Creating SFTP

[cPanelDavidG]

Hi cPanelDavidG

We are having this issue with WHM 11.25.0, PureFTPd and a secondary FTP account (we are John_Buehrer's host).

Cyberduck works fine through FTPES, unless there's an empty folder. Browsing an empty folder gives us a "Listing directory failed (I won't open a connection to LOCAL_IP".

Filezilla does not work at all.

I even tried browsing into an empty folder in my testing, unable to generate any errors in my testing. I recommend letting a technical analyst take a look at your server so we can determine the cause of this issue and thus a resolution.

[crazyaboutlinux]

I am unable to replicate this issue with:

- cPanel/WHM server running 11.25.1
- Running FTP Server: ProFTPd
- Then Running FTP Server: PureFTPd
- Using primary FTP account for a cPanel account
- Then using a secondary FTP account for a cPanel account
- FTP Client: CyberDuck on Mac OS with PPC architecture (not Intel) using FTPES

I didn't have any hanging nor delay, everything displayed as it should. The only issue I encountered was just that my test server had a self-signed certificate for FTP and I just needed to authorize it.

Nilesh, I tested using port 21 - you may want to try port 21 instead of port 990.

For everyone else, I recommend having someone take a look at the server logs to see what may be causing this issue.

Dear cPaneldavidG,

I am using Windows XP (intel) & FileZilla FTP client version 3.3.2.1

Server details as below

cPanel 11.25.0-S45750
WHM 11.25.0 - X 3.9
CENTOS 5.5 i686 virtuozzo

And our FTP server is configured with pure-ftpd

Still i am getting an error when i choose FTPS - FTP over implicit TLS/SSL

Status: Waiting to retry...
Status: Resolving address of example.com
Status: Connecting to xxx.xxx.xxx.xx:21...
Status: Connection established, initializing TLS...
Error: Connection timed out
Error: Could not connect to server

And i am not entering port 998 its detecting bydefault but, as you said use port 21 instead of 998 , getting same error on port 21 also.

And if i choose FTPES - FTP over explicit TLS/SSL & Its working with this, there is no issue atoll

Nilesh

[cPanelDavidG]

Dear cPaneldavidG,

I am using Windows XP (intel) & FileZilla FTP client version 3.3.2.1

Server details as below

cPanel 11.25.0-S45750
WHM 11.25.0 - X 3.9
CENTOS 5.5 i686 virtuozzo

And our FTP server is configured with pure-ftpd

Still i am getting an error when i choose FTPS - FTP over implicit TLS/SSL

Status: Waiting to retry...
Status: Resolving address of example.com
Status: Connecting to xxx.xxx.xxx.xx:21...
Status: Connection established, initializing TLS...
Error: Connection timed out
Error: Could not connect to server

And i am not entering port 998 its detecting bydefault but, as you said use port 21 instead of 998 , getting same error on port 21 also.

And if i choose FTPES - FTP over explicit TLS/SSL & Its working with this, there is no issue atoll

Nilesh

Looking at that, it seems the issue is occuring when a TLS connection is trying to be initialized. I was double-checking settings in WHM this morning and found that if you are using Pure-FTPD, there's a setting to disable TLS. I recommend double-checking to ensure TLS is not disabled. This setting is on the FTP Server Configuration screen in the Service Configuration section of WHM.

[cPanelDon]

Please be aware that implicit FTPS and explicit FTPS/FTPES are two different modes of operation for FTPS and, to the best of my knowledge, the implicit mode is deprecated in favor of the explicit mode that is more narrowly referred to as FTPES, versus FTPS that could imply either mode if not verbosely clarified. When configuring the FTP client software, such as FileZilla, please verify to ensure that it is setup to connect using "FTPES - FTP over explicit TLS/SSL".

In FileZilla, selecting "FTPS - FTP over implicit TLS/SSL" will, by default, attempt to connect using the standard port for implicit FTPS, that of TCP port 990; however, a default installation of Pure-FTPd does not operate on port 990 and will not allow implicit FTPS connections unless it is a custom installation that was built using the configure option "--with-implicittls" at compile-time. For clarification, according to the official Pure-FTPd web site and documentation resources the compile-time option "--with-implicittls" is used to build an implicit-FTPS-only server, i.e., one that supports only implicit FTPS and that, I believe, would need to run independently from the Pure-FTPd installation serving plain FTP and explicit FTPS/FTPES.

Regarding ProFTPd, to the best of my knowledge, the default installation and stock FTP virtual host configuration do not operate on TCP port 990; to connect via implicit FTPS the ProFTPd documentation leads me to believe that it would require a custom configuration using a different FTP virtual host that is configured to listen on TCP port 990 serving only implicit SSL (by setting "UseImplicitSSL" via the ProFTPd directive "TLSOptions").

