# Use standard passive ports
<Global>
  PassivePorts 49152 65535
</Global>

# chroot users into their home by default
DefaultRoot ~

# Enable TLS
<IfModule !mod_tls.c>
  LoadModule mod_tls.c
</IfModule>

TLSEngine                     on
TLSRequired                   off
TLSRSACertificateFile         /etc/ssl/certs/proftpd.crt
TLSRSACertificateKeyFile      /etc/ssl/private/proftpd.key
TLSOptions                    NoSessionReuseRequired
TLSVerifyClient               off
TLSLog                        /var/log/proftpd/tls.log
<IfModule mod_tls_shmcache.c>
  TLSSessionCache             shm:/file=/var/run/proftpd/sesscache
</IfModule>

# VirtualHost for SFTP (FTP over SSH) port
<IfModule !mod_sftp.c>
  LoadModule mod_sftp.c
</IfModule>

<VirtualHost 0.0.0.0>
  SFTPEngine on
  SFTPLog /var/log/proftpd/sftp.log

  # Configure the server to listen on 2222 (openssh owns 22)
  Port 2222

  # Configure the RSA and ECDSA host keys, using the same host key
  # files that OpenSSH uses.
  SFTPHostKey /etc/proftpd/ssh_host_rsa_key
  SFTPHostKey /etc/proftpd/ssh_host_ecdsa_key

  # Configure the file used for comparing authorized public keys of users.
  SFTPAuthorizedUserKeys file:~/.sftp/authorized_keys

  # Enable compression
  SFTPCompression delayed

  # More then FTP max logins, as there are more ways to authenticate
  # using SSH2.
  MaxLoginAttempts 6
</VirtualHost>