0

I'm trying to connect to a server that needs TLS using LFTP.

I'm trying in this way, but I get error sslv3 alert when I try to use any command ls, put, pget, etc.

lftp
set ftp:ssl-force true
connect X.X.X.X
X.X.X.X: -> login myuser
Password:
myuser@X.X.X.X:-> pget filename
Fatal error: SSL_Connect: sslv3 alert illegal parameter

How can I fix this? Thanks in advance.

UPDATE 1

I've tried with open ftp://X.X.X.X as below, with the same result. I'm missing some other commands before open command?

$ lftp
lftp :~> open ftp://X.X.X.X
lftp X.X.X.X:~> login admin
Password:
lftp admin@X.X.X.X:~> ls
`ls' at 0 [Connecting...]
`ls' at 0 [Delaying before reconnect: 16]

When I try with Filezilla with option Use explicit FTP over TLS if available or Require explicit FTP over TLS it works and before to enter the password appears this window that mentions TLS 1.2.

enter image description here

Finally, when connects to server shows this log.

Status: Connecting to X.X.X.X:21...
Status: Connection established, waiting for welcome message...
Status: Initializing TLS...
Status: Verifying certificate...
Status: TLS connection established.
Status: Server does not support non-ASCII characters.
Status: Logged in
Status: Retrieving directory listing...
Status: Directory listing of "/" successful

UPDATE 2

This is the log when I try with lftp -d

$ lftp -d
lftp :~> open ftp://AAA.BBB.CCC.DDD
---- Resolving host address...
---- IPv6 is not supported or configuredress...]
---- 1 address found: AAA.BBB.CCC.DDD
lftp AAA.BBB.CCC.DDD:~> login admin
Password:
lftp admin@AAA.BBB.CCC.DDD:~> ls
---- Connecting to AAA.BBB.CCC.DDD (AAA.BBB.CCC.DDD) port 21
<--- 220 ftp server ready.
---> FEAT
<--- 500 Sorry, no such command.
---> AUTH TLS
<--- 234 AUTH command ok; starting SSL connection.
---> USER admin
**** SSL_connect: sslv3 alert illegal parameter
---- Closing control socket
---- Connecting to AAA.BBB.CCC.DDD (AAA.BBB.CCC.DDD) port 21
<--- 220 ftp server ready.
---> FEAT
<--- 500 Sorry, no such command.
---> USER admin
<--- 430 Require auth before enter.
---> QUIT
<--- 221 Have a nice day!
---- Closing control socket
`ls' at 0 [Delaying before reconnect: 12]

UPDATE 3

I try with FTP and LFTP from Cygwin on Windows7 (Here in Windows7 I run Filezilla successfuly).

Cygwin emulator:

$ uname -a
CYGWIN_NT-6.1 user 3.1.5(0.340/5/3) 2020-06-01 08:59 x86_64 Cygwin

user@user ~
$ openssl version
OpenSSL 1.1.1f  31 Mar 2020

I've tried with FTP from CentOS machine.

CentOS:

[root@ServerAbc ~]# openssl version
OpenSSL 1.0.1e-fips 11 Feb 2013
[root@ServerAbc ~]#
[root@ServerAbc ~]# uname -a
Linux ServerAbc 2.6.32-573.3.1.el6.x86_64 #1 SMP Thu Aug 13 22:55:16 UTC 2015 x86_64 x86_64 x86_64 GNU/Linux
[root@ServerAbc ~]# cat /etc/*-release
CentOS release 6.7 (Final)
LSB_VERSION=base-4.0-amd64:base-4.0-noarch:core-4.0-amd64:core-4.0-noarch:graphics-4.0-amd64:graphics-4.0-noarch:printing-4.0-amd64:printing-4.0-noarch

I got this error sending openssl with or without -connect ... in both machines.

user@user ~
$ openssl s_client AAA.BBB.CCC.DDD:21 -starttls ftp </dev/null
s_client: Use -help for summary.

user@user ~
$ openssl -connect s_client AAA.BBB.CCC.DDD:21 -starttls ftp </dev/null
Invalid command '-connect'; type "help" for a list.

user@user ~
$ openssl help
Standard commands
asn1parse         ca                ciphers           cms
crl               crl2pkcs7         dgst              dhparam
dsa               dsaparam          ec                ecparam
enc               engine            errstr            gendsa
genpkey           genrsa            help              list
nseq              ocsp              passwd            pkcs12
pkcs7             pkcs8             pkey              pkeyparam
pkeyutl           prime             rand              rehash
req               rsa               rsautl            s_client
s_server          s_time            sess_id           smime
speed             spkac             srp               storeutl
ts                verify            version           x509

Message Digest commands (see the `dgst' command for more details)
blake2b512        blake2s256        gost              md2
md4               md5               rmd160            sha1
sha224            sha256            sha3-224          sha3-256
sha3-384          sha3-512          sha384            sha512
sha512-224        sha512-256        shake128          shake256
sm3

