Plaintext FTP should be disabled by default

[patch0]

/etc/pure-ftpd/conf/TLS currently appears to be set to 1 which means "Accept both normal sessions and SSL/TLS ones." - my opinion would be that for the next release, we should change this to 2, or even 3. Options are below.

              -Y tls behavior
              -Y 0 (default) disables SSL/TLS security mechanisms.
              -Y 1 Accept both normal sessions and SSL/TLS ones.
              -Y  2  refuses  connections  that  aren't using SSL/TLS security
              mechanisms, including anonymous ones.
              -Y 3 refuses connections  that  aren't  using  SSL/TLS  security
              mechanisms, and refuse cleartext data channels as well.
              The  server  must  have been compiled with SSL/TLS support and a
              valid certificate must be in place to accept encrypted sessions.

Originally reported on Bytemark's Gitlab by @jiphex on 2016-12-22T10:45:27.708Z

[patch0]

Requires SNI/per domain IPs and config to work without random SSL name mismatch warnings.

Originally posted by @patch0 on 2017-02-21T14:17:50.642Z

[patch0]

To use TLS, you must provide a file called /etc/ssl/private/pure-ftpd.pem
with a private key for your host and the related certificate.

The location can be changed at compile-time with the --with-certfile option
passed to ./configure.

wow. SNI does not really seem like an option

Originally posted by @telyn on 2017-03-09T15:32:18.402Z

[patch0]

Subject Alternative Names might be doable though with letsencrypt users - my letsencrypt cert for my home server looks like this:

Subject: CN=git.aetheria.co.uk
X509v3 Subject Alternative Name:
                DNS:docker-registry.git.aetheria.co.uk, DNS:emby.aetheria.co.uk, DNS:firefly.aetheria.co.uk, DNS:git.aetheria.co.uk, DNS:ihatemoney.aetheria.co.uk, DNS:owncloud.aetheria.co.uk, DNS:subsonic.aetheria.co.uk

Originally posted by @telyn on 2017-03-09T15:36:10.696Z

[patch0]

Maybe we could re-survey the landscape of FTP servers?

Originally posted by @patch0 on 2017-03-09T16:00:27.902Z

[patch0]

I wonder if it'd be possible to do something with SFTP chroots these days that would make FTP redundant

Originally posted by @jiphex on 2017-03-09T16:01:19.964Z

[patch0]

I'm not sure there is much we can do with this until SNI comes to the ancient world of FTP.