1. What do I need to run Secure FTP Wrapper?

2. Which clients are supported by Secure FTP Wrapper?

3. Does Secure FTP Wrapper support data encryption?

4. You say Secure FTP Wrapper supports explicit SSL connections, but it's not working for me. What do I have to do to enable this behavior?

5. How do I put Secure FTP Wrapper into a debug mode?

6. Does Secure FTP Wrapper work with Microsoft IIS?

7. How do I make Secure FTP Wrapper work with WS_FTP Pro?

8. I have a certificate signed by Verisign, how do I convert the certificate to a format that will work with Secure FTP Wrapper?

9. How can I put Secure FTP Wrapper behind a (NAT) firewall?

Starting in version 2.5 the Wrapper can be configured to handle an Explicit SSL connection (AUTH SSL). This feature adds support for WS_FTP Pro (7.5) and NetFinder (2.3.2).

To enable this feature, you need to add ExplicitSSLPort=<port> to the ftpswrap.conf configuration file. The value set for ExplicitSSLPort must be different from the value set for DestPort, or DestInterface must be different from the value set for SSLInterface

If at all possible we recommend the following settings:

DestInterface=127.0.0.1
DestPort=21
SSLInterface=<your server's IP>
ExplicitSSLPort=21

We also recommend setting the flag EncryptCommand=1. This option enforces that the "AUTH SSL" command precede the "USER" command which in turn will keep your user's identity secure.

If you are unsure what to do here contact your system administrator.

Converting an RSA private key from PEM to DER format:

openssl pkcs8 -topk8 -nocrypt -outform der -in <priv.pem> -out <priv.pk8>

Converting an RSA public key from PEM to DER format:

openssl x509 -outform der -in <pub.pem> -out <pub.der>

Note: if you were not given the key/ceritifcate in PEM format but instead have it in one pkcs12 file, then first do the following (and then try the above steps again):

Getting an RSA private key in PEM format from a pkcs12 file:

openssl pkcs12 -in <verisign.pfx> -nocerts -nodes -out <priv.pem>

Getting an RSA public key in PEM format from a pkcs12 file:

openssl pkcs12 -in <verisign.pfx> -nokeys -out <pub.pem>

If the request is high enough we can write a CGI that will help in this conversion process.

1. Edit the ftpswrap.conf configuration file and add:

   PassivePortRange=<low port>-<high port>

   We recommend setting a port range of at least 100 avaliable ports (e.g. 3000-3099).

   If you are using NAT, you will also want to add:

   FirewallInterface=<public IP address>


2. Configure your firewall to forward the ports referenced under the PassivePortRange directly to the wrapper. If you cannot configure this on your firewall, the wrapper may not function properly.

3. Finally, configure your firewall to allow for inbound traffic to port 990 (and port 21 if supporting explicit SSL), and outbound traffic from port 989 (and port 20 for explicit SSL).