP Server Using Filezilla
Connect to FTP Server Using Filezilla

12. Then the application will ask you to allow secure connection using the unknown, self-signed certificate. Click OK to proceed.

Accept SSL Certificate to Connect FTP
Accept SSL Certificate to Connect FTP

If the configuration at the server is fine, the connection should be successful as shown in the following screenshot.

Connected FTP Server
Connected FTP Server

13. Finally, test the FTP secure connection status by trying to upload files from your machine to the server as shown in the next screenshot.

Securely Transfer Files via Filezilla
Securely Transfer Files via Filezilla

That’s all! In this article, we showed how to secure an FTP server using SSL/TLS for secure file transfer in RHEL 8. This is the second part of our comprehensive guide to install, configure and secure an FTP server in RHEL 8. To share any queries or thoughts, use the feedback form below.

If you liked this article, then do subscribe to email alerts for Linux tutorials. If you have any questions or doubts? do ask for help in the comments section.

If You Appreciate What We Do Here On TecMint, You Should Consider:

TecMint is the fastest growing and most trusted community site for any kind of Linux Articles, Guides and Books on the web. Millions of people visit TecMint! to search or browse the thousands of published articles available FREELY to all.

If you like what you are reading, please consider buying us a coffee ( or 2 ) as a token of appreciation.

Support Us

We are thankful for your never ending support.

Got something to say? Join the discussion.

Have a question or suggestion? Please leave a comment to start the discussion. Please keep in mind that all comments are moderated and your email address will NOT be published.

This site uses Akismet to reduce spam. Learn how your comment data is processed.