- better TLS/SSL config, misc config cleanup

diff --git a/proftpd-anonftp.conf b/proftpd-anonftp.conf
index 3f869b17e6417dc11448d6489ccf6ca0eb718d7c..4018a5d53b2ededa406920e7f41312aaee140f40 100644 (file)
--- a/proftpd-anonftp.conf
+++ b/proftpd-anonftp.conf
@@ -1,7 +1,4 @@
-# $Id$
-
 # A basic anonymous configuration
-# uncoment this section below if you want gain annonymous ftp acces
 <Anonymous ~ftp>
        User                    ftp
        Group                   ftp

diff --git a/proftpd-mod_pam.conf b/proftpd-mod_pam.conf
index 53bd2880e6c4c5bcfcaeb8872940c116a7981352..45d54a0beb57a2f50fd6a442384f0ba6029009d3 100644 (file)
--- a/proftpd-mod_pam.conf
+++ b/proftpd-mod_pam.conf
@@ -1,4 +1,3 @@
-# $Id$
 LoadModule     mod_auth_pam.c
 
 <IfModule mod_auth_pam.c>

diff --git a/proftpd-mod_tls.conf b/proftpd-mod_tls.conf
index f5103cff144e4091f6d3ff3a5627fb061d1e524a..c7b662674e538db6f388719301175bc44a0ecf0f 100644 (file)
--- a/proftpd-mod_tls.conf
+++ b/proftpd-mod_tls.conf
@@ -1,22 +1,32 @@
-# $Id$
-LoadModule     mod_tls.c
+LoadModule mod_tls.c
 
-# TLSEngine must be enabled for TLS options to have effect.
-#TLSEngine on
+# Enable TLS/SSL connections
+TLSEngine on
 
-# These are the TLS related options, default values
-#TLSRSACertificateFile         /etc/ftpd/ftpd-rsa.pem
-#TLSRSACertificateKeyFile      /etc/ftpd/ftpd-rsa-key.pem
+# Specify TLS/SSL log
+TLSLog /var/log/ftp.tls.log
 
-#TLSDSACertificateFile         /etc/ftpd/ftpd-dsa.pem
-#TLSDSACertificateKeyFile      /etc/ftpd/ftpd-dsa-key.pem
+# Path to CA chain file
+TLSCACertificateFile /etc/ftpd/chain.pem
 
-#TLSCARevocationFile           /etc/ftpd/ftpd-crl.pem
-#TLSDHParamFile                                /etc/ftpd/ftpd-dhparam.pem
+# Path to certificate file
+TLSRSACertificateFile /etc/ftpd/cert.pem
 
-#TLSCipherSuite                                ALL:!EXP
+# Path to certificate key file
+TLSRSACertificateKeyFile /etc/ftp/privkey.pem
 
-# don't verify any peer certificates
-#TLSVerifyClient                       off
+# Define available TLS/SSL ciphers (allow only strong ones by default)
+TLSCipherSuite HIGH:!kDHd:!aNULL:!aDSS:!eNULL:!DES:!RC4:!RC2:!MD5:!SHA1:!SHA:!SSLv2:!SSLv3:!TLSv1:!TLSv1.1:!EXP:!EXPORT56:!LOW:!MEDIUM:!ADH:!DSS:!NULL
 
-#TLSRequired off
+# Allow TLSv1.2 only
+TLSProtocol TLSv1.2
+
+# Don't verify client certificates
+TLSVerifyClient off
+
+# Require TLS/SSL for all connections and both control and data channels
+TLSRequired on
+
+# Do not require reuse of the SSL session
+# This is required by some apps (ie. curl) to work over SSL
+TLSOptions NoSessionReuseRequired