having trouble with ftps ... Explicite over TTL

[stevetim]

All works for ftp, but ftps does not work. Only ftp works on port 21 for the server I need.

on FileZilla the work around is to keep it ftp, but require explicit over TTL, is there a way in AllSky to make this happen also when connecting?

[EricClaeys]

Allsky uses the Linux lftp command for FTP/FTPS. I suspect there's a way but I'm not an lftp guru. Try man lftp > /tmp/lftp at a terminal window, then edit /tmp/lftp to see what the options are. Another possibility is to post this question on the Allsky Facebook group. A lot more people view it there.

If you are paying for web hosting, I'm sure they provide secure FTP, so you could ask them.

[markusd112]

I have the same problem here: my provider (all-inkl.com) offers FTP/FTPS-access for multiple configurable FTP-Users, but ssh-access only for one single ssh-user (that is intended to do the administration of the full webspace via ssh).

My allsky-FTP-user has only access to the dedicated allsky-folder in the htdocs-area of the webspace, so for security reasons I want to use this ftp user to access it, not the ssh-user with fullaccess to everywhere, so switching to SFTP or SCP isn't a solution.

I am not able to connect via lftp via FTPS to my webspace. I get some error:

Fatal error: gnutls_handshake: An unexpected TLS packet was received

Via FTP it works fine. Via WinSCP I can connect via FTPS (ftp with explicit SSL/TLS) without any problem.

Has anybody get it work?

[EricClaeys]

I use ftps with IONOS and it works fine. If you can't get ftps to work, ask your service provider what settings to use.

[markusd112]

Thanks, Eric. I am already in contact with my provider all-inkl.com to solve the problem. Additional I have a test account at IONOS to try it there: it seems, that there isn't a support for FTPS any longer there: if I create a new ftp user in the IONOS backend, the new user is listed with "SFTP" as possible protocol. In the details port tcp/22 has to be used, so it is FTP via SSH, not FTP via explicit SSL.

Are you sure that you use FTPS with your IONOS ftp account to upload, not SFTP? Maybe your contract is older so you have the ability to use FTPS. In my contract only SFTP is available.

[markusd112]

I think, we have found the solution: if you configure the AllSky-FTP-Settings to "ftps", lftp uses FTP via implicite SSL to connect to the server. If you want to use FTP via explicite SSL (which is the up to date mechanism for FTPS) you have to set:
PROTOCOL="ftp"
LFTP_COMMANDS="set ftp:ssl-force yes"
This opens the ftp connection via unencrypted FTP via tcp/21 first and after that it changes to SSL/TLS-encryption via tcp/21.

@update: it seems that lftp switches automatically to FTPeS without any additional LFTP-command, so if you set protocol to "ftp" it uses TLS_AUTH if the server is able to use it. To force lftp only send username and password via SSL encryption, you should add LFTP_COMMANDS="ftp:ssl-force yes" in your ftp-settings.sh file.

Here an example with protocol = ftp and no "ftp:ssl-force yes" settings for my provider:

admin@allsky:~/allsky/scripts $ ./upload.sh test.txt / test.txt
Upload output from 'test.txt:
---- Resolving host address...
buffer: EOF on FD 5
---- 1 address found: xx.xx.xx.xx
---- dns cache hit
---- attempt number 1 (max_retries=2)
---- Connecting to xxxxx.kasserver.com (xx.xx.xx.xx) port 21
<--- 220 FTP on xxxxx.kasserver.com ready
---> FEAT
<--- 211-Features:
<--- AUTH TLS
<--- CCC
<--- CLNT
<--- EPRT
<--- EPSV
<--- HOST
<--- LANG it-IT;ko-KR;en-US;es-ES;zh-TW;fr-FR;ru-RU;bg-BG;ja-JP;zh-CN
<--- MDTM
<--- MFF modify;UNIX.group;UNIX.mode;
<--- MFMT
<--- MLST modify*;perm*;size*;type*;unique*;UNIX.group*;UNIX.groupname*;UNIX.mode*;UNIX.owner*;UNIX.ownername*;
<--- PBSZ
<--- PROT
<--- REST STREAM
<--- SIZE
<--- SSCN
<--- TVFS
<--- UTF8
<--- 211 End
---> AUTH TLS
<--- 234 AUTH TLS successful
GNUTLS: REC[0x123c1d0]: Allocating epoch #0
GNUTLS: added 6 protocols, 29 ciphersuites, 19 sig algos and 10 groups into priority list
---> CLNT lftp/4.8.4
GNUTLS: REC[0x123c1d0]: Allocating epoch #1
GNUTLS: HSK[0x123c1d0]: Adv. version: 3.3
GNUTLS: Keeping ciphersuite 13.02 (GNUTLS_AES_256_GCM_SHA384)
GNUTLS: Keeping ciphersuite 13.03 (GNUTLS_CHACHA20_POLY1305_SHA256)
GNUTLS: Keeping ciphersuite 13.01 (GNUTLS_AES_128_GCM_SHA256)
GNUTLS: Keeping ciphersuite 13.04 (GNUTLS_AES_128_CCM_SHA256)
....etc.....

[EricClaeys]

Glad you got it working.