Ошибка выполнения квитирования связи tls an unexpected tls packet was received

Status:	Connecting to 3x.xxx.xxx.91:21...
Status:	Connection established, waiting for welcome message...
Status:	Initializing TLS...
Status:	Verifying certificate...
Status:	TLS connection established.
Status:	Logged in
Status:	Retrieving directory listing...
Status:	Server sent passive reply with unroutable address. Using server address instead.
Command:	MLSD
Error:	GnuTLS error -15: An unexpected TLS packet was received.
Error:	The data connection could not be established: ECONNABORTED - Connection aborted

Hello everyone!
Let me explain the problem: I have a Western Digital NAS where I have activated the FTP protocol. If I use a plain TLS connection (without explicit and implicit TLS) I can connect to the server both locally (192.168.1.5) and remotely (3x.xxx.xxx.91). The moment I activate explicit TLS, it connects without problems locally, while remotely I have this error. Attached I also entered the settings of the NAS of the WD and the ports open in the modem. What could be the problem?

boco wrote: ↑

2020-01-14 11:56

Does it work if you select the «Report external IP in PASV mode?

Did you configure the router correctly? Network Configuration

I have selected the «Report external IP in PASV mode» and entered as the IP address «3x.xxx.xxx.91» (the public IPv4 address of the router). This is the result:

Status:	Connecting to 3x.xxx.xxx.91:21...
Status:	Connection established, waiting for welcome message...
Status:	Initializing TLS...
Status:	Verifying certificate...
Status:	TLS connection established.
Status:	Server does not support non-ASCII characters.
Status:	Logged in
Status:	Retrieving directory listing...
Command:	PWD
Response:	257 "/" is your current location
Command:	TYPE I
Response:	200 TYPE is now 8-bit binary
Command:	PASV
Response:	227 Entering Passive Mode (3x,xxx,xxx,91,234,34)
Command:	MLSD
Error:	GnuTLS error -15: An unexpected TLS packet was received.
Error:	The data connection could not be established: ECONNABORTED - Connection aborted

Attached I enter the settings of the router, NAS and FileZilla Client.

The bottom port forwarding in your router is wrong (the 49153-65534).

«Public door» 49153-65534 is correct, but the local port isn’t. If you cannot enter the same port range as in «Public door», but only a single port, enter the first port of the range (49153) and the router will figure out the rest.

Test again. Note that we have a test facility: https://ftptest.net

boco wrote: ↑

2020-01-14 14:17

The bottom port forwarding in your router is wrong (the 49153-65534).

«Public door» 49153-65534 is correct, but the local port isn’t. If you cannot enter the same port range as in «Public door», but only a single port, enter the first port of the range (49153) and the router will figure out the rest.

Test again. Note that we have a test facility: https://ftptest.net

I changed the port setting:
— local port 49153
— public door 49153-65534

Now I have this error:

Status:	Connecting to 3x.xxx.xxx.91:21...
Status:	Connection established, waiting for welcome message...
Status:	Initializing TLS...
Status:	Verifying certificate...
Status:	TLS connection established.
Status:	Server does not support non-ASCII characters.
Status:	Logged in
Status:	Retrieving directory listing...
Command:	PWD
Response:	257 "/" is your current location
Command:	TYPE I
Response:	200 TYPE is now 8-bit binary
Command:	PASV
Response:	227 Entering Passive Mode (3x,xxx,xxx,91,213,167)
Command:	MLSD
Error:	The data connection could not be established: ECONNREFUSED - Connection refused by server

Instead from the test facility https://ftptest.net:

