I have been trying to set up VSFTPd on my CentOS 7 machine, and I have been running into an issue when connecting through FileZilla. I keep receiving
error -15 regarding the TLS packet.
The following is my full FileZilla debug log.
Status: Connection established, waiting for welcome message... Trace: CFtpControlSocket::OnReceive() Response: 220 (vsFTPd 3.0.2) Trace: CFtpControlSocket::SendNextCommand() Command: AUTH TLS Trace: CFtpControlSocket::OnReceive() Response: 234 Proceed with negotiation. Status: Initializing TLS... Trace: CTlsSocket::Handshake() Trace: CTlsSocket::ContinueHandshake() Trace: CTlsSocket::OnSend() Trace: CTlsSocket::OnRead() Trace: CTlsSocket::ContinueHandshake() Trace: CTlsSocket::OnRead() Trace: CTlsSocket::ContinueHandshake() Trace: TLS Handshake successful Trace: Protocol: TLS1.2, Key exchange: RSA, Cipher: AES-256-GCM, MAC: AEAD Status: Verifying certificate... Trace: CFtpControlSocket::SendNextCommand() Command: USER jflory Status: TLS/SSL connection established. Trace: CTlsSocket::OnRead() Trace: CFtpControlSocket::OnReceive() Response: 331 Please specify the password. Trace: CFtpControlSocket::SendNextCommand() Command: PASS **************** Trace: CTlsSocket::OnRead() Trace: CTlsSocket::Failure(-15, 53) Error: GnuTLS error -15: An unexpected TLS packet was received. Trace: CRealControlSocket::OnClose(53) Trace: CControlSocket::DoClose(64) Trace: CFtpControlSocket::ResetOperation(66) Trace: CControlSocket::ResetOperation(66) Error: Could not connect to server Trace: CFileZillaEnginePrivate::ResetOperation(66)
I am very confusing as to what I am doing wrong. I followed this DigitalOcean guide for setting up VSFTPd with TLS.
The following is my config from
anonymous_enable=NO local_enable=YES write_enable=YES local_umask=022 dirmessage_enable=YES xferlog_enable=YES connect_from_port_20=YES xferlog_std_format=YES chroot_local_user=YES #chroot_list_enable=YES # (default follows) #chroot_list_file=/etc/vsftpd/chroot_list listen=YES listen_ipv6=NO pam_service_name=vsftpd userlist_enable=YES tcp_wrappers=YES rsa_cert_file=/etc/ssl/private/vsftpd.pem rsa_private_key_file=/etc/ssl/private/vsftpd.pem ssl_enable=YES allow_anon_ssl=NO force_local_data_ssl=YES force_local_logins_ssl=YES ssl_tlsv1=YES ssl_sslv2=NO ssl_sslv3=NO require_ssl_reuse=NO ssl_ciphers=HIGH pasv_enable=YES pasv_min_port=21 pasv_max_port=21 pasv_address=<IP address> #allow_writable_chroot=YES
I hadn't added the passive sections until I was prompted to by other troubleshooting tactics – however, even before adding the entire part about passive mode, I was still receiving the same issue.
Also, I tried turning on
allow_writable_chroot as many others reported this to be the solution on this Ubuntu forum thread, but this was not the case for me. Whenever I tried running
sudo systemctl restart vsftpd, it would fail to start up, and removing that line from the config would fix it for me.
Any troubleshooting help is welcome! Thanks.