How to disable FTP without upsetting Virtualmin

jimdunn · December 8, 2024, 12:55pm

I hope I could ask for the proper way to “disable FTP but keep FTPS and SFTP enabled” on my Debian server, without causing any issues with Virtualmin.

Thx!!

SYSTEM INFORMATION
OS type and version	Debian 11
Webmin version	latest
Virtualmin version	latest
Webserver version	apache
Related packages	SUGGESTED

ID10T · December 8, 2024, 3:03pm

I think sftp is handled by ssh.

Some random AI tells me you can force Proftpd to allow only encrypted connections.

www.proftpd.org/docs/howto/TLS.html

jimdunn · December 8, 2024, 6:00pm

I found the virtualmin.conf file in the /etc/proftpd/conf.d folder.

I have uncommented the “TLSRequired on” that was there.

I just didn’t want to break any other Virtualmin functionality.

Joe · December 8, 2024, 9:09pm

sftp is handled by both openssh and ProFTPd on a Virtualmin system. Port 22 is the ssh server, and will accept an sftp connection (but will not be limited to sftp), while ProFTPd listens on port 2222 for sftp connections, and will be limited in whatever way ProFTPd is configured to limit users.

And, according to the ProFTPd docs, the option is TLSRequired on

http://www.proftpd.org/docs/howto/TLS.html

I would trust the ProFTPd docs over any AI.

Joe · December 8, 2024, 9:11pm

You can completely disable ProFTPd, and Virtualmin will not care. We do not use FTP for anything.

ID10T · December 8, 2024, 9:13pm

Yeah. I included a link to those docs. I thought Proftpd listened on 2222 but when I fired it up to check there was nothing in netstat. I ran into it first when I tried to make ssh listen on that port. Not sure why it didn’t show up now, but, I don’t use it so not gonna sweat it.

Joe · December 8, 2024, 9:35pm

The Virtualmin installer configures it to do so. The config that does it is here:

github.com

virtualmin/Virtualmin-Config/blob/e154b02d11a4ccc1e063f2999dfd0e32413e5926/lib/Virtualmin/Config/Plugin/ProFTPd.pm#L149


      
          TLSLog                        /var/log/proftpd/tls.log
          <IfModule mod_tls_shmcache.c>
            TLSSessionCache             shm:/file=/var/run/proftpd/sesscache
          </IfModule>
          
          # VirtualHost for SFTP (FTP over SSH) port
          <IfModule !mod_sftp.c>
            LoadModule mod_sftp.c
          </IfModule>
          
          <VirtualHost 0.0.0.0>
            SFTPEngine on
            SFTPLog /var/log/proftpd/sftp.log
          
            # Configure the server to listen on 2222 (openssh owns 22)
            Port 2222
          
            # chroot users into their home by default
            DefaultRoot ~
          
            # Allow file overwrites

A fresh ProFTPd installation would not set that up.

ID10T · December 8, 2024, 11:40pm

Yeah. It is still installed, I just turned it off. I don’t know what happened but I’m finding it ONLY on IPV6 in netstat. But, I don’t use it so I’m not gonna spend time trouble shooting it. I started it because I didn’t want to give advice without verifying the port 2222 thing. Memory being what it is now daze.