Status: Resolving address of 3x.xxx.xxx.91
Status: Connecting to 3x.xxx.xxx.91
Warning: The entered address does not resolve to an IPv6 address.
Status: Connected, waiting for welcome message...
Reply: 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------
Reply: 220-You are user number 3 of 10 allowed.
Reply: 220-Local time is now 15:27. Server port: 21.
Reply: 220-IPv6 connections are also welcome on this server.
Reply: 220 You will be disconnected after 10 minutes of inactivity.
Command: CLNT https://ftptest.net on behalf of 3x.xxx.xxx.91
Reply: 530 You aren't logged in
Command: AUTH TLS
Reply: 234 AUTH TLS OK.
Status: Performing TLS handshake...
Status: TLS handshake successful, verifying certificate...
Status: Received 1 certificates from server.
Status: cert[0]: subject='CN=192.168.1.5' issuer='CN=192.168.1.5'
Command: USER xxxx
Reply: 331 User xxxx OK. Password required
Command: PASS ***********
Reply: 230 OK. Current restricted directory is /
Command: SYST
Reply: 215 UNIX Type: L8
Command: FEAT
Reply: 211-Extensions supported:
Reply: EPRT
Reply: IDLE
Reply: MDTM
Reply: SIZE
Reply: REST STREAM
Reply: MLST type*;size*;sizd*;modify*;UNIX.mode*;UNIX.uid*;UNIX.gid*;unique*;
Reply: MLSD
Reply: ESTP
Reply: PASV
Reply: EPSV
Reply: SPSV
Reply: ESTA
Reply: AUTH TLS
Reply: PBSZ
Error: Carriage return without line feed received

Results
Error: Carriage return without line feed received
— The replies sent by your server are violating the FTP specifications.
— You have to upgrade to a proper server.

I decreased the public port range to 65523-65534. Now I can access the folders remotely from FileZilla, but as soon as I try to download a file it gives me this error:

Status:	Connecting to 3x.xxx.xxx.91:21...
Status:	Connection established, waiting for welcome message...
Status:	Initializing TLS...
Status:	Verifying certificate...
Status:	TLS connection established.
Status:	Server does not support non-ASCII characters.
Status:	Logged in
Status:	Retrieving directory listing...
Status:	Directory listing of "/" successful
Status:	Disconnected from server
Status:	Connecting to 3x.xxx.xxx.91:21...
Status:	Connection established, waiting for welcome message...
Status:	Initializing TLS...
Status:	Verifying certificate...
Status:	TLS connection established.
Status:	Server does not support non-ASCII characters.
Status:	Logged in
Status:	Starting download of /D-Russo/Desktop/stampa.bollettino.pagamento_rotated.pdf
Command:	CWD /D-Russo/Desktop
Response:	250 OK. Current directory is /D-Russo/Desktop
Command:	PWD
Response:	257 "/D-Russo/Desktop" is your current location
Command:	TYPE I
Response:	200 TYPE is now 8-bit binary
Command:	PASV
Response:	227 Entering Passive Mode (3x,xxx,xxx,91,255,249)
Command:	RETR stampa.bollettino.pagamento_rotated.pdf
Error:	The data connection could not be established: ECONNREFUSED - Connection refused by server
Error:	Connection timed out after 20 seconds of inactivity
Error:	File transfer failed

Instead with WinSCP I have this error:

Failed to get the folder list
I won't open a connection to 192.168.1.8 (only to 3x.xxx.xxx.91)

I ran into this same issue. Another thread advises against setting allow_writeable_chroot=YES for security reasons, namely to mitigate a «ROARING BEAST ATTACK».

Setting allow_writeable_chroot=YES means that vsftpd should allow the situation where the user’s home directory is writeable by that user. Instead for security reasons I changed the permissions on the user’s root folder from 777 to 555.

Original: drwxrwxrwx /home/ftpuser/

Changed to: dr-xr-xr-x /home/ftpuser/

This made the user’s home directory NOT writeable by the user and thus I didn’t have to use the allow_writeable_chroot=YES parameter. This is fine (and more secure) for my situation as I have a preset directory structure and don’t want the user making new files or directories in their root folder anyways.

I figured this out when I switched the home directory to /var/ftp via the local_root=[path] parameter for vsftpd and it worked without having to set allow_writeable_chroot=YES. This folder /var/ftp is (755) but owned by root and thus not writeable by ftpuser.

answered Sep 6, 2019 at 19:27

Weirdly for me this issue cropped up when trying to ls after logging in.

It turned out to be that I had uninstalled httpd in favour of nginx and the folder I was using was owned apache:apache and the user got removed when I removed httpd.
I chcon‘d the directories to nginx:nginx and then replaced the user in these lines in my config file:

guest_username=nginx
nopriv_user=nginx


Hopefully this helps someone out there because the error messages weren’t helpful at all.

answered Nov 14, 2018 at 13:27

I found so many confusing answers. I will post an

/etc/vsftpd.conf

that worked flawlessly for me in Ubuntu 18.04 using fileZilla as a client on 2019-09-04. The FTPS is deployed in an EC2 instance regulated by a very strict security group that only allows specific public IPS to access.

