Connection issue after update to 3.10.0.1? Nothing wrong with your host... solution..

[Rygel]

If you're reading this then you've probably run into an issue that currently getting some heated debate here on this form. You're probably running into an issue with connecting to your host via "Explicit FTP over TLS" and maybe you see lines like - Server does not support non-ASCII characters - in your FileZilla connection log.

And you might not enjoy seeing answers like "your host is running broken servers" which is actually pretty ridiculous.

On the contrary - you're probably on a shared host that uses a lot of good security, and they probably have PassivePortRange disabled in Pure-FTPD and they're probably running CSF/LFD firewall suite by ConfigServer which by default does not allow access to the PassivePortRange, and the host probably has SSH / shell access DISABLED for user in a shared hosting environment. ALL OF WHICH ARE *SMART* CHOICES ON THE PART OF YOUR HOST. That is a nicely secured shared hosting environment, and I used those settings by default on my servers as well.

So after I too ran into the initial shock of the change to use Explicit FTP over TLS by default in the new FileZilla and seeing that this is going to be a widely reported issue from people who use my service, I have resolved the issue by making the following changes.

HERE'S WHAT YOU CAN RUN BY YOUR HOST to see if they'll make these simple changes - this is what worked for me on my servers for my users:

(note - these steps need to be performed by a server administrator at your hosting company if you're on a shared hosting service)

1. If your host is running Pure-FTPD (PureFTP) then they should first edit /etc/pure-ftpd.conf and un-comment the PassivePortRange line and set it to something similar to this:

PassivePortRange 30000 35000

Then after they save that change they need to restart Pure-FTPD on the server.

2. If your host is running CSF/LFD firewall from ConfigServer (excellent security product) then they also need to add 30000:35000 to the TCP IN Allowed ports in CSF/LFD ConfigServer Firewall Config.

Then after they save the changes to the config they need to restart CSF/LFD.

NOTE - your host must also make sure that they have PureFTP set to allow BOTH - Plain FTP and also Explicit FTP over TLS.

That's it really - a couple quick steps you can give to your hosting provider to see if they're willing to do them. (Not all will, and that's understandable if they're concerned about opening the extra ports).

So instead of going with the whole "your host is running broken servers" line of thinking...

Your host is most likely working absolutely fine. I KNEW my servers weren't broken and I KNEW they were configured correctly, and frankly I thought some of the responses in the other threads were childish and insulting to point blame at web hosts for a change that should not ever be universal.

Chances are, your host is fine and your server is fine, and they're just running *extra* security which they can tune-down a little if they want to accommodate this setting.

So the above fixes the Explicit TLS thing, but here's something that will occur regardless - the "This Server's certificate is unknown" popup screen when connecting TLS in FileZilla. I've tested this on several servers and domains with *completely valid / current / proper / not expired / not self-signed , actual properly installed valid SSL certificates* and the popup still happens. Again, nothing wrong with the host or the server.

[infinitempg]

Have been getting the update notice and bypassing for a little while but tonight I let it update. As soon as I did when I used my Quick Connect I get this :

Status: Connection established, waiting for welcome message...
Status: Initializing TLS...
Status: Verifying certificate...
Status: TLS connection established.
Status: Server does not support non-ASCII characters.
Status: Connected
Status: Retrieving directory listing...

It sits for a while and then I get :

Command: PWD
Response: 257 "/" is your current location
Command: TYPE I
Response: 200 TYPE is now 8-bit binary
Command: PASV
Response: 227 Entering Passive Mode (173,254,28,57,155,86)
Command: MLSD
Error: Connection timed out
Error: Failed to retrieve directory listing

I cannot log on to the server. AND I am connecting to my hosted service on hoster.example.com, and I seriously doubt they're going to make any changes that a lowly little customer makes. If this is the way the new version is going to stay I will soon be visiting one of the sites that collects old versions and return to the previous version. Can't afford a bunch of haggling with my hosting service nor can I wait until this is resolved.

Sounds like a pretty dangs serious bug in the new version....

[xeon]

What result do you get from the site below?

https://ftptest.net/

[infinitempg]

What result do you get from the site below?
https://ftptest.net/

No time to test, have work to do. Uninstalled the new version, found version 3.1.1.1 and installed it and it works perfectly. If I get the nag screen to update I'm ignoring it next time. I'll check back here and if the new version is patched and fixed I'll install it. And there are 12,751 downloads of that old version and I'd bet that number jumps up pretty quick. http://www.oldversion.com/windows/filezilla-3-1-1-1

Popped out to that site but definitely not warm and cozy putting my host, username and password in there...

[boco]

I'll check back here and if the new version is patched and fixed I'll install it.

Don't hold your breath.

