FTPS and SVFTPD

salsbo
salsbo
edited March 2014 in SecuritySpy
Hi

I tried to use FTPS with VSFTPD and I can not upload files

the connection is OK, but there is no transfer

the file is uploaded empty

Here is my configuration file:

listen=YES
local_enable=YES
write_enable=YES
local_umask=022
use_localtime=YES
dual_log_enable=YES
xferlog_enable=YES
connect_from_port_20=YES
allow_writeable_chroot=YES
chroot_local_user=YES
chroot_list_enable=NO
anonymous_enable=NO
secure_chroot_dir=/var/run/vsftpd/empty
pam_service_name=vsftpd
ssl_enable=YES
allow_anon_ssl=NO
force_local_data_ssl=NO
force_local_logins_ssl=YES
require_ssl_reuse=YES
ssl_tlsv1=YES
ssl_sslv2=YES
ssl_sslv3=YES
rsa_cert_file=/etc/ssl/private/vsftpd.pem
rsa_private_key_file=/etc/ssl/private/vsftpd.pem
pasv_enable=YES
pasv_promiscuous=NO
pasv_min_port=9000
pasv_max_port=9020
pasv_address=xx.xx.xx.xx
port_promiscuous=NO

I experimented with filezilla and everything is OK

Are there specific parameters for VSFTPD?

With force_local_data_ssl=YES ==> 522 Data connections must be encrypted.
with force_local_data_ssl=NO ==> uploading, creating a empty file on the server and time out

regards

Comments

  • salsbo
    salsbo
    edited March 2014
    the log file :
    Sun Mar 9 21:38:00 2014 [pid 23860] FTP command: Client "xx.xx.xx.xx", "USER securityspy"
    Sun Mar 9 21:38:00 2014 [pid 23860] [securityspy] FTP response: Client "xx.xx.xx.xx", "331 Please specify the password."
    Sun Mar 9 21:38:00 2014 [pid 23860] [securityspy] FTP command: Client "xx.xx.xx.xx", "PASS "
    Sun Mar 9 21:38:00 2014 [pid 23846] [securityspy] OK LOGIN: Client "xx.xx.xx.xx"
    Sun Mar 9 21:38:00 2014 [pid 23870] [securityspy] FTP response: Client "xx.xx.xx.xx", "230 Login successful."
    Sun Mar 9 21:38:01 2014 [pid 23870] [securityspy] FTP command: Client "xx.xx.xx.xx", "TYPE I"
    Sun Mar 9 21:38:01 2014 [pid 23870] [securityspy] FTP response: Client "xx.xx.xx.xx", "200 Switching to Binary mode."
    Sun Mar 9 21:38:01 2014 [pid 23870] [securityspy] FTP command: Client "xx.xx.xx.xx", "CWD /upload"
    Sun Mar 9 21:38:01 2014 [pid 23870] [securityspy] FTP response: Client "xx.xx.xx.xx", "250 Directory successfully changed."
    Sun Mar 9 21:38:01 2014 [pid 23870] [securityspy] FTP command: Client "xx.xx.xx.xx", "PASV"
    Sun Mar 9 21:38:01 2014 [pid 23870] [securityspy] FTP response: Client "xx.xx.xx.xx", "227 Entering Passive Mode (45,875,27,45,45,57)."
    Sun Mar 9 21:38:01 2014 [pid 23870] [securityspy] FTP command: Client "xx.xx.xx.xx", "STOR 09-03-2014_21-36-46_MD_Camra_FaceTime_HD_(intgr.mov"
    Sun Mar 9 21:38:01 2014 [pid 23870] [securityspy] FTP response: Client "xx.xxx.xxx.xx", "522 Data connections must be encrypted."
  • salsbo
    salsbo
    edited March 2014
    or

    Sun Mar 9 21:51:14 2014 [pid 24565] [securityspy] FTP command: Client "xx.xx.xx.xx", "STOR 09-03-2014_21-49-57_MD_Camra_FaceTime_HD_(intgr.mov"
    Sun Mar 9 21:51:14 2014 [pid 24565] [securityspy] FTP response: Client "xx.xx.xx.xx", "150 Ok to send data."
    Sun Mar 9 21:51:54 2014 [pid 24565] [securityspy] OK UPLOAD: Client "xx.xx.xx.xx", "/upload/09-03-2014_21-49-57_MD_Camra_FaceTime_HD_(intgr.mov", 142 bytes, 0.00Kbyte/sec
    Sun Mar 9 21:51:54 2014 [pid 24565] [securityspy] FTP response: Client "xx.xx.xx.xx", "226 Transfer complete."

    ... and nothing : 142 bytes
  • salsbo
    salsbo
    it work in active mode with login SSL and data non SSL
    but it doesn't work in passive mode

    VSFTPD use 9000 to 9020 and i think security spy use other port ???

  • Ben
    Ben
    Hi salsbo,

    Thanks for the detailed information. I'm not immediately sure what could be going on here. When you choose the FTPS option, SecuritySpy will attempt to set up an encrypted connection for both the control connection and the data connection.

    The data connection is separate from the control connection, and the port used for this is decided by the server. It looks like the server uses ports 9000-9020, and this is what SecuritySpy will therefore use.

    Are you sure there is no firewall between the Mac and the server that could be blocking the data connections?
  • salsbo
    salsbo
    hi

    i think there is no pb with the firewall :
    - work fine with filezilla (FTPES)
    - i use policy iptables -p INPUT ACCEPT

    if login & data use SSL, with "force_local_data_ssl=YES" then i have "522 Data connections must be encrypted."

    i will try tonight a TCPDUMP

    thx a lot
  • james
    james
    I had the same problem and got it to work by setting "force_local_data_ssl=NO"

    Why would that be?

    ssl_enable=YES
    rsa_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem
    rsa_private_key_file=/etc/ssl/private/ssl-cert-snakeoil.key
    implicit_ssl=NO
    require_ssl_reuse=NO
    ssl_tlsv1=YES
    ssl_sslv2=YES
    ssl_sslv3=YES
    force_local_data_ssl=NO
    force_local_logins_ssl=YES
  • james
    james
    I spoke too soon. The files are all corrupt and are exactly 142 bytes.
  • heinz
    heinz
    i have exactly the same problem:
    upload with FTP works fine,
    upload with FTPS lasts very much longer and the file is corrupted (180Bytes).

    Info: usually there is a message when accessing my server with FTPS (and with another software): i have to confirm the unknown certificate.

    When secspy uploads a file to a FTPS-Server there is no message concerning the certificate... ?! -maybe this is important to find the error...


    Best Regards,

    Heinz
  • Ben
    Ben
    Hi Heinz,

    By default SecuritySpy will accept any certificate for the secure FTP upload - this is why you don't get the message.

    To test your server configuration, please try uploading a file using some other FTP client software (e.g. Cyberduck) via FTPS (not SFTP as this is a different protocol). Does this work?
  • Ben
    Ben
    luckyluc - are you able to give us temporary FTPS access to your server so that we can test this? This will really help to debug the problem. Thanks.

Categories