FileZilla Forums

Welcome to the official discussion forums for FileZilla
Promotion
FileZilla Pro leaderboard
It is currently 2018-01-14 01:18

Unanswered topics | Active topics


» »

All times are UTC



Post new topic  Reply to topic  Page 1 of 4
  [ 57 posts ]  Go to page 1 2 3 4 Next
  Print view Previous topic | Next topic 
Author Message
Technofrood
PostPosted: 2012-01-10 16:25 
Offline
500 Command not understood

Joined: 2012-01-10 16:11
Posts: 3
I use FileZilla to connect to a vsftd (2.0.7) using Require explicit FTP over TLS, this was working fine until an upgrade to 3.5.3, I know get "GnuTLS error -12: A TLS fatal alert has been received." every time I try to connect.

Code:
16:05:15   Status:   Connecting to serverip:21...
16:05:15   Status:   Connection established, waiting for welcome message...
16:05:15   Trace:   CFtpControlSocket::OnReceive()
16:05:15   Response:   220 (vsFTPd 2.0.7)
16:05:15   Trace:   CFtpControlSocket::SendNextCommand()
16:05:15   Command:   AUTH TLS
16:05:15   Trace:   CFtpControlSocket::OnReceive()
16:05:15   Response:   234 Proceed with negotiation.
16:05:15   Status:   Initializing TLS...
16:05:15   Trace:   CTlsSocket::Handshake()
16:05:15   Trace:   CTlsSocket::ContinueHandshake()
16:05:15   Trace:   CTlsSocket::OnSend()
16:05:15   Trace:   CTlsSocket::OnRead()
16:05:15   Trace:   CTlsSocket::ContinueHandshake()
16:05:15   Trace:   CTlsSocket::OnRead()
16:05:15   Trace:   CTlsSocket::ContinueHandshake()
16:05:15   Trace:   CTlsSocket::Failure(-12, 10053)
16:05:15   Trace:   GnuTLS alert 40: Handshake failed
16:05:15   Error:   GnuTLS error -12: A TLS fatal alert has been received.
16:05:15   Trace:   CRealControlSocket::OnClose(10053)
16:05:15   Trace:   CControlSocket::DoClose(64)
16:05:15   Trace:   CFtpControlSocket::ResetOperation(66)
16:05:15   Trace:   CControlSocket::ResetOperation(66)
16:05:15   Error:   Could not connect to server
16:05:15   Trace:   CFileZillaEnginePrivate::ResetOperation(66)


Just tested with WinSCP and that works fine.

I can't see anything going wrong in the server side logs.
Top
   
Reply with quote  
boco
PostPosted: 2012-01-10 17:55 
Offline
Contributor
User avatar

Joined: 2006-05-01 03:28
Posts: 23495
Location: Germany
Yes, it's the same for me. 3.5.3 broke TLS with my servers, too. For the time being, I'm back to 3.5.2.

Quote:
18:53:11 Status: Resolving address of natalya
18:53:11 Status: Connecting to 10.0.0.3:21...
18:53:11 Status: Connection established, waiting for welcome message...
18:53:11 Trace: CFtpControlSocket::OnReceive()
18:53:11 Response: 220-zFTPServer (licensed) v6.0, build 2011-10-18 10:24 ready.
18:53:11 Response: 220-
18:53:11 Response: 220-Hello, 10.0.0.3!
18:53:11 Response: 220-Current date & time: 2012-01-10, 18:53
18:53:11 Response: 220-You are user 1 of 20 allowed.
18:53:11 Response: 220-Currently logged on users: 0
18:53:11 Response: 220-Uploaded/downloaded total: 466.03 GiB up / 1.22 TiB down
18:53:11 Response: 220-
18:53:11 Response: 220 Have fun!
18:53:11 Trace: CFtpControlSocket::SendNextCommand()
18:53:11 Command: AUTH TLS
18:53:11 Trace: CFtpControlSocket::OnReceive()
18:53:11 Response: 234 AUTH Command OK. Initializing SSL
18:53:11 Status: Initializing TLS...
18:53:11 Trace: CTlsSocket::Handshake()
18:53:11 Trace: CTlsSocket::ContinueHandshake()
18:53:11 Trace: CTlsSocket::OnSend()
18:53:11 Trace: CTlsSocket::OnRead()
18:53:11 Trace: CTlsSocket::ContinueHandshake()
18:53:11 Trace: CTlsSocket::OnRead()
18:53:11 Trace: CTlsSocket::ContinueHandshake()
18:53:12 Trace: CTlsSocket::OnRead()
18:53:12 Trace: CTlsSocket::ContinueHandshake()
18:53:12 Trace: CTlsSocket::Failure(-12, 10053)
18:53:12 Trace: GnuTLS alert 47: Illegal parameter
18:53:12 Error: GnuTLS error -12: A TLS fatal alert has been received.
18:53:12 Trace: CRealControlSocket::OnClose(10053)
18:53:12 Trace: CControlSocket::DoClose(64)
18:53:12 Trace: CFtpControlSocket::ResetOperation(66)
18:53:12 Trace: CControlSocket::ResetOperation(66)
18:53:12 Error: Could not connect to server
18:53:12 Trace: CFileZillaEnginePrivate::ResetOperation(66)

