Facebook
TwitterCristiano Winckler
New Pleskian
Hi Guys!
I’m experiencing a very strange problem trying to use Proftp over TLS.
- CentOS Linux release 7.0.1406 (Core)
- PLesk 12.5.30
- psa-proftpd-1.3.5b-cos7.build1205160427.18.x86_64
This is a new installation and the server DOES NOT have a firewall running.
Problem is: FTP transfer works fine if I connect to the server using plain text password (unsecure), but when I try to connect to the server using TLS, the list of directories is never shown and the connection is timed out.
Now, some of you might think this is because the passive ports are not configured, but that´s not the case. Passive ports are configured properly and, as mentioned earlier, firewall is disabled.
PassivePorts 49152 65534
When I look at the “ftp_tls.log”, this is all that’s there:
2016-07-02 09:25:07,739 mod_tls/2.6[17101]: TLS/TLS-C requested, starting TLS handshake
2016-07-02 09:25:33,389 mod_tls/2.6[17129]: TLS/TLS-C requested, starting TLS handshake
2016-07-02 09:55:16,031 mod_tls/2.6[21043]: TLS/TLS-C requested, starting TLS handshake
2016-07-02 09:55:41,687 mod_tls/2.6[21095]: TLS/TLS-C requested, starting TLS handshake
2016-07-02 09:57:50,712 mod_tls/2.6[21258]: TLS/TLS-C requested, starting TLS handshake
So, basically, the connection stops at the handshake for some reason and it´s not completed.
I’ve searched online for some sort of solution or someone that had the same problem, but it seems no one experienced this before.
Anyone have an opinion on what could be causing this?
This is the content of my proftpd.conf
#
# To have more informations about Proftpd configuration
# look at : http://www.proftpd.org/
#
# This is a basic ProFTPD configuration file (rename it to
# 'proftpd.conf' for actual use. It establishes a single server
# and a single anonymous login. It assumes that you have a user/group
# "nobody" and "ftp" for normal operation and anon.
ServerName "ProFTPD"
#ServerType standalone
ServerType inetd
DefaultServer on
<Global>
DefaultRoot ~ psacln
AllowOverwrite on
<IfModule mod_tls.c>
# common settings for all virtual hosts
TLSEngine on
TLSRequired off
TLSLog /var/log/plesk/ftp_tls.log
TLSRSACertificateFile /usr/local/psa/admin/conf/httpsd.pem
TLSRSACertificateKeyFile /usr/local/psa/admin/conf/httpsd.pem
# Authenticate clients that want to use FTP over TLS?
TLSVerifyClient off
# Allow SSL/TLS renegotiations when the client requests them, but
# do not force the renegotations. Some clients do not support
# SSL/TLS renegotiations; when mod_tls forces a renegotiation, these
# clients will close the data connection, or there will be a timeout
# on an idle data connection.
TLSRenegotiate none
# As of ProFTPD 1.3.3rc1, mod_tls only accepts SSL/TLS data connections
# that reuse the SSL session of the control connection, as a security measure.
# Unfortunately, there are some clients (e.g. curl) which do not reuse SSL sessions.
TLSOptions NoSessionReuseRequired
</IfModule>
</Global>
DefaultTransferMode binary
UseFtpUsers on
TimesGMT off
SetEnv TZ :/etc/localtime
# Port 21 is the standard FTP port.
Port 21
# Umask 022 is a good standard umask to prevent new dirs and files
# from being group and world writable.
Umask 022
# To prevent DoS attacks, set the maximum number of child processes
# to 30. If you need to allow more than 30 concurrent connections
# at once, simply increase this value. Note that this ONLY works
# in standalone mode, in inetd mode you should use an inetd server
# that allows you to limit maximum number of processes per service
# (such as xinetd)
MaxInstances 30
#Following part of this config file were generate by PSA automatically
#Any changes in this part will be overwritten by next manipulation
#with Anonymous FTP feature in PSA control panel.
#Include directive should point to place where FTP Virtual Hosts configurations
#preserved
ScoreboardFile /var/run/proftpd.scoreboard
# Primary log file mest be outside of system logrotate province
TransferLog /var/log/plesk/xferlog
#Change default group for new files and directories in vhosts dir to psacln
<Directory /var/www/vhosts>
GroupOwner psacln
</Directory>
# Enable PAM authentication
AuthPAM on
AuthPAMConfig proftpd
IdentLookups off
UseReverseDNS off
UseIPv6 Off
AuthGroupFile /etc/group
Include /etc/proftpd.d/*.conf
I’m experiencing a very strange problem trying to use Proftp over TLS.
