Could not spawn process C:\Program Files\FileZilla Server\filezilla-server-impersonator.exe

[lifespeed]

As the subject says, I've been having some difficulty ever since I upgraded from the old server version 0.9.x to 1.7.1

I am unable to list the directory from Filezilla client, even on the same machine as the server, getting the error:

Code: Select all

Could not spawn process C:\Program Files\FileZilla Server\filezilla-server-impersonator.exe

Server logs below:

Code: Select all

<Date/Time> Info [Type] Message
<27-05-2023 20:25:05> FTP Session 8 2601:64x:xxxx:xxxx:xxxx:xxx220:d0a1:1b36 [Command] USER clay
<27-05-2023 20:25:05> FTP Session 8 2601:64x:xxxx:xxxx:xxxx:xxx220:d0a1:1b36 [Response] 331 Please, specify the password.
<27-05-2023 20:25:05> FTP Session 8 2601:64x:xxxx:xxxx:xxxx:xxx220:d0a1:1b36 [Command] PASS ****
<27-05-2023 20:25:05> File-based Authenticator, FTP Session: 8 [Trace] Authenticating user 'clay'. Methods requested: (password). Available methods: [password].
<27-05-2023 20:25:05> File-based Authenticator, FTP Session: 8 [Trace] Auth method password passed for user 'clay'.
<27-05-2023 20:25:05> File-based Authenticator, FTP Session: 8 [Trace] impersonation_token: { username: "", home: "" }
<27-05-2023 20:25:05> File-based Authenticator, FTP Session: 8 [Trace] Authentication for user 'clay' is complete.
<27-05-2023 20:25:05> File-based Authenticator, FTP Session: 8 [Trace] User 'clay' has no filesystem impersonator of its own but a default one for system user 'admin' has been defined.
<27-05-2023 20:25:05> File-based Authenticator, FTP Session: 8 [Trace] impersonation_token: { username: "admin", home: "C:\Users\Admin" }
<27-05-2023 20:25:05> FTP Session 8 2601:64x:xxxx:xxxx:xxxx:xxx220:d0a1:1b36 admin [Response] 230 Login successful.
<27-05-2023 20:25:05> FTP Session 8 2601:64x:xxxx:xxxx:xxxx:xxx220:d0a1:1b36 admin [Command] PWD
<27-05-2023 20:25:05> FTP Session 8 2601:64x:xxxx:xxxx:xxxx:xxx220:d0a1:1b36 admin [Response] 257 "/" is current directory.
<27-05-2023 20:25:20> FTP Session 8 2601:64x:xxxx:xxxx:xxxx:xxx220:d0a1:1b36 admin [Command] CWD android
<27-05-2023 20:25:20> File-based Authenticator/impersonator client, user: admin [Trace] call: no available callers. Let's create one.
<27-05-2023 20:25:20> File-based Authenticator/impersonator client, user: admin/impersonator process [Trace] Token is valid
<27-05-2023 20:25:20> File-based Authenticator/impersonator client, user: admin/impersonator process [Error] Could not spawn process C:\Program Files\FileZilla Server\filezilla-server-impersonator.exe
<27-05-2023 20:25:30> File-based Authenticator/impersonator client, user: admin [Error] Timeout expired.
<27-05-2023 20:25:30> File-based Authenticator/impersonator client, user: admin [Error] Error: Unknown error (138). Closing channel.
<27-05-2023 20:25:30> FTP Session 8 2601:64x:xxxx:xxxx:xxxx:xxx220:d0a1:1b36 admin [Response] 550 Couldn't open the file or directory

And here is what Filezilla client sees:

Code: Select all

Status:	Resolving address of ftp.xxxx.com
Status:	Connecting to [2601:64x:xxxx:xxxx:xxxx:xxx220:d0a1:1b36]:21...
Status:	Connection established, waiting for welcome message...
Status:	Initializing TLS...
Status:	TLS connection established.
Status:	Logged in
Status:	Retrieving directory listing...
Status:	Directory listing of "/" successful
Status:	Retrieving directory listing of "/android"...
Command:	CWD android
Response:	550 Couldn't open the file or directory
Error:	Failed to retrieve directory listing

Any ideas? I think I'm familiar with my pFsense router and windows firewally configuration, and don't really see anything problematic there especially given the connection is made. The configuration is the same since Filezilla server v0.9.x.
I am running Filezilla server as a service, under a and administrator user login, not the usual SERVICES user. Didn't seem to matter either way, as I did run it briefly under SERVICES user with similar problems.

[botg]

Check whether the Windows account the service is running under has the "Replace a process level token" right, you can find it in the group policy editor under Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment

[lifespeed]

Check whether the Windows account the service is running under has the "Replace a process level token" right, you can find it in the group policy editor under Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment

I found the administrator user account which runs Filezilla server service was not listed in the Replace a process level token user list, so I added the user. Afterwards, the error message Could not spawn process C:\Program Files\FileZilla Server\filezilla-server-impersonator.exe went away. The symptom of Filezilla client, run on the same machine running Filezilla server, failing to list a directory after CWD command also went away. So clearly some success here. In fact, if this adjustment of group policy is needed for Filezilla server run under a user account, it might be worth documenting in the PDF manual.

Unfortunately, problems remain. I'm having poor results with CWD and listing directories connecting from outside my network using PASV mode. But that is likely a subject for a new thread, so I'll try and produce appropriate logs and description.

Thanks so much for the help.