Hello,
I installed pure-ftpd on my machine to use the TLS protocle. I followed the instructions given in: http://www.howtoforge.com/how-to-configure-pureftpd-to-accept-tls-sessions-o... TLS 2
but I still cannot ftp by using ftps (filezilla).
Do I need to configure the firewall to open the port? in firewall-config, I do not see any tls service. However, in system-config-service, I do see 2 service pure-ftpd one saying that it is running and one not running (The pure-ftpd service will be started on demand by the xinetd service and ends when it has nothing more to do.) Is it normal?
Thank for your help.
=========================================================================== Patrick DUPRÉ | | email: pdupre@gmx.com Laboratoire de Physico-Chimie de l'Atmosphère | | Université du Littoral-Côte d'Opale | | Tel. (33)-(0)3 28 23 76 12 | | Fax: 03 28 65 82 44 189A, avenue Maurice Schumann | | 59140 Dunkerque, France ===========================================================================
Am 07.09.2013 00:43, schrieb Patrick Dupre:
I installed pure-ftpd on my machine to use the TLS protocle. I followed the instructions given in: http://www.howtoforge.com/how-to-configure-pureftpd-to-accept-tls-sessions-o...
but I still cannot ftp by using ftps (filezilla)
be explicit - you can not connect or you can not list folders and transfer data http://slacksite.com/other/ftp.html conatins basics about FTP
Do I need to configure the firewall to open the port?
you need to open the passive port-range in the firewall by hand "nf_conntrack_ftp" as any other DPI can not work with encrypted streams
On 09/06/2013 03:43 PM, Patrick Dupre issued this missive:
Hello,
I installed pure-ftpd on my machine to use the TLS protocle. I followed the instructions given in: http://www.howtoforge.com/how-to-configure-pureftpd-to-accept-tls-sessions-o... TLS Â Â Â Â Â Â Â Â 2
but I still cannot ftp by using ftps (filezilla).
Do I need to configure the firewall to open the port? in firewall-config, I do not see any tls service. However, in system-config-service, I do see 2 service pure-ftpd one saying that it is running and one not running (The pure-ftpd service will be started on demand by the xinetd service and ends when it has nothing more to do.) Is it normal?
Yes, you have to modify your firewall configuration. For FTPS, you must allow incoming connections to port TCP port 990. To permit passive FTPS data, then you must also allow incoming TCP connections for a range of ports that the server will use for passive data connections. You must also tell your FTP daemon which ports those are.
I'm not sure how you tell pure-ftpd which ports it can use for passive connections, but in vsftpd they're specified by the "pasv_min_port" and "passv_max_port" variables in the vsftpd.conf file.
My server allow passive FTP/FTPS data over ports 20,000-20,100, so my firewall allows incoming connections for TCP ports 21, 990 and 20000 through 20100. My vsftpd.conf file contains:
passv_min_port=20000 passv_max_port=20100
And away we go. ---------------------------------------------------------------------- - Rick Stevens, Systems Engineer, AllDigital ricks@alldigital.com - - AIM/Skype: therps2 ICQ: 22643734 Yahoo: origrps2 - - - - "How does that damned three seashell thing work?" - - -- Sylvester Stallone, "Demolition Man" - ----------------------------------------------------------------------
On 09/07/2013 05:16 AM, Rick Stevens wrote:
On 09/06/2013 03:43 PM, Patrick Dupre issued this missive:
Hello,
I installed pure-ftpd on my machine to use the TLS protocle. I followed the instructions given in: http://www.howtoforge.com/how-to-configure-pureftpd-to-accept-tls-sessions-o...
TLS Â Â Â Â Â Â Â Â 2
but I still cannot ftp by using ftps (filezilla).
Do I need to configure the firewall to open the port? in firewall-config, I do not see any tls service. However, in system-config-service, I do see 2 service pure-ftpd one saying that it is running and one not running (The pure-ftpd service will be started on demand by the xinetd service and ends when it has nothing more to do.) Is it normal?
Yes, you have to modify your firewall configuration. For FTPS, you must allow incoming connections to port TCP port 990. To permit passive FTPS data, then you must also allow incoming TCP connections for a range of ports that the server will use for passive data connections. You must also tell your FTP daemon which ports those are.
If you are using iptables for firewall, you could use the 'ip_nat_ftp' and 'ip_conntrack_ftp' module if you are behind nat, or 'ip_conntrack_ftp' module alone otherwise, for having the firewall ports dynamically opened on demand. You specify the module to be loaded in '/etc/sysconfig/iptables-config'.
How do you do this with the new 'firewalld' beast ? Learning about that beast is still on my 'To Do' list. :-)
- rejy (rmc)
I'm not sure how you tell pure-ftpd which ports it can use for passive connections, but in vsftpd they're specified by the "pasv_min_port" and "passv_max_port" variables in the vsftpd.conf file.
My server allow passive FTP/FTPS data over ports 20,000-20,100, so my firewall allows incoming connections for TCP ports 21, 990 and 20000 through 20100. My vsftpd.conf file contains:
passv_min_port=20000 passv_max_port=20100And away we go.
- Rick Stevens, Systems Engineer, AllDigital ricks@alldigital.com -
- AIM/Skype: therps2 ICQ: 22643734 Yahoo: origrps2 -
-"How does that damned three seashell thing work?" --- Sylvester Stallone, "Demolition Man" -
Am 07.09.2013 08:38, schrieb Rejy M Cyriac:
If you are using iptables for firewall, you could use the 'ip_nat_ftp' and 'ip_conntrack_ftp' module if you are behind nat, or 'ip_conntrack_ftp' module alone otherwise, for having the firewall ports dynamically opened on demand. You specify the module to be loaded in '/etc/sysconfig/iptables-config'
did you read the subject? did you try it?
as i have alreday said: 'ip_conntrack_ftp' does *not* work with encrypted connections
why? because it hardly can read the answer which port was negotiated for ftp-data you may try it, been there done that
On 09/07/2013 12:28 PM, Reindl Harald wrote:
Am 07.09.2013 08:38, schrieb Rejy M Cyriac:
If you are using iptables for firewall, you could use the 'ip_nat_ftp' and 'ip_conntrack_ftp' module if you are behind nat, or 'ip_conntrack_ftp' module alone otherwise, for having the firewall ports dynamically opened on demand. You specify the module to be loaded in '/etc/sysconfig/iptables-config'
did you read the subject? did you try it?
Have tried ftp in general, not ftps specifically.
as i have alreday said: 'ip_conntrack_ftp' does *not* work with encrypted connections
Sorry, missed that. This is new information to me. Adding to my ever-growing 'To Do' list to check.
- rejy (rmc)
why? because it hardly can read the answer which port was negotiated for ftp-data you may try it, been there done that
-
Patrick Dupre -
Reindl Harald -
Rejy M Cyriac -
Rick Stevens