summary: FTPS is a mechanism for securing FTP traffic to and from a Plesk server by encrypting FTP connections.

By default, the Plesk FTP server uses explicit FTPS, which is less secure. You can configure it to use the more secure implicit FTPS instead.

In this topic, you will learn how to configure the Plesk FTP server to use implicit FTPS.

Overview

Plain FTP traffic between the Plesk FTP server and the FTP clients can be intercepted and read by a third party. To mitigate this, FTPS encrypts that traffic using an SSL/TLS certificate.

By default, the Plesk FTP server is configured to only support explicit FTPS. This means that connections are only encrypted if the FTP client requests it. The alternative is implicit FTPS, which encrypts all FTP connections by default, and does not allow unencrypted FTP connections.

Switching to implicit FTPS eliminates the chance of FTP traffic being intercepted because of a FTP client misconfiguration or user error.

Enabling Implicit FTPS on Operating Systems Using xinetd

Follow this procedure if your operating system uses the xinetd service. This includes all versions of Debian and Ubuntu, and also earlier versions of Red Hat Enterprise Linux, as well as OSes based on it, such as AlmaLinux, CloudLinux, and CentOS.

To enable implicit FTPS on an OS using xinetd:

  1. Log in to the Plesk server via SSH as the root user, or use the SSH Terminal extension.

  2. Run the following commands:

    touch /etc/xinetd.d/ftps_psa

chmod 0644 /etc/xinetd.d/ftps_psa

  3. Paste the following lines into the /etc/xinetd.d/ftps_psa file:

    service ftps
{
   flags = IPv6
        disable = no
        socket_type = stream
        protocol = tcp
        wait = no
        user = root
        instances = UNLIMITED
        server = /usr/sbin/in.proftpd
        server_args  = -c /etc/proftpd.conf
}

  4. Add the following lines to the /etc/proftpd.conf file, after the </Global> closing tag:

    <IfModule mod_tls.c>
<VirtualHost 0.0.0.0>
    Port 990
    TLSEngine on
    TLSOptions UseImplicitSSL
</VirtualHost>
</IfModule>

  5. Run the service xinetd restart command.

Implicit FTPS service should now be available on the TCP port 990. Make sure that inbound connections to that port are allowed by the firewall.

Enabling Implicit FTPS on Operating Systems Not Using xinetd

Follow this procedure if your operating system does not use the xinetd service. This includes the latest versions of Red Hat Enterprise Linux, as well as OSes based on it, such as AlmaLinux.

To enable implicit FTPS on an OS not using xinetd:

  1. Log in to the Plesk server via SSH as the root user, or use the SSH Terminal extension.

  2. Add the following lines to the /etc/proftpd.conf file, after the </Global> closing tag:

    <IfModule mod_tls.c>
<VirtualHost 0.0.0.0>
    Port 990
    TLSEngine on
    TLSOptions UseImplicitSSL
</VirtualHost>
</IfModule>

  3. In the /usr/lib/systemd/system/proftpd.socket file, replace the line ListenStream=21 with ListenStream=990

  4. Run the systemctl daemon-reload && systemctl restart proftpd.socket command.

Implicit FTPS service should now be available on the TCP port 990. Make sure that inbound connections to that port are allowed by the firewall.