☰

Filezilla 客户端和 VSFTPD：GnuTLS 错误 -12：已收到 TLS 致命警报

tag-icon • tag-icon ftp ftps vsftpd
Filezilla 客户端和 VSFTPD：GnuTLS 错误 -12：已收到 TLS 致命警报

所以现在我正在尝试为 FTP(e)S 配置 vsftpd 服务器。我似乎遇到了不同客户端的问题。Secure FTPD 对我来说很好用。Filezilla 不行。

Filezilla 的输出

tatus:  Connecting to foo:21...
Status: Connection established, waiting for welcome message...
Trace:  CFtpControlSocket::OnReceive() 
Response:   220 "Welcome to FTP!"
Trace:  CFtpControlSocket::SendNextCommand()
Command:    AUTH TLS
Trace:  CFtpControlSocket::OnReceive()
Response:   234 Proceed with negotiation.
Status: Initializing TLS...
Trace:  CTlsSocket::Handshake()
Trace:  CTlsSocket::ContinueHandshake()
Trace:  CTlsSocket::OnSend()
Trace:  CTlsSocket::OnRead()
Trace:  CTlsSocket::ContinueHandshake()
Trace:  CTlsSocket::Failure(-12, 53)
Trace:  GnuTLS alert 40: Handshake failed
Error:  GnuTLS error -12: A TLS fatal alert has been received.

从 vsftpd 粘贴：

# Could be whatever you like, or 990 if you want to use the now-deprecated ftps port.
listen_port=21

# Limit passive ports to this range to assis firewalling
pasv_min_port=30000
pasv_max_port=30003

#May be needed to help packets through some NAT/firewall setups. The address
# is the external ip of the machine, assuming it is a static one.
pasv_address= "foo" ---> we NAT everything so this has the EXTERNAL IP

# Set to ssl_enable=YES if you want to enable SSL
ssl_enable=YES
anon_mkdir_write_enable=NO
anon_root=/srv/ftp
anon_upload_enable=NO
idle_session_timeout=900
log_ftp_protocol=YES
pasv_enable=YES
ssl_sslv2=NO
ssl_sslv3=NO
ssl_tlsv1=YES

# Path to the certificate and key files (which should be the same file)
rsa_cert_file=/etc/vsftpd2.pem
rsa_private_key_file=/etc/vsftpd2.pem

# No ssl for bad boys
#allow_anon_ssl=NO

# All local logins (i.e. non-anonymous) are forced to use ssl.
force_local_data_ssl=NO
#force_local_logins_ssl=YES
#dsa_cert_file=/etc/vsftpd.pem
require_ssl_reuse=NO

所以问题是：这里出了什么问题？顺便说一句：我还不完全确定 ftps 和 ftpEs 之间有什么区别

谢谢

答案1

好的，找到了。显然，最新的 filezilla 3.5 客户端和 ftps 之间存在一些奇怪的行为。

对于 vsftpd，解决方案很简单，在 vsftpd.conf 文件中添加：ssl_ciphers=HIGH

我不确定我是否也被允许发布此内容，但是 filezilla 论坛中存在有关此内容的威胁。

http://forum.filezilla-project.org/viewtopic.php?f=2&t=23280

答案2

如果chroot_local_user=yes使用则ssl_ciphers=HIGH不会起作用。

相关内容