Following these instructions I managed to configure my FTP server for SSL on a windows server 2008 (IIS 7) while enabling
Require SSL connections. However I'm not able to connect to the FTP server over SSL.
-disabled firewall on server
-did nmap to the server which reported the below ports:
PORT STATE SERVICE 21/tcp open ftp 53/tcp open domain 88/tcp open kerberos-sec 135/tcp open msrpc 139/tcp open netbios-ssn 389/tcp open ldap 443/tcp open https 445/tcp open microsoft-ds 464/tcp open kpasswd5 593/tcp open http-rpc-epmap 636/tcp open ldapssl 1433/tcp open ms-sql-s 1723/tcp open pptp 3268/tcp open globalcatLDAP 3269/tcp open globalcatLDAPssl 3389/tcp open ms-term-serv 49152/tcp open unknown 49153/tcp open unknown 49154/tcp open unknown 49155/tcp open unknown 49157/tcp open unknown 49158/tcp open unknown 49159/tcp open unknown
-based on this list of TCP port I was expecting to see either
FTPS (990) or
SFTP (22) opened. If I go to the FTP
Bindings... settings, the only one list is
fto (21) and there aren't any other FTP-related choices I can add. If I try to add HTTPS
filezilla as a client and did following tests over port 21:
FTP mode -> fails with
Response: 534 Policy requires SSL.
SFTP mode -> client happy after receiving
Response: 220 Microsoft FTP service
FTPS mode -> client sending what looks like a client hello, fails with
Response: 451 The parameter is incorrect.
Q: How can I troubleshoot this issue further (ultimate goal is to be able to force client of secured FTP)?
I'm really stuck at this point. I've tried every protocol
Filezilla is offering me (
Filezilla starts talking clear-text FTP and
Response: 534 Policy requires SSL, or it tries to initiate a secure connection and I get responses such as
Response: 451 The parameter is incorrect or
Response: 431 Failed to setup secure session.
I'm sniffing traffic with wireshark and I can see that
filezilla is properly using the port I'm setting. I've added several ports to the FTP binding on IIS (e.g.
990..., TCP-handshake is properly established in every case) and I get the same behaviour whatever I try.
I also had a look at the FTP logs in
c:\inetpub\logs\LogFiles and all I get are useless messages such as
AUTH SSL which don't help with understanding why things are actually failing.
Q: How can I troubleshoot this further (is there a debug mode for the ISS FTP) ?