Secure FTPS with FileZilla Server: Client-Certificate Authentication, Passive Mode, and Audit Logging

Problem & Takeaway:\nOrganizations that expose FTPS to external partners often struggle to balance security, connectivity, and auditability. The minimal, secure architecture for FileZilla Server that satisfies these constraints uses mutual TLS authentication, passive mode for NAT traversal, and the server’s audit log for compliance. This article shows the exact configuration, checks, and failure modes you need to consider.\n\nRequirements:\n- FileZilla Server 0.9.60 (or later) on a Windows host behind a NAT.\n- Server certificate signed by a trusted CA (or a self-signed cert if you control the CA).\n- Client certificates issued by the same CA, installed on each partner’s FileZilla client.\n- Firewall that can open a dedicated PASV port range.\n- Write access to the server’s audit log directory.\n\nSmallest Suitable Design:\nThe design consists of four logical layers:\n1. Client-Server TLS Layer – Mutual authentication ensures only known clients can connect.\n2. Data-Channel Layer – Passive mode allows the server to accept data connections from behind firewalls.\n3. Audit Layer – Built-in log records all authentication events and file-transfer actions.\n4. Isolation Layer – Per-user virtual directories and permissions prevent cross-user access.\n\nTrust / Data Boundaries:\n- CA Trust Anchor – The CA that signs both server and client certificates must be trusted by all parties.\n- Server Certificate – Exposes the server’s identity; stored in server_cert.pem and server_key.pem.\n- Client Certificate – Stored on each client; used for mutual TLS.\n- Firewall – Only the PASV range and control port (990) are opened; all other ports remain closed.\n\nConfiguration Steps:\n1. Enable FTPS and Require Client Certificates\n In FileZilla Server Interface → Settings → FTP over TLS Settings set:\n Use explicit FTP over TLS (FTPES) on port 990\n Server certificate: \n Server key: \n Require client certificate: Yes\n Allow insecure clients: No\n Export settings to settings.xml and verify the XML contains:\n \n \n \n 1\n 990\n \n2. Configure Passive Mode\n Settings → Passive mode settings:\n Passive mode enabled: Yes\n Passive mode port range: - \n Use IP address of the NAT gateway: \n Verify XML contains:\n \n 1\n \n \n \n \n3. Enable Audit Logging\n Settings → Audit Log:\n Audit log enabled: Yes\n Audit log file: \\audit.log\n Log level: Detailed\n Verify XML contains:\n \n 1\n \\audit.log\n Detailed\n \n4. Firewall Configuration\n Open control port and PASV range on NAT gateway. Example using ufw:\n sudo ufw allow 990/tcp\n sudo ufw allow :/tcp\n Confirm with: sudo ufw status verbose\n\nOperational Checks:\nVerify Mutual TLS\n Use openssl s_client -connect :990 -cert -key -CAfile -starttls ftp\n Expected output: Verify return code: 0 (ok)\n Check server audit log for entry similar to:\n 2026-10-14 19:00:00 - AUTH - User: partner1 - Success - Client cert: CN=Partner1\n\nTest Passive Data Transfer\n From client, initiate a file upload: put /local/path/file.txt /remote/path/file.txt\n On server, verify data channel opens by running: netstat -an | grep LISTEN | grep \n Audit log entry:\n 2026-10-14 19:02:15 - TRANSFER - User: partner1 - Upload - /remote/path/file.txt\n\nAudit Log Integrity\n Ensure log file rotates correctly. Check file size and timestamps after a batch of transfers. Adjust rotation policy if needed.\n\nFailure Modes & Conditions:\n- Client certificate expired → Connection denied → Renew certificate and distribute.\n- Firewall blocks PASV range → Data transfer fails; client sees timeout → Open the range; verify with nmap.\n- Server certificate not trusted → Connection refused → Install CA on client.\n- Audit log disabled → Loss of compliance evidence → Re-enable audit logging in settings.\n\nWhen to Re-evaluate the Design:\n- Partners require anonymous FTP for legacy scripts – current design blocks them.\n- Need SFTP instead of FTPS – FileZilla Server does not provide SFTP; use different server.\n- NAT environment changes (e.g., moving to cloud) – update external IP and firewall rules.\n\nLimitations:\n- No SFTP or FTP over SSL/TLS with session reuse beyond standard FTPS.\n- Client-certificate revocation lists (CRLs) not automatically enforced; manually refresh CA’s CRL on server.\n- Passive mode requires dedicated port range; dynamic NAT may need additional configuration.\n\nPractical Checklist:\n1. Generate and distribute client certificates.\n2. Configure FTPS settings in FileZilla Server.\n3. Set passive mode port range and open it in the firewall.\n4. Enable audit logging and verify rotation.\n5. Perform a test upload and review the audit log.\n\nFollowing this minimal architecture ensures secure, compliant file transfers that work reliably behind NAT while providing a verifiable audit trail.