Cipher commands (see the `enc' command for more details)
aes-128-cbc       aes-128-ecb       aes-192-cbc       aes-192-ecb
aes-256-cbc       aes-256-ecb       aria-128-cbc      aria-128-cfb
aria-128-cfb1     aria-128-cfb8     aria-128-ctr      aria-128-ecb
aria-128-ofb      aria-192-cbc      aria-192-cfb      aria-192-cfb1
aria-192-cfb8     aria-192-ctr      aria-192-ecb      aria-192-ofb
aria-256-cbc      aria-256-cfb      aria-256-cfb1     aria-256-cfb8
aria-256-ctr      aria-256-ecb      aria-256-ofb      base64
bf                bf-cbc            bf-cfb            bf-ecb
bf-ofb            camellia-128-cbc  camellia-128-ecb  camellia-192-cbc
camellia-192-ecb  camellia-256-cbc  camellia-256-ecb  cast
cast-cbc          cast5-cbc         cast5-cfb         cast5-ecb
cast5-ofb         des               des-cbc           des-cfb
des-ecb           des-ede           des-ede-cbc       des-ede-cfb
des-ede-ofb       des-ede3          des-ede3-cbc      des-ede3-cfb
des-ede3-ofb      des-ofb           des3              desx
idea              idea-cbc          idea-cfb          idea-ecb
idea-ofb          rc2               rc2-40-cbc        rc2-64-cbc
rc2-cbc           rc2-cfb           rc2-ecb           rc2-ofb
rc4               rc4-40            rc5               rc5-cbc
rc5-cfb           rc5-ecb           rc5-ofb           seed
seed-cbc          seed-cfb          seed-ecb          seed-ofb
zlib

On Cygwin terminal (Windows7) the lftp version is as below:

$ lftp -v
LFTP | Version 4.9.1 | Copyright (c) 1996-2020 Alexander V. Lukyanov
.
.
.
Libraries used: Expat 2.2.6, idn2 2.2.0, libiconv 1.14, OpenSSL 1.1.1f  31 Mar 2020, Readline 7.0, zlib 1.2.11

UPDATE 4

From Cygwin

User@User ~
$ openssl s_client -connect AAA.BBB.CCC.DDD:21 -starttls ftp </dev/null
CONNECTED(00000004)
34359738384:error:14094417:SSL routines:ssl3_read_bytes:sslv3 alert illegal parameter:ssl/record/rec_layer_s3.c:1543:SSL alert number 47
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 77 bytes and written 313 bytes
Verification: OK
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 0 (ok)
---

From CentOS

[root@ServerC ~]# openssl s_client -connect AAA.BBB.CCC.DDD:21 -starttls ftp </dev/null
CONNECTED(00000003)
depth=0 C = ZZ, O = Xyz, OU = some text, ZZ = 5900283817720ZZ000123.xyz.net
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=0 C = ZZ, O = Xyz, OU = some text, ZZ = 5900283817720ZZ000123.xyz.net
verify error:num=27:certificate not trusted
verify return:1
depth=0 C = ZZ, O = Xyz, OU = some text, ZZ = 5900283817720ZZ000123.xyz.net
verify error:num=21:unable to verify the first certificate
verify return:1
---
Certificate chain
0 s:/C=ZZ/O=Xyz/OU=some text/ZZ=5900283817720ZZ000123.xyz.net
i:/C=ZZ/O=Xyz/OU=some text/ZZ=Xyz Wireless Network Product CA
---
Server certificate
-----BEGIN CERTIFICATE-----
..
..
gTsopEBALpl89bP3EfsakjncRTT
..
..

-----END CERTIFICATE-----
subject=/C=ZZ/O=Xyz/OU=some text/ZZ=5900283817720ZZ000123.xyz.net
issuer=/C=ZZ/O=Xyz/OU=some text/ZZ=Xyz some text CA
---
No client certificate CA names sent
Server Temp Key: ECDH, prime256v1, 256 bits
---
SSL handshake has read 1739 bytes and written 383 bytes
---
New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES256-GCM-SHA384
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : ECDHE-RSA-AES256-GCM-SHA384
    Session-ID: 76BBAC123994626C01C5B8B0B31ADF6EB9EB100C5BF110BD0C90B4C9B96DFC2
    Session-ID-ctx:
    Master-Key: XXXX....
    Key-Arg   : None
    Krb5 Principal: None
    PSK identity: None
    PSK identity hint: None
    Start Time: 1592177053
    Timeout   : 300 (sec)
    Verify return code: 21 (unable to verify the first certificate)
---
220 ftp server ready.
DONE

Remote server settings

Transport Encrypted mode = SSL Encrypted
FTPS server command port = 21
FTPS server source data port = 20
TSL/SSL = SSL 3.0
        = TSL1.0
        = TSL1.1
        = TSL1.2

UPDATE 5

$ openssl x509 -noout -text -in cert.pem
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            ee:00:11:22:...55:21
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = ZZ, O = PPKDKD, OU = Some text, ZZ = PPKDKD Some text CA
        Validity
            Not Before: Dec  1 07:16:13 2017 GMT
            Not After : Nov 27 07:16:13 2032 GMT
        Subject: C = ZZ, O = PPKDKD, OU = Some text, ZZ = 123456789XX000216.PPKDKD.com
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    36:14:...:f8:d7:
                    .
                    .
                    .
                    11:22:...:78:55:
                    c4:33
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                keyid:00:11:....:F1

