Dotaz: vsftpd & SSL, error 530

[hyperion]

ahoj,

vsftpd mam zkompilovany s SSL:

emerge -av vsftpd

These are the packages that I would merge, in order:

Calculating dependencies ...done!
[ebuild   R   ] net-ftp/vsftpd-2.0.3-r1  +pam (-selinux) +ssl +tcpd -xinetd 0 kB

Total size of downloads: 0 kB

vytvoril jsem si certifikat (700 na private a 600 na vsftpd.pem):

openssl req -x509 -nodes -newkey rsa:1024 -keyout /etc/ssl/private/vsftpd.pem -out /etc/ssl/private/vsftpd.pem

nastavil vsftpd.conf:

#SSL 2005-11-22
ssl_enable=YES
allow_anon_ssl=NO
force_local_data_ssl=YES
force_local_logins_ssl=YES
ssl_tlsv1=YES
ssl_sslv2=YES
ssl_sslv3=YES
rsa_cert_file=/etc/ssl/private/vsftpd.pem

vystup z Filezilly:

Connecting to xxx.xxx.xxx.xxx:443 ...
Status:	Connected with xxx.xxx.xxx.xxx:443, negotiating SSL connection...
Response:	220 -==============-
Command:	AUTH TLS
Response:	234 Proceed with negotiation.
Status:	SSL connection established. Waiting for welcome message...
Command:	USER ftp
Response:	530 Anonymous sessions may not use encryption.
Error:	Unable to connect!

"Anonymous sessions may not use", pritom se hlasim pomoci uzivatelskeho jmena a hesla..:/

Odpovědi

[jm]

Response: 530 Anonymous sessions may not use encryption.

Co presne je na tom nejasneho? Anonymni uzivatel nema povoleno pouzivat sifrovane pripojeni.

[hyperion]

ale ja mam uzivatele ftp v /etc/passwd a neni anonymni..

[jm]

No, tak prosimte pouzij jineho uzivatele nez ftp.

[hyperion]

ok..ted to vypada na neco jinyho..:

Status:	Connecting to xxx.xxx.xxx.xxx:443 ...
Status:	Connected with xxx.xxx.xxx.xxx:443, negotiating SSL connection...
Response:	220 -==============-
Command:	AUTH TLS
Response:	234 Proceed with negotiation.
Status:	SSL connection established. Waiting for welcome message...
Command:	USER cokoliv
Response:	331 Please specify the password.
Command:	PASS ******
Response:	230 Login successful.
Command:	FEAT
Response:	211-Features:
Response:	 AUTH SSL
Response:	 AUTH TLS
Response:	 EPRT
Response:	 EPSV
Response:	 MDTM
Response:	 PASV
Response:	 PBSZ
Response:	 PROT
Response:	 REST STREAM
Response:	 SIZE
Response:	 TVFS
Response:	211 End
Command:	SYST
Response:	215 UNIX Type: L8
Command:	PBSZ 0
Response:	200 PBSZ set to 0.
Command:	PROT P
Response:	200 PROT now Private.
Status:	Connected
Status:	Retrieving directory listing...
Command:	PWD
Response:	257 "/"
Command:	TYPE A
Response:	200 Switching to ASCII mode.
Command:	PORT 172,21,154,33,16,191
Response:	500 Illegal PORT command.
Error:	Could not retrieve directory listing

[jm]

No, to je problem s firewallem. Pouzij pasivni rezim pripojeni.

[hyperion]

jasne, to me taky mohlo docvaknout..tak tedy (predtim to bez sifrovani fungovalo, jen jsem doconfil SSL):

Status:	Connecting to xxx.xxx.xxx.xxx ...
Status:	Connected with xxx.xxx.xxx.xxx:443, negotiating SSL connection...
Response:	220 -==============-
Command:	AUTH TLS
Response:	234 Proceed with negotiation.
Status:	SSL connection established. Waiting for welcome message...
Command:	USER tomsa
Response:	331 Please specify the password.
Command:	PASS ******
Response:	230 Login successful.
Command:	FEAT
Response:	211-Features:
Response:	 AUTH SSL
Response:	 AUTH TLS
Response:	 EPRT
Response:	 EPSV
Response:	 MDTM
Response:	 PASV
Response:	 PBSZ
Response:	 PROT
Response:	 REST STREAM
Response:	 SIZE
Response:	 TVFS
Response:	211 End
Command:	SYST
Response:	215 UNIX Type: L8
Command:	PBSZ 0
Response:	200 PBSZ set to 0.
Command:	PROT P
Response:	200 PROT now Private.
Status:	Connected
Status:	Retrieving directory listing...
Command:	PWD
Response:	257 "/"
Command:	TYPE A
Response:	200 Switching to ASCII mode.
Command:	PASV
Response:	227 Entering Passive Mode (212,71,169,79,136,254)
Command:	LIST
Error:	Transfer channel can't be opened. Reason: A
 connection attempt failed because the connected party did
 not properly respond after a period of time, or
 established connection failed because connected host has
 failed to respond.
Error:	Could not retrieve directory listing
Command:	TYPE I
Status:	Disconnected from server

[jm]

No, to mas stale problem s firewallem, pro zmenu na druhe strane. Aby bylo jasno - conntrack nefunguje se sifrovanym FTP, ten rozsah portu pro pasivni pripojeni musi byt na firewallu otevreny.

[hyperion]

hmm asi chapu:/ na cilovem FTP je pasivni pripojeni povoleno a rozsah portu pro pasiv povoleno na FW2.

pokud tedy pouziju FTP over TLS: misto A (FW1) -> misto B (FW2), tak musi byt na FW1 povoleny rozsah taky?