_________________
### BEGIN SIGNATURE BLOCK ###
No support requests per PM! You will NOT get any reply!!!
FTP connection problems? Do yourself a favor and read Network Configuration.
All FileZilla products fully support IPv6. http://worldipv6launch.org
### END SIGNATURE BLOCK ###
Top
   
Reply with quote  
matalliac
PostPosted: 2012-01-10 18:49 
Offline
500 Command not understood

Joined: 2012-01-10 18:47
Posts: 1
First name: Lord
Last name: Vader
Also fails for me. We use vsftpd on a linux server. Any clients below 3.5.3 connect fine. I too am reverting back to an older version.
Top
   
Reply with quote  
boco
PostPosted: 2012-01-10 19:39 
Offline
Contributor
User avatar

Joined: 2006-05-01 03:28
Posts: 23495
Location: Germany
@botg: Please disclose exactly what exactly you changed, and the new preconditions for the server TLS components. I will then refer the server devs to this thread, and others can do the same.

I'll stick this thread for a week, for the time being.


Edit: I found a list of ciphers for the server I'm using. Would it be possible none of them works anymore?

Code:
"RSA-RC4-MD5,RSA-3DES-SHA,RSA-AES256-SHA,DH-RSA-3DES-SHA,DHE-RSA-3DES-SHA,DH-ANON-RC4-MD5,RSA-RC4-MD5-EXPORT"


Edit2: FileZilla 3.5.2 negotiated the following cipher with my server:
Code:
Cipher: 3DES-CBC, MAC: SHA1


3DES sounds pretty weak to me...

_________________
### BEGIN SIGNATURE BLOCK ###
No support requests per PM! You will NOT get any reply!!!
FTP connection problems? Do yourself a favor and read Network Configuration.
All FileZilla products fully support IPv6. http://worldipv6launch.org
### END SIGNATURE BLOCK ###
Top
   
Reply with quote  
botg
PostPosted: 2012-01-10 22:45 
Offline
Site Admin
User avatar

Joined: 2004-02-23 20:49
Posts: 30569
First name: Tim
Last name: Kosse
I've removed 3DES from the allowed ciphers, along with the MD5 hash algorithm.

boco wrote:
Edit: I found a list of ciphers for the server I'm using. Would it be possible none of them works anymore?

Code:
"RSA-RC4-MD5,RSA-3DES-SHA,RSA-AES256-SHA,DH-RSA-3DES-SHA,DHE-RSA-3DES-SHA,DH-ANON-RC4-MD5,RSA-RC4-MD5-EXPORT"


All of them are insecure in my opinion. Of the above, only RSA-AES256-SHA has acceptable key strength but still isn't secure as it doesn't offer forward secrecy which is commonly established by performing a Diffie-Hellman key exchange.

You should update to a more modern server.
Top
   
Reply with quote  
Technofrood
PostPosted: 2012-01-11 09:47 
Offline
500 Command not understood

Joined: 2012-01-10 16:11
Posts: 3
It seems my copy of vsftpd is using SSL Cipher DES-CBC3-SHA, is this also not secure and not allowed by FileZilla anymore?
Top
   
Reply with quote  
boco
PostPosted: 2012-01-11 14:25 
Offline
Contributor
User avatar

Joined: 2006-05-01 03:28
Posts: 23495
Location: Germany
If you mean 3DES-CBC-SHA, that one seems to be banned now.

http://svn.filezilla-project.org/filezi ... threv=4384

_________________
### BEGIN SIGNATURE BLOCK ###
No support requests per PM! You will NOT get any reply!!!
FTP connection problems? Do yourself a favor and read Network Configuration.
All FileZilla products fully support IPv6. http://worldipv6launch.org
### END SIGNATURE BLOCK ###
Top
   
Reply with quote  
Technofrood
PostPosted: 2012-01-11 14:45 
Offline
500 Command not understood

Joined: 2012-01-10 16:11
Posts: 3
Just found a sloution for vsftpd, from this thread, I added ssl_ciphers=HIGH to the vsftd.conf and the latest FileZilla can now connect to the FTP server again.
Top
   
Reply with quote  
boco
PostPosted: 2012-01-11 22:16 
Offline
Contributor
User avatar

