ServerName			"FTP server"
ServerType			standalone
DefaultServer			on
Port				21
Umask				022
DefaultTransferMode binary

LoadModule mod_tls.c

MaxInstances			30

User				nobody
Group				nobody

IdentLookups		off

AuthOrder mod_auth_file.c mod_auth_pam.c* mod_auth_unix.c
AuthUserFile "/usr/local/apps/proftpd/etc/proftpd.passwd"
AuthGroupFile "/usr/local/apps/proftpd/etc/proftpd.group"

DefaultRoot ~

DebugLevel 9
SystemLog "/var/log/proftpd/proftpd.log"

DelayEngine off

AllowOverwrite		on

<Limit SITE_CHMOD>
  DenyAll
</Limit>

<IfModule mod_tls.c>
    TLSEngine on
    TLSLog /var/log/proftpd/tls.log
    TLSProtocol TLSv1
    TLSOptions AllowPerUser

    # Are clients required to use FTP over TLS when talking to this server?
	# it is possible to force tls only for specified users with TLSOptions AllowPerUser
	# but, it seems that it is currently broken
	# so TLSRequired is off and each users, that needs higher security level
    # should explicitly enable SSL/TLS
    TLSRequired on

    # Server's certificate
    TLSRSACertificateFile /usr/local/apps/proftpd/etc/server.cert.pem
    TLSRSACertificateKeyFile /usr/local/apps/proftpd/etc/server.key.pem

    # CA the server trusts
#    TLSCACertificateFile /etc/ftpd/root.cert.pem

    # Authenticate clients that want to use FTP over TLS?
    TLSVerifyClient on

    # Allow SSL/TLS renegotiations when the client requests them, but
    # do not force the renegotations.  Some clients do not support
    # SSL/TLS renegotiations; when mod_tls forces a renegotiation, these
    # clients will close the data connection, or there will be a timeout
    # on an idle data connection.
#    TLSRenegotiate required off
    TLSRenegotiate none

<Anonymous ~ftp>
  User				ftp
  Group				ftp

#  AnonRequirePassword off
  UserAlias			anonymous ftp

  MaxClients			10

  DisplayLogin			welcome.msg
  DisplayChdir		.message	true

  # uncomment if TLSOptions has ALlowPerUser
  TLSRequired off

#  <Limit WRITE>
#    DenyAll
#  </Limit>
</Anonymous>


</IfModule>