# FTPS Shim TLS configuration /etc/vsftpd.conf
# Run standalone?  vsftpd can run either from an inetd or as a standalone
# daemon started from an initscript.
# This directive enables listening on IPv6 sockets. By default, listening
# on the IPv6 "any" address (::) will accept connections from both IPv6
# and IPv4 clients. It is not necessary to listen on *both* IPv4 and IPv6
# sockets. If you want that (perhaps because you want to listen on specific
# addresses) then you must run two copies of vsftpd with two configuration
# files.
listen=YES
# Make sure PORT transfer connections originate from port 20 (ftp-data).
connect_from_port_20=NO
listen_port=38250
ftp_data_port=38255
# Allow anonymous FTP? (Disabled by default).
anonymous_enable=NO
# Uncomment this to allow local users to log in.
local_enable=YES
# Default umask for local users is 077. You may wish to change this to 022,
# if your users expect that (022 is used by most other ftpd's)
local_umask=022
# Activate directory messages - messages given to remote users when they
# go into a certain directory.
dirmessage_enable=YES
# If enabled, vsftpd will display directory listings with the time
# in  your  local  time  zone.  The default is to display GMT. The
# times returned by the MDTM FTP command are also affected by this
# option.
use_localtime=YES
# Activate logging of uploads/downloads.
xferlog_enable=YES
# If you want, you can have your log file in standard ftpd xferlog format.
# Note that the default log file location is /var/log/xferlog in this case.
xferlog_std_format=NO
# You may override where the log file goes if you like. The default is shown below.
xferlog_file=/var/log/vsftpd.log
log_ftp_protocol=YES
debug_ssl=YES
# You may change the default value for timing out an idle session.
idle_session_timeout=600
# You may change the default value for timing out a data connection.
data_connection_timeout=120
# You may fully customise the login banner string:
ftpd_banner=Welcome to Read-Only FTPS Shim service.
# You may restrict local users to their home directories.  See the FAQ for
# the possible risks in this before using chroot_local_user or
# chroot_list_enable below.
chroot_local_user=YES
allow_writeable_chroot=YES
# This option should be the name of a directory which is empty.  Also, the
# directory should not be writable by the ftp user. This directory is used
# as a secure chroot() jail at times vsftpd does not require filesystem
# access.
secure_chroot_dir=/var/run/vsftpd/empty
# This string is the name of the PAM service vsftpd will use.
pam_service_name=ftp
# FTPS Passive Mode. -Define port range for passive mode connections
pasv_enable=Yes
pasv_min_port=10100
pasv_max_port=10110
ssl_enable=YES
# force client to use TLS when logging in
allow_anon_ssl=NO
force_local_data_ssl=YES
force_local_logins_ssl=YES
ssl_tlsv1=YES
ssl_sslv2=NO
ssl_sslv3=NO
require_ssl_reuse=NO
ssl_ciphers=HIGH
# specify TSL certificate/private key
rsa_cert_file=/etc/ssl/certs/fullchain.pem
rsa_private_key_file=/etc/ssl/private/privkey.pem
force_local_logins_ssl=YES
force_anon_logins_ssl=YES
# Uncomment this to indicate that vsftpd use a utf8 filesystem.
utf8_filesystem=YES
# Users
userlist_enable=YES
userlist_file=/etc/vsftpd.user_list
userlist_deny=NO

answered Sep 4, 2019 at 3:54

I am running Ubuntu 18.04 LTS on armv7l. I am running git clone inside a proxy (I got the proxy variables set properly), but now I get this;

fatal: unable to access '<my_git>.git/': gnutls_handshake() failed: An unexpected TLS packet was received.

It used to work in Ubuntu 16.04. I have checked this solution but it does not work for me. All I am trying to do is to git clone.

asked Jun 28, 2018 at 17:35

Yu

Ideals are like the stars: we never reach them, but like the mariners of the sea, we chart our course by them.