Joined: 2006-05-01 03:28
Posts: 23495
Location: Germany
This identical text is also in the zFTPServer forum:
------------------------------------------------------------

Solution for zFTPServer Suite users:

1.(A) Shut down the service part of zFTPServer.
2.(A) Open Settings.ini in the zFTPServer directory
3. Go to the [FTPS Ciphers] line. Below are the ciphers zFTP offers for negotiation.
4. Go to the end of the line listing the ciphers, and before the terminal double-quote, add:

[FTPS Ciphers]
"<List of other ciphers>,DHE-RSA-AES256-SHA,DHE-RSA-CAMELLIA256-SHA,DHE-RSA-AES128-SHA,DHE-RSA-CAMELLIA128-SHA"

5. (A) Save the file.
6. (A) Start the service again.

(A) means administrative privileges required.


The next zFTPServer version will likely have these ciphers included by default.

_________________
### BEGIN SIGNATURE BLOCK ###
No support requests per PM! You will NOT get any reply!!!
FTP connection problems? Do yourself a favor and read Network Configuration.
All FileZilla products fully support IPv6. http://worldipv6launch.org
### END SIGNATURE BLOCK ###
Top
   
Reply with quote  
tom_uk
PostPosted: 2012-01-20 14:30 
Offline
500 Command not understood

Joined: 2012-01-20 14:26
Posts: 1
First name: Tom
Last name: Burke
Quote:
Just found a sloution for vsftpd, from this thread, I added ssl_ciphers=HIGH to the vsftd.conf and the latest FileZilla can now connect to the FTP server again.


Thank you for this - I was faced with this problem from one of our customers today and this was the answer.
Top
   
Reply with quote  
xeon
PostPosted: 2012-01-29 22:15 
Offline
226 Transfer OK

Joined: 2009-08-19 03:18
Posts: 116
While I disagree that DES-CBC3-SHA is a "weak" cipher I agree with botg's end decision to remove support for it.

This is mostly for performance reasons 3DES is one of the slowest ciphers around and does nothing but waste cpu cycles compared to superior alternatives.

My preference is always to use RC4-SHA or when possible ECDHE-RSA-RC4-SHA however not much supports ECDHE at the moment and vsftpd doesn't even support regular DHE to begin with much less ECDHE.

Using RC4-SHA in my opinion is the best choice as you get way better performance than any other cipher and it's not CBC based like everything else all while providing plenty enough protection and in some cases even more than alternatives due to it not being vulnerable to CBC based attacks.
Top
   
Reply with quote  
perfup
PostPosted: 2012-01-31 14:41 
Offline
500 Command not understood

Joined: 2012-01-31 14:35
Posts: 1
First name: Santy
Last name: Ram
botg wrote:
I've removed 3DES from the allowed ciphers, along with the MD5 hash algorithm.

boco wrote:
Edit: I found a list of ciphers for the server I'm using. Would it be possible none of them works anymore?

Code:
"RSA-RC4-MD5,RSA-3DES-SHA,RSA-AES256-SHA,DH-RSA-3DES-SHA,DHE-RSA-3DES-SHA,DH-ANON-RC4-MD5,RSA-RC4-MD5-EXPORT"


All of them are insecure in my opinion. Of the above, only RSA-AES256-SHA has acceptable key strength but still isn't secure as it doesn't offer forward secrecy which is commonly established by performing a Diffie-Hellman key exchange.

You should update to a more modern server.


Well... I have 4 friends that are programmers and web developers like me... We all got the same response from FTP servers (private servers). Get the Portable 3.5.2 or another software, we aint upgrading shit.

So, i dont think your gonna get lot of love from ftp servers over the world. Your gonna get back to the 3.5.2 politics or get a lot of people not upgrading or using the older portable version.

And there are a bunch of ppl getting this problem, I thinkg you should reconsider. GL.
I mean, do you really think we get to decide where the client wants his files being uploaded? That we can just say... Update to a more modern server to someone who doesnt even know what a server is?
Top
   
Reply with quote  
kinsei
PostPosted: 2012-02-09 18:41 
Offline
500 Command not understood

Joined: 2012-01-19 16:45
Posts: 3
First name: Tim
Last name: S
xeon wrote:
While I disagree that DES-CBC3-SHA is a "weak" cipher I agree with botg's end decision to remove support for it.

This is mostly for performance reasons 3DES is one of the slowest ciphers around and does nothing but waste cpu cycles compared to superior alternatives.

My preference is always to use RC4-SHA or when possible ECDHE-RSA-RC4-SHA however not much supports ECDHE at the moment and vsftpd doesn't even support regular DHE to begin with much less ECDHE.

Using RC4-SHA in my opinion is the best choice as you get way better performance than any other cipher and it's not CBC based like everything else all while providing plenty enough protection and in some cases even more than alternatives due to it not being vulnerable to CBC based attacks.