The following are specific resources I used during research of this topic:

• Resources for general reference:
  • ftps - an overview - RFC4217 - state of play
  • draft-murray-auth-ftp-ssl-07 - Securing FTP with TLS - Appendix A (Deprecated SSL negotiation mechanisms)
  • FTPS - Methods of invoking - Wikipedia, the free encyclopedia
• Resources specific to Pure-FTPd:
  • Pure-FTPd - Latest news
    

    Pure-FTPd 1.0.24 has been released.
    Support for building a FTPS (implicit SSL/TLS) server, using with-implicittls

  • http://download.pureftpd.org/pub/pure-ftpd/doc/NEWS
    

    * Version 1.0.23:
    - Support for building a FTPS (implicit SSL/TLS) server, using --with-implicittls

  • http://download.pureftpd.org/pub/pur.../doc/ChangeLog
    

    * Version 1.0.23:
    - New compile-time option: --with-implicittls in order to build a FTPS-only server

  • http://download.pureftpd.org/pub/pure-ftpd/doc/README
    

    ------------------------ ADVANCED COMPILATION ------------------------
    The "./configure" script accepts some arguments you might want to add before the compilation:
    [...]
    --with-implicittls: build a FTPS server (SSL/TLS is implicitely enabled). The protocol is incompatible with FTP and listens to another port by default (port 990, ftps). Never enable this option unless you know what you're doing.

• Resources specific to ProFTPd:
  • ProFTPD Bugzilla - Bug 3266 – Support "implicit" FTPS
  • http://www.proftpd.org/docs/NEWS-1.3.3
    

    1.3.3rc2 - Released 20-Oct-2009
    --------------------------------
    - Bug 3266 - Support "implicit" FTPS.

  • http://www.proftpd.org/docs/RELEASE_NOTES-1.3.3
    

    1.3.3rc2
    ---------
    + Support for "implicit" FTPS. To enable this, use:
    TLSOptions UseImplicitSSL
    
    WARNING: Using this setting will cause mod_tls to handle ALL connections to the vhost as implicit FTPS connections. It is NOT possible to support both plain FTP (or explicit FTPS) clients AND implicit FTPS clients on the same address/port. Therefore this setting should ONLY ever be used in order to support braindead/broken FTPS clients, and then only for as long as it takes to fix/replace those broken clients.
    
    Note that "implicit" FTPS was explicitly DROPPED from the RFC which defines FTP over SSL/TLS; the only clients which use this feature are outdated clients based on older, now-invalidated versions of the specification. Please update your FTPS clients to one which uses explicit FTPS as soon as possible.

  • ProFTPD mini-HOWTO - FTP and SSL/TLS - Implicit FTPS
    

    Question: How come mod_tls does not support "implicit" FTPS (i.e. automatically encrypting sessions on port 990)?
    Answer: The short answer is because the Draft no longer specifies support for such a mode. Here is a description of why the alternatives to the current mode (client-requested encryption using standard control channel) are "bad".
    
    The long answer is covered in Eric Rescorla's excellent book, "SSL and TLS". There tend to be two different strategies used when adding new features to a protocol: separate ports for protocol variants, or upward negotiation. Port 443 for HTTPS is an example of the separate ports strategy. The drawback to the separate ports approach is that there is a finite number of ports available, and so this approach does not scale well. The benefit is that use of separate ports tends to require smaller changes to client and server code. Upward negotiation is more flexible, but requires that the protocol support some sort of feature negotiation or extension discovery, allowing clients and servers to easily agree to negotiate "upward" into a secure channel. The authors of the FTPS Draft felt that upward negotiation was the more appropriate of these two approaches for encrypting FTP channels.
    
    All that said, in ProFTPD 1.3.3rc2, the mod_tls module was enhanced to support implicit FTPS via the UseImplicitSSL TLSOption.

  • ProFTPD module mod_tls - TLSOptions Directive - UseImplicitSSL
    

    TLSOptions
    [...]
    UseImplicitSSL
    
    This option will cause the mod_tls module to handle all connections as if they are SSL connections implicitly; the client does not need to send the AUTH TLS FTP command. This can cause issues for FTPS clients which are expecting explicit FTPS, not implicit FTPS.
    
    Thus if the UseImplicitSSL option is used, you will want to have a separate <VirtualHost> section with a different port number just for those clients which require/expect implicit FTPS.

[crazyaboutlinux]

Looking at that, it seems the issue is occuring when a TLS connection is trying to be initialized. I was double-checking settings in WHM this morning and found that if you are using Pure-FTPD, there's a setting to disable TLS. I recommend double-checking to ensure TLS is not disabled. This setting is on the FTP Server Configuration screen in the Service Configuration section of WHM.

Dear cPanelDavidG,

Yes, we are using Pure-FTPD & i had looked at FTP Server Configuration, The TLS Encryption Support is set to optional.

[Infopro]

Please Note: Important cPanel/WHM Version Number Designation Change

As of July 28, 2010 the cPanel/WHM version number designations have been officially changed.

Version 11.25.1 is now designated 11.28 and version 11.25.2 is now designated 11.30.

These new changes were explained in some detail recently at the July 2010 - Quarterly Road map - Webinar direct from cPanel's PodCast Studio in Houston, Texas with speakers David Grega and Mario Rodriguez.

An official press release about these changes is forthcoming and can be accessed at this link as soon as it's made available to the Forum Team:
Important cPanel/WHM Version Number Designation Change (To be updated)

This post serves to update users who are subscribed to threads (where this message is posted) looking forward to upcoming enhancements in future versions of cPanel.