[botg]

Thanks Rygel for the excellent explanation.

I suppose the interpretation of the "server" term is part of the confusion.

Depending on the context, "server" can either mean the FTP daemon, the physical machine the FTP daemon run on, or in the most broad sense, the daemon, the machine and the network in front of it.

So the above fixes the Explicit TLS thing, but here's something that will occur regardless - the "This Server's certificate is unknown" popup screen when connecting TLS in FileZilla. I've tested this on several servers and domains with *completely valid / current / proper / not expired / not self-signed , actual properly installed valid SSL certificates* and the popup still happens. Again, nothing wrong with the host or the server.

That's normal and desired. FileZilla follows the TOFU model of trust.

[ajbird]

for Proftp the directive is

PassivePorts 30000 35000

though opening all those ports explicitly really does not feel right.. not sure which I prefer.. plain txt passwords or a whole bunch of open ports.

[botg]

You could use an FTP server that communicates with the firewall to open ports on-demand.

[alanbeasy]

I don't think it is a reasonable solution to have to contact my host and get them to make the recommended changes.
(I don't have the time anyway)
I have simply rolled back to the previous version (3.9.0.6) and now I have no problem.

Just need to figure out how to stop FileZilla from opening the "new version window" every time I open it.

I have set preferences to never check for updates!

[alanbeasy]

AND...... I have just noted that even with automatic updates set as "NEVER" after deleting the update, when I open FileZilla, it downloads the update anyway. Does anyone know how to stop it doing that?

[alanbeasy]

How to stop FileZilla Automatic Update and Prompt Window

Found the solution myself. Here it is.

1) Find the filezilla.xml in user / AppData / Roaming / Filezilla
2) Save a back up copy and put it somewhere on your desktop (in a new folder).
If you happen to mess up something, you can just put it back and start again - no worries.
2) Open the filezilla.xml file with a text editor such as WordPad.
3) Find the following line: <Setting name="Update Check">0</Setting>
If the value is not '0' change the value '0'
4) Next line: <Setting name="Update Check Interval">0</Setting>
If value is a number such as '7' change the value '0'
5) Find the following lines:
<Setting name="Update Check New Version">nightly 2015-01-24
http://filezilla-project.org/nightlies/ ... _setup.exe 6950896 sha512 828a73b9ef19ae7a6f01a244ed98c2799b4e731b78d00739bd266cfae5563a043d1c02e854f3798545903be9e3641846140c219ccfd7b8203f8273be1c504459 &#x0A;release 3.10.0.2 http://downloads.sourceforge.net/filezi ... -setup.exe 6381120 sha512 f4eba3762d669f442d175f3f16d799da33bd404538e4c9c7c1676c74cafceccfa2851b7bdc77ed9502346bf2667c43814d7af1ef86d82bd25be73e5619c3d561&#x0A;</Setting>
<Setting name="Update Check Check Beta">0</Setting>

Change "nightly" to "never" and delete everything following "never" down to the next </Setting>
<Setting name="Update Check Check Beta">0</Setting>

In other words, delete all this:

2015-01-24
http://filezilla-project.org/nightlies/ ... _setup.exe 6950896 sha512 828a73b9ef19ae7a6f01a244ed98c2799b4e731b78d00739bd266cfae5563a043d1c02e854f3798545903be9e3641846140c219ccfd7b8203f8273be1c504459 &#x0A;release 3.10.0.2 http://downloads.sourceforge.net/filezi ... -setup.exe 6381120 sha512 f4eba3762d669f442d175f3f16d799da33bd404538e4c9c7c1676c74cafceccfa2851b7bdc77ed9502346bf2667c43814d7af1ef86d82bd25be73e5619c3d561&#x0A;

6) Save the file.
7) Go to User / downloads (the default location for update files). Delete the update 3.10.0.1

Now when you open Filezilla, you will not get any update prompt windows.
You can update manually anytime - but I will not be doing so unless there is a real good reason to do so.

[boco]

You can update manually anytime - but I will not be doing so unless there is a real good reason to do so.

Is continued support not a real good reason? All support requests for 3.9.0.6 (or anything older than the latest version, for that matter) will be largely ignored.

[botg]

Using outdated software is never a good idea.

[alanbeasy]

You can update manually anytime - but I will not be doing so unless there is a real good reason to do so.

Is continued support not a real good reason? All support requests for 3.9.0.6 (or anything older than the latest version, for that matter) will be largely ignored.

By the attitude I am reading, the support for the latest version is "largely being ignored" too.
Version 3.9.0.6 was working perfectly for me.
Best idea is not to fix what 'aint broke.

[alanbeasy]

Using outdated software is never a good idea.

But in this case, it was clearly a bad idea to install the update.