SSL Questions

Hello,

I apologize for the redundancy of this. I have spent so much time reading FAQs, Googling and forum posts that I'm about to give up. The frustration stems from this being my first attempt at securing an FTP connection. I thank you in advance for patience, understanding and assistance.

I'll try to keep it simple:

• I set up a GeneF6 FTP server and it works fine using authentication, IP address restrictions, unencrypted FTP access, etc.
• I created a key set within Gene6, but am unclear if I am supposed to copy them to the client computer and import them?
• I have the latest build of SmartFTP installed.
• Normal FTP works fine (PASV and PORT). The server's IP binding is configured as "Regular FTP Session, allow explicit SSL" over port 21. This mode accepts both encrypted and unencrypted sessions. My ultimate goal is to only accept explicit connections.
• When enabling "FTP over SSL (explicit) in SmartFTP, I can't get a directory listing. I've tried switching port modes from PASV to PORT, configuring my router to port-forward all ports from 21 - 65534 and shutting down my firewall. Switching the server/client back to unencrypted works fine.

Can someone help me figure out how to get explicit SSL working? The computer hosting Gene6 FTP is a Win2k SP4 workstation.

Here's the log from SmartFTP:

[11:26:30] SmartFTP v2.5.1006.26
[11:26:30] Resolving host name "xxx.xxx.xxx.xxx"
[11:26:30] Connecting to xxx.xxx.xxx.xxx Port: 21
[11:26:30] Connected to xxx.xxx.xxx.xxx.
[11:26:35] 220 Gene6 FTP Server v3.10.0 (Build 2) ready...
[11:26:35] AUTH TLS
[11:26:35] 234 AUTH command ok; starting SSL connection.
[11:26:35] Connected. Exchanging encryption keys...
[11:26:35] Session Cipher: 128 bit RC4
[11:26:35] TLS encrypted session established.
[11:26:35] PBSZ 0
[11:26:35] 200 PBSZ=0
[11:26:35] USER johnsmith
[11:26:35] 331 Password required for johnsmith.
[11:26:35] PASS (hidden)
[11:26:36] 230 Home FTP ServerUser johnsmith logged in.
[11:26:36] SYST
[11:26:36] 215 UNIX Type: L8
[11:26:36] Detected Server Type: UNIX
[11:26:36] FEAT
[11:26:36] 211-Extensions supported:
[11:26:36] AUTH TLS
[11:26:36] CCC
[11:26:36] CLNT
[11:26:36] CPSV
[11:26:36] EPRT
[11:26:36] EPSV
[11:26:36] MDTM
[11:26:36] MFCT
[11:26:36] MFMT
[11:26:36] MLST type*;size*;create;modify*;
[11:26:36] MODE Z
[11:26:36] PASV
[11:26:36] PBSZ
[11:26:36] PROT
[11:26:36] REST STREAM
[11:26:36] SIZE
[11:26:36] SSCN
[11:26:36] TVFS
[11:26:36] UTF8
[11:26:36] XCRC "filename" SP EP
[11:26:36] XMD5 "filename" SP EP
[11:26:36] XSHA1 "filename" SP EP
[11:26:36] 211 End.
[11:26:36] Detected Server Software: Gene6 FTP Server 3.x
[11:26:36] CLNT SmartFTP 2.5.1006
[11:26:36] 200 Noted.
[11:26:36] OPTS UTF8 ON
[11:26:36] 200 UTF8 OPTS ON
[11:26:36] PWD
[11:26:37] 257 "/" is current directory.
[11:26:37] TYPE A
[11:26:37] 200 Type set to A.
[11:26:37] MODE Z
[11:26:37] 200 Mode Z ok.
[11:26:37] PROT P
[11:26:37] 200 PROT command successful.
[11:26:37] PASV
[11:26:37] 227 Entering Passive Mode (192,168,1,150,253,49)
[11:26:37] Opening data connection to 192.168.1.150 Port: 64817
[11:26:37] MLSD
[11:26:58] A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond.
[11:27:07] 425 Cannot open data connection.
[11:27:07] Automatic failover of data connection mode from "Passive Mode (PASV)" to "Active Mode (PORT)".
[11:27:07] PORT 10,144,48,40,9,35
[11:27:07] 200 Port command successful.
[11:27:07] MLSD
[11:27:28] 425 Cannot open data connection.
[11:27:59] NOOP
[11:27:59] 200 NOOP command successful.


Any help will be much appreciated. Thanks in advance.

Kind regards,

Jeff

Hello ..

Try the following. Go to the favorite settings then FTP->Connection and enable "Force PASV IP".

You may want to install the latest version of SmartFTP as well.
https://www.smartftp.com/download

Regards
Mat

Thanks Matt. Unfortunately, the results were the same -- with the exception that it didn't roll to active mode. It gets to the command "MLSD" and a "425 Cannot open data connection" results (after a timeout period). Any other ideas?

My bad on the SFTP version. I downloaded it and forgot to install it (duh!). It has been updated to 2.5.1008.11. I can post the log again if you need it. Should other ports besides 21-22 be port-forwarded in my router? Encryption seems to be working per the log, so I'm lost at this point. Any other ideas?

Best Regards,

Jeff

You have to specify a port range on the FTP server:
1. Setup port range in Gene6 (e.g. 50'000 -> 50'100)
2. Open the port range in the firewall where the FTP server is located. You may need to forward these ports to the FTP server's internal address.

Then try again.
Regards,
Mat

Matt,

You are the man! That last post was the nudge I needed. Implicit and explicit (only) access are now working.
Thanks much for your quick and excellent responses!

Jeff