            X509v3 Certificate Policies:
                Policy: X509v3 Any Policy
                  CPS: http://someurl

            X509v3 Basic Constraints:
                CA:FALSE
            X509v3 CRL Distribution Points:

                Full Name:
                  URI:http://someurl/

            X509v3 Subject Alternative Name:
                DNS:123456789XX000216.PPKDKD.com
            X509v3 Key Usage: critical
                Digital Signature, Non Repudiation, Key Encipherment, Data Encipherment, Key Agreement
            X509v3 Subject Key Identifier:
                81:23:...23:3A
    Signature Algorithm: sha256WithRSAEncryption
         4c:22:...                                      :04:57:
         .
         .
         .
         41:11:22:00
1

From the man page:

ftp:ssl-force (boolean)
if true, refuse to send password in clear when server does not support SSL. Default is false.

So that option isn't going to help you.

You need to tell lftp which of the many supported protocols you wish to use. When you connect with the open command you provide the scheme and host in the <scheme>://<hostname> format. For example: ftp://example.org.

A list of supported schemes is given at the start of the man page.

If you've been successful with Filezilla when using its Use explicit FTP over TLS if available option, then you should use the ftp:// scheme.

The ftps:// scheme is the equivalent of Filezilla's implicit FTP which requires the server to be listening on port 990. This is an older, deprecated method of using TLS.

| improve this answer | |
  • I've save output from CenOS within cert.pem and then I sent the command you suggested from Cygwin. I shared on update 5. – Ger Cas Jun 16 at 7:19
  • 1
    There's nothing wrong with that certificate. You should investigate the FTP server further. What OS, FTP service etc. is it running including versions of crypto libraries. Maybe even run up a VM with the same software to experiment with. Is this a public FTP service? If so, you can add details so that others can test. – garethTheRed Jun 16 at 8:01
  • It is local server with propietary/custom version of linux from some vendor. I'll need to investigate deeper. Thanks a lot for your huge help, support and time. Very appreaciated. – Ger Cas Jun 16 at 8:04
  • If it's a proprietary/custom version then the vendor may well have compiled/configured OpenSSL with defaults that don't work with your version of lftp. Remember that once you get to the bottom of this, add your own answer so that others can benefit from your investigation. At the same time, maybe remove some of the excess info in your question (it's getting quite long) leaving only the parts relevant to your answer, so that it's easier for future readers? Good luck! – garethTheRed Jun 16 at 8:58
1

The **** SSL_connect: sslv3 alert illegal parameter message looks like a local one.

lftp's default SSL/TLS settings might include a reference to SSLv3 (hopefully to disable it!), but the SSL/TLS library lftp is compiled to use may already have removed SSLv3 support completely, so it no longer recognizes the SSLv3 keyword.

If you start lftp and run set -a, what is the current value of the set ssl:priority setting?

If the value includes sslv3, you might want to change the setting so that it won't mention sslv3 at all.

On further research, the error message does come from the local SSL/TLS library, and the presence of ssl_connect indicates that the library in question is OpenSSL. But a google search for "openssl SSL_connect alert illegal parameter" brings up references to old OpenSSL bugs only, related to the server using ciphers and protocol versions not supported by the client.

Your FileZilla test indicates that the server definitely can do TLS 1.2. Perhaps the problem is that the version of OpenSSL your lftp is compiled with is too old to support TLS 1.2?

You might try openssl s_client -connect AAA.BBB.CCC.DDD:21 -starttls ftp </dev/null to see if OpenSSL on that system can successfully negotiate a TLS connection with the FTP server without the influence of lftp. It will normally output a lot of diagnostics; but if it fails before successfully negotiating the SSL/TLS connection, it indicates the OpenSSL version on the system is too old to successfully connect to this FTP/TLS server.

What's the name and version of your operating system?

| improve this answer | |
  • Looks like I got the two options reversed: the command should be openssl s_client -connect .... My mistake. – telcoM Jun 14 at 23:10
  • no problem. Thanks again for the help. I made update 4 in original post with print of openssl ... – Ger Cas Jun 14 at 23:35
  • Centos's OpenSSL seems to negotiate a TLS 1.2 connection successfully, but Cygwin's OpenSSL fails completely. According to the remote server settings, it is willing to use the broken SSL 3.0 if a client asks. Cygwin's lftp and OpenSSL both seem pretty new... perhaps so new that SSL 3.0 support has been completely removed from OpenSSL, and it reacts badly if something still offers that? Try disabling SSL 3.0 from the remote server if at all possible. – telcoM Jun 16 at 12:17
  • Hi, I'm not sure if it is possible to remove SSL 3.0, but in such case would be needed to set SSL 1.0 for example? Or when you say remove it is set SSL to nothing? – Ger Cas Jun 16 at 14:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.