Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Situation: a client with an AIX machine can't connect properly to a Windows 2003 Server running FTP server Serv-U FTP Server v10.2. Plain FTP works. SFTP is not working.

It's not clear where the error is, whether this is an issue on the FTP client or server side. They are connecting with an ftp binary that has a -s flag option.

Here's what they see on their side:

$ ftp -s -D 900 ftp.example.com
Connected to XX.XXX.XX.XXX.
220 Serv-U FTP Server v10.2 ready...
234 AUTH command OK. Initializing SSL connection.
TLS Auth Entered.

ERROR  Error during the hand shake for the control connection
ERROR  Error setting BIO object for the control connection
FTP: Unable to authenticate to Server.

Using a FreeBSD machine, I was trying to see if I could evaluate what might be happening, so what I tried was running curl as below, and also using curl inside PHP, and I get a sense that it's possible there's an issue with SSL certificates on the Windows server. But then other folks have been able to connect from other machines using SFTP without issue, so it's hard to say where the problem is.

Here's a curl command and the output error I get from a FreeBSD machine outside the network:

curl --ftp-ssl ftp://ftp.example.com

The result is:

curl: (60) SSL certificate problem, verify that the CA cert is OK. Details:
error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
More details here: http://curl.haxx.se/docs/sslcerts.html

curl performs SSL certificate verification by default, using a "bundle"
 of Certificate Authority (CA) public keys (CA certs). The default
 bundle is named curl-ca-bundle.crt; you can specify an alternate file
 using the --cacert option.
If this HTTPS server uses a certificate signed by a CA represented in
 the bundle, the certificate verification probably failed due to a
 problem with the certificate (it might be expired, or the name might
 not match the domain name in the URL).
If you'd like to turn off curl's verification of the certificate, use
 the -k (or --insecure) option.

What can I do to see where the fault might be? Any guidance on how to debug this and maybe see the certs that are being passed back and forth? Or maybe guidance on what to tell the client to do to give us something more diagnostic than "unable to authenticate." Again, when we open vanilla FTP to them, everything works fine, so it's definitely in the security of the connection.

share|improve this question

As far as I know, none of the AIX versions up to 7.1 ship with a SSL capable FTP client (and there's no -s switch as you show in your example), so it sounds like they're using a non-standard client, which could be anything really.

Maybe ask them to switch to LFTP, or Curl from IBM's RPM packages, both have FTP over SSL support

share|improve this answer
    
ftp -s became available in AIX6.1. – yarek Jan 29 at 8:49

We have faced a similar problem in our enterprise setup; it was caused by following line in configuration of the Cisco ASA on the way between the involved machines:

inspect ftp strict

Removal of the strict did the trick.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.