1

I've looked at the related issues but none of them solved my issue.

I'm trying to transfer files via ftp using curl to a server in my dmz from an FTPS server on an EC2 server running vsftpd.

$ curl ftps://ec2-myserver.compute.amazonaws.com --verbose --tlsv1.1
* Rebuilt URL to: ftps://ec2-myserver.us-east-2.compute.amazonaws.com/
*   Trying ip_addr...
* TCP_NODELAY set
* Connected to ec2-myserver.us-east-2.compute.amazonaws.com (ip_addr) port ---- (#0)
* successfully set certificate verify locations:
*   CAfile: /etc/ssl/certs/ca-certificates.crt
  CApath: /etc/ssl/certs
* TLSv1.1 (OUT), TLS handshake, Client hello (1):
* error:1408F10B:SSL routines:ssl3_get_record:wrong version number
* Closing connection 0

I am able to get the files connection FTPS from Filezilla on a windows server.

I am getting the same error in every TLS version.

I've tried enabling ssl3 on the vsfpd server but it didn't solve it.

3
  • If there a reason that you try to enforce TLS 1.1? Do you do the same in Filezilla where it works? What happens if you don't enforce TLS 1.1 in curl? Jan 30, 2020 at 13:45
  • Thanks for your reply. It doesn't work whether I enforce any version of TLS or don't.
    – kroov
    Feb 2, 2020 at 7:04
  • Does this mean that you get the exact same error message when not specifying the TLS version? And did you try Filezilla from exact the same system where you've run curl on? Feb 2, 2020 at 7:28

1 Answer 1

0

I was running vsftpd in chroot configuration, and it was failing silently (because it couldn't access /dev/log in chroot I guess? )

chroot_local_user=YES
local_root=public_html

I would see OK LOGIN in vsftpd.log, but on client after sending username in password it would fail with this error:

client% openssl s_client -connect testftps.example.org:21 --tls1_2 --starttls ftp -quiet
depth=2 C = US, O = Internet Security Research Group, CN = ISRG Root X1
verify return:1
depth=1 C = US, O = Let's Encrypt, CN = R3
verify return:1
depth=0 CN = testftps.example.org
verify return:1
220 Welcome to TEST vsftpd FTPS service.
user ftptest
331 Please specify the password.
pass xxxxxxxx
140419419894912:error:1408F10B:SSL routines:ssl3_get_record:wrong version number:../ssl/record/ssl3_record.c:308:

only did the stracing vsftpd reveal the problem:

server# strace -tt -ff -s500 -p `pidof vsftpd`
[...]
[pid 27164] 18:31:56.249184 access("/", W_OK) = 0
[pid 27164] 18:31:56.249386 fcntl(0, F_GETFL) = 0x2 (flags O_RDWR)
[pid 27164] 18:31:56.249599 fcntl(0, F_SETFL, O_RDWR|O_NONBLOCK) = 0
[pid 27164] 18:31:56.249763 write(0, "500 OOPS: ", 10) = 10
[pid 27164] 18:31:56.250118 write(0, "vsftpd: refusing to run with writable root inside chroot()", 58) = 58
[pid 27164] 18:31:56.250436 write(0, "\r\n", 2) = 2
[pid 27164] 18:31:56.250758 exit_group(2) = ?

so the fix was chmod 500 ~ftptest/public_html, but it could have been anything else, strace was the real problem-finder here.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .