How to make ftp connections to FZ server most secure?

Message

fabianus · #1 Post by **fabianus** » 2006-05-21 10:29

Hello !

As I do not know much about networks, ftp, etc. I would be verythankfull if someone could give me some hints how to make ftp - transfers most secure when using FileZilla server.

Regards,
Fabian

#2 Post by **botg** » 2006-05-21 11:57

Enable SSL, enable "Force PROT P" and remove the general FTP port (21).

fabianus · #3 Post by **fabianus** » 2006-05-21 16:27

Hi botg,

Thanks for the advice. So I did this and had these problems :

Status: Connecting to 8.XXX.XX.XX ...
Status: Connected with 8.XXX.XXX.XX . Waiting for welcome message...
Response: 220-FileZilla Server version 0.9.16c beta
Response: 220-written by Tim Kosse (Tim.Kosse@gmx.de)
Response: 220 Please visit http://sourceforge.net/projects/filezilla/
Command: USER xxx
Response: 331 Password required for xxx
Command: PASS ********
Response: 230 Logged on
Command: FEAT
Response: 211-Features:
Response: MDTM
Response: REST STREAM
Response: SIZE
Response: MLST type*;size*;modify*;
Response: UTF8
Response: CLNT
Response: 211 End
Command: CLNT FileZilla
Response: 200 Don't care
Command: OPTS UTF8 ON
Response: 200 UTF8 mode enabled
Command: SYST
Response: 215 UNIX emulated by FileZilla
Status: Connected
Status: Retrieving directory listing...
Command: PWD
Response: 257 "/" is current directory.
Command: TYPE A
Response: 200 Type set to A
Command: PASV
Response: 227 Entering Passive Mode (8,XXX,XXX,XXX,9,43)
Command: LIST
Response: 425 Can't open data connection.
Error: Could not retrieve directory listing
Command: TYPE I
Response: 200 Type set to I
Command: PWD
Response: 257 "/" is current directory.
Command: PWD
Response: 257 "/" is current directory.
Command: TYPE A
Response: 200 Type set to A
Response: 421 No-transfer-time exceeded. Closing control connection.
Error: Disconnected from server
Status: Waiting to retry... (5 retries left)
Status: Connecting to 8.XXX.XXX.XX...
Status: Connected with 8.XXX.XXX.XX. Waiting for welcome message...
Response: 220-FileZilla Server version 0.9.16c beta
Response: 220-written by Tim Kosse (Tim.Kosse@gmx.de)
Response: 220 Please visit http://sourceforge.net/projects/filezilla/
Command: USER fvb
Response: 331 Password required for fvb
Command: PASS ********
Response: 230 Logged on
Command: FEAT
Response: 211-Features:
Response: MDTM
Response: REST STREAM
Response: SIZE
Response: MLST type*;size*;modify*;
Response: UTF8
Response: CLNT
Response: 211 End
Command: CLNT FileZilla
Response: 200 Don't care
Command: OPTS UTF8 ON
Response: 200 UTF8 mode enabled
Command: SYST
Response: 215 UNIX emulated by FileZilla
Status: Connected
Status: Retrieving directory listing...
Command: PWD
Response: 257 "/" is current directory.
Command: TYPE A
Response: 200 Type set to A
Command: PASV
Response: 227 Entering Passive Mode (8,XXX,XXX,XXX,9,48)
Command: LIST
Response: 425 Can't open data connection.
Error: Could not retrieve directory listing
Command: REST 0
Response: 350 Rest supported. Restarting at 0
Command: REST 0
Response: 350 Rest supported. Restarting at 0
Command: TYPE I
Response: 200 Type set to I
Response: 421 No-transfer-time exceeded. Closing control connection.
Error: Disconnected from server
Status: Waiting to retry... (4 retries left)

etc.

As ftp client I use the FileZilla client.

Thank you very much for any help to get this to work - if possible !

By the way, I did not understand what you mean by "remove the general FTP port (21).

Regards,
Fabian

#4 Post by **botg** » 2006-05-21 18:41

Well you are still connecting using normal unencrypted FTP. If you leave the FTP port edit box empty, unencrypted connections won't be possible anymore .

#5 Post by **boco** » 2006-05-21 19:51

botg wrote:Well you are still connecting using normal unencrypted FTP. If you leave the FTP port edit box empty, unencrypted connections won't be possible anymore .

Do you mean the port edit box in the FZS Interface? If I leave it empty, I get this:

Code: Select all

Failed to create a listen socket on any of the specified ports. Server is not online!

boco

#6 Post by **botg** » 2006-05-21 22:59

boco, you only get that message if both the standard FTP ports are unset and the SSL port is disabled.

#7 Post by **boco** » 2006-05-22 01:12

No, FTP port is enabled and listens on port 999 (can't use 990 because of MS Active Sync using the same).

If I disable the standard FTP port (21) and leave SSL (999) intact, I get that message. I just double-checked to be shure, no go.

boco

#8 Post by **botg** » 2006-05-22 09:18

Then it's a bug, I'll have a look.

fabianus · #9 Post by **fabianus** » 2006-06-15 09:20

Hello,

finally I got it to work. This is the connection protocoll, could you just have a brief look at it to be sure that the connection is 100% secure now?

Thank you very much!

Regards,
Fabian

SmartFTP v1.5.990.26
Resolving host name "ftp.mydomain.net"
Connecting to 8.8.xxx.xxx Port: 21
Connected to ftp.mydomain.net.
220 ----
AUTH TLS
234 Using authentication type TLS
Connected. Exchanging encryption keys...
Session Cipher: 128 bit RC4
TLS encrypted session established.
PBSZ 0
200 PBSZ=0
USER xxx
331 Password required for xxx
PASS (hidden)
230 Logged on
SYST
215 UNIX emulated by FileZilla
FEAT
211-Features:
MDTM
REST STREAM
SIZE
MLST type*;size*;modify*;
AUTH SSL
AUTH TLS
UTF8
CLNT
211 End
CLNT SmartFTP 1.5.990
200 Don't care
OPTS UTF8 ON
200 UTF8 mode enabled
PWD
257 "/" is current directory.
TYPE I
200 Type set to I
PROT P
200 Protection level set to P
PASV
227 Entering Passive Mode (8,8,xxx,xxx,4,2)
Opening data connection to 8.8.xxx.xxxPort: 1026
MLSD
Connected. Exchanging encryption keys...
150 Connection accepted
Session Cipher: 128 bit RC4
TLS encrypted session established.
374 bytes transferred. (174 bytes/s) (00:00:02)
226 Transfer OK

#10 Post by **boco** » 2006-06-15 13:45

Code: Select all

AUTH TLS
234 Using authentication type TLS
Connected. Exchanging encryption keys...
Session Cipher: 128 bit RC4
TLS encrypted session established.
PBSZ 0
200 PBSZ=0

Code: Select all

 PROT P
200 Protection level set to P

Code: Select all

MLSD
Connected. Exchanging encryption keys...
150 Connection accepted
Session Cipher: 128 bit RC4
TLS encrypted session established.
374 bytes transferred. (174 bytes/s) (00:00:02)
226 Transfer OK

Excellent!

That should work. If you get the directory listing, all is fine. Test a data transfer as well!

boco