- CentOS Linux release 7.0.1406 (Core)
- PLesk 12.5.30
- psa-proftpd-1.3.5b-cos7.build1205160427.18.x86_64
This is a new installation and the server DOES NOT have a firewall running.
Problem is: FTP transfer works fine if I connect to the server using plain text password (unsecure), but when I try to connect to the server using TLS, the list of directories is never shown and the connection is timed out.
Now, some of you might think this is because the passive ports are not configured, but that´s not the case. Passive ports are configured properly and, as mentioned earlier, firewall is disabled.
PassivePorts 49152 65534
When I look at the “ftp_tls.log”, this is all that’s there:
2016-07-02 09:25:07,739 mod_tls/2.6[17101]: TLS/TLS-C requested, starting TLS handshake
2016-07-02 09:25:33,389 mod_tls/2.6[17129]: TLS/TLS-C requested, starting TLS handshake
2016-07-02 09:55:16,031 mod_tls/2.6[21043]: TLS/TLS-C requested, starting TLS handshake
2016-07-02 09:55:41,687 mod_tls/2.6[21095]: TLS/TLS-C requested, starting TLS handshake
2016-07-02 09:57:50,712 mod_tls/2.6[21258]: TLS/TLS-C requested, starting TLS handshake
So, basically, the connection stops at the handshake for some reason and it´s not completed.
I’ve searched online for some sort of solution or someone that had the same problem, but it seems no one experienced this before.
Anyone have an opinion on what could be causing this?
This is the content of my proftpd.conf
#
# To have more informations about Proftpd configuration
# look at : http://www.proftpd.org/
#
# This is a basic ProFTPD configuration file (rename it to
# 'proftpd.conf' for actual use. It establishes a single server
# and a single anonymous login. It assumes that you have a user/group
# "nobody" and "ftp" for normal operation and anon.
ServerName "ProFTPD"
#ServerType standalone
ServerType inetd
DefaultServer on
<Global>
DefaultRoot ~ psacln
AllowOverwrite on
<IfModule mod_tls.c>
# common settings for all virtual hosts
TLSEngine on
TLSRequired off
TLSLog /var/log/plesk/ftp_tls.log
TLSRSACertificateFile /usr/local/psa/admin/conf/httpsd.pem
TLSRSACertificateKeyFile /usr/local/psa/admin/conf/httpsd.pem
# Authenticate clients that want to use FTP over TLS?
TLSVerifyClient off
# Allow SSL/TLS renegotiations when the client requests them, but
# do not force the renegotations. Some clients do not support
# SSL/TLS renegotiations; when mod_tls forces a renegotiation, these
# clients will close the data connection, or there will be a timeout
# on an idle data connection.
TLSRenegotiate none
# As of ProFTPD 1.3.3rc1, mod_tls only accepts SSL/TLS data connections
# that reuse the SSL session of the control connection, as a security measure.
# Unfortunately, there are some clients (e.g. curl) which do not reuse SSL sessions.
TLSOptions NoSessionReuseRequired
</IfModule>
</Global>
DefaultTransferMode binary
UseFtpUsers on
TimesGMT off
SetEnv TZ :/etc/localtime
# Port 21 is the standard FTP port.
Port 21
# Umask 022 is a good standard umask to prevent new dirs and files
# from being group and world writable.
Umask 022
# To prevent DoS attacks, set the maximum number of child processes
# to 30. If you need to allow more than 30 concurrent connections
# at once, simply increase this value. Note that this ONLY works
# in standalone mode, in inetd mode you should use an inetd server
# that allows you to limit maximum number of processes per service
# (such as xinetd)
MaxInstances 30
#Following part of this config file were generate by PSA automatically
#Any changes in this part will be overwritten by next manipulation
#with Anonymous FTP feature in PSA control panel.
#Include directive should point to place where FTP Virtual Hosts configurations
#preserved
ScoreboardFile /var/run/proftpd.scoreboard
# Primary log file mest be outside of system logrotate province
TransferLog /var/log/plesk/xferlog
#Change default group for new files and directories in vhosts dir to psacln
<Directory /var/www/vhosts>
GroupOwner psacln
</Directory>
# Enable PAM authentication
AuthPAM on
AuthPAMConfig proftpd
IdentLookups off
UseReverseDNS off
UseIPv6 Off
AuthGroupFile /etc/group
Include /etc/proftpd.d/*.conf
