Custom Query (8174 matches)

Hi,

We are unable to connect Ftp using Require explicit FTP over TLS Encryption below is the ftp log

Status: Connecting to 118.67.248.123:21... Status: Connection established, waiting for welcome message... Response: 220 Serv-U FTP Server v10.4 ready... Command: AUTH TLS Response: 234 AUTH command OK. Initializing SSL connection. Status: Initializing TLS... Status: Verifying certificate... Command: USER tirtira7897TI7663 Status: TLS/SSL connection established. Response: 331 User name okay, need password. Command: PASS Response: 230 User logged in, proceed. Command: SYST Response: 215 UNIX Type: L8 Command: FEAT Response: 211-Extensions supported Response: UTF8 Response: OPTS MODE;MLST;UTF8 Response: CLNT Response: CSID Name; Version; Response: HOST domain Response: SITE PSWD;SET;ZONE;CHMOD;MSG;EXEC;HELP Response: AUTH TLS;SSL;TLS-C;TLS-P; Response: PBSZ Response: PROT Response: CCC Response: SSCN Response: RMDA directoryname Response: DSIZ Response: AVBL Response: EPRT Response: EPSV Response: MODE Z Response: THMB BMP|JPEG|GIF|TIFF|PNG max_width max_height pathname Response: REST STREAM Response: SIZE Response: MDTM Response: MDTM YYYYMMDDHHMMSS[+-TZ];filename Response: MFMT Response: MFCT Response: MFF Create;Modify; Response: XCRC filename;start;end Response: MLST Type*;Size*;Create;Modify*;Perm;Win32.ea;Win32.dt;Win32.dl Response: 211 End (for details use "HELP commmand" where command is the command of interest) Command: CLNT FileZilla Response: 200 Noted. Command: OPTS UTF8 ON Response: 200 OPTS UTF8 is set to ON. Command: PBSZ 0 Response: 200 PBSZ command OK. Protection buffer size set to 0. Command: PROT P Response: 200 PROT command OK. Using private data connection. Command: OPTS MLST type;size;modify;perm; Response: 200 MLST OPTS Type;Size;Modify;Perm; Status: Connected Status: Retrieving directory listing... Command: PWD Response: 257 "/" is current directory. Command: TYPE I Response: 200 Type set to I. Command: PASV Response: 227 Entering Passive Mode (118,67,248,123,195,81) Command: MLSD Response: 150 Opening BINARY mode data connection for MLSD. Response: 426 Data connection unexpectedly closed. Error: Failed to retrieve directory listing

I scanned my local server with nessus and got an interesting warning:

"Synopsis: It may be possible to obtain sensitive information from the remote host with SSL/TLS-enabled services. Description: A vulnerability exists in SSL 3.0 and TLS 1.0 that could allow information disclosure if an attacker intercepts encrypted traffic served from an affected system. TLS 1.1, TLS 1.2, and all cipher suites that do not use CBC mode are not affected. This script tries to establish an SSL/TLS remote connection using an affected SSL version and cipher suite, and then solicits return data. If returned application data is not fragmented with an empty or one-byte record, it is likely vulnerable. OpenSSL uses empty fragments as a countermeasure unless the 'SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS' option is specified when OpenSSL is initialized. Solution: Configure SSL/TLS servers to only use TLS 1.1 or TLS 1.2 if supported.Configure SSL/TLS servers to only support cipher suites that do not use block ciphers. Apply patches if available. See Also: ​http://www.openssl.org/~bodo/tls-cbc.txt ​http://vnhacker.blogspot.com/2011/09/beast.html ​http://technet.microsoft.com/en-us/security/bulletin/ms12-006 ​http://support.microsoft.com/kb/2643584 ​http://blogs.msdn.com/b/kaushal/archive/2012/01/21/fixing-the-beast.aspx "

I am not sure, if this issue is really a security issue. A possible solution should be, to disable TLS 1.0 support. I understand, that this is a compatibility problem, but perhaps you could add an option to disable it. So everybody can decide, if he wants compatibility or more security. I am running Filezilla Server Version 0.9.41 with FTP over SSL/TLS enabled.

I connected with a client to the server and tried to upload a file. The upload didn't start, and it was because the root directory didn't exist on the server anymore. I was expecting that the server would re-create the directory on a upload.