This is a silly reason to agree with removing support for the cipher from the client. As long as you have the choice to choose your ciphers, why should you care what ciphers other users of the client prefer? Why do you agree with forcing users to either never upgrade or switch clients if they don't have control over the FTP servers that they are connecting to? What possible benefit does this provide to you personally?

As has been stated several times, this move seems to serve no purpose other than to frustrate users to no end when they cant connect to servers they had been able to connect to forever with this client.

If you want to change behavior, change the default. Don't remove all of the features that you don't like but which others find useful. The code already existed to support this. It would seem to be very easy to implement a checkbox to allow for its continued support while removing it from the program's default installation.

But I guess it's a free program so you can choose to do whatever you like. The irony of that donate button sitting in the top right of the screen is, however, most striking now; and I will be sure to never be fooled into clicking on it again after seeing the way all of the users are ignored in this way. "Yes, please donate to use so we can continue to code our own pet projects without regard for you, the one donating."
Top
   
Reply with quote  
xeon
PostPosted: 2012-02-09 19:39 
Offline
226 Transfer OK

Joined: 2009-08-19 03:18
Posts: 116
kinsei wrote:
xeon wrote:
While I disagree that DES-CBC3-SHA is a "weak" cipher I agree with botg's end decision to remove support for it.

This is mostly for performance reasons 3DES is one of the slowest ciphers around and does nothing but waste cpu cycles compared to superior alternatives.

My preference is always to use RC4-SHA or when possible ECDHE-RSA-RC4-SHA however not much supports ECDHE at the moment and vsftpd doesn't even support regular DHE to begin with much less ECDHE.

Using RC4-SHA in my opinion is the best choice as you get way better performance than any other cipher and it's not CBC based like everything else all while providing plenty enough protection and in some cases even more than alternatives due to it not being vulnerable to CBC based attacks.

This is a silly reason to agree with removing support for the cipher from the client. As long as you have the choice to choose your ciphers, why should you care what ciphers other users of the client prefer? Why do you agree with forcing users to either never upgrade or switch clients if they don't have control over the FTP servers that they are connecting to? What possible benefit does this provide to you personally?

As has been stated several times, this move seems to serve no purpose other than to frustrate users to no end when they cant connect to servers they had been able to connect to forever with this client.

If you want to change behavior, change the default. Don't remove all of the features that you don't like but which others find useful. The code already existed to support this. It would seem to be very easy to implement a checkbox to allow for its continued support while removing it from the program's default installation.

But I guess it's a free program so you can choose to do whatever you like. The irony of that donate button sitting in the top right of the screen is, however, most striking now; and I will be sure to never be fooled into clicking on it again after seeing the way all of the users are ignored in this way. "Yes, please donate to use so we can continue to code our own pet projects without regard for you, the one donating."

I don't see how saving cpu cycles is silly. People who say this don't seem to understand just how much is wasted by using a cipher like 3DES.

If anything needs to be done it's vsftpd's dev needing to change their default cipher to something more efficient such as AES/RC4 or perhaps even multiple ciphers this time.

As for anyone else you have no one but your server admin to blame if they aren't able to take 5-10 seconds out of their day to change the default cipher on their ftp servers.

If an admin can't even do that maybe it's time to find a new host or admin?
Top
   
Reply with quote  
kinsei
PostPosted: 2012-02-10 02:55 
Offline
500 Command not understood

Joined: 2012-01-19 16:45
Posts: 3
First name: Tim
Last name: S
xeon wrote:
I don't see how saving cpu cycles is silly. People who say this don't seem to understand just how much is wasted by using a cipher like 3DES.

If anything needs to be done it's vsftpd's dev needing to change their default cipher to something more efficient such as AES/RC4 or perhaps even multiple ciphers this time.

As for anyone else you have no one but your server admin to blame if they aren't able to take 5-10 seconds out of their day to change the default cipher on their ftp servers.

If an admin can't even do that maybe it's time to find a new host or admin?

I never said saving CPU cycles is silly. But it is silly that you feel the need to save other people's CPU cycles by FORCING them to switch hosts. Who makes you the person who decides what should be more important for us?

Leaving it as an OPTION allows the best of both worlds. Period.

You get what you want and so does everyone else.

I am not going to pay more money to switch to another host so I can use FileZilla's latest client.

Ridiculous.
Top
   
Reply with quote  
Display posts from previous:  Sort by  
Post new topic  Reply to topic  Page 1 of 4
  [ 57 posts ]  Go to page 1 2 3 4 Next

» »

All times are UTC

Who is online

Users browsing this forum: No registered users and 21 guests

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB® Forum Software © phpBB Limited