0

I have been trying to set up VSFTPd on my CentOS 7 machine, and I have been running into an issue when connecting through FileZilla. I keep receiving error -15 regarding the TLS packet.

The following is my full FileZilla debug log.

Status:         Connection established, waiting for welcome message...
Trace:          CFtpControlSocket::OnReceive()
Response:   220 (vsFTPd 3.0.2)
Trace:          CFtpControlSocket::SendNextCommand()
Command:    AUTH TLS
Trace:          CFtpControlSocket::OnReceive()
Response:   234 Proceed with negotiation.
Status:         Initializing TLS...
Trace:          CTlsSocket::Handshake()
Trace:          CTlsSocket::ContinueHandshake()
Trace:          CTlsSocket::OnSend()
Trace:          CTlsSocket::OnRead()
Trace:          CTlsSocket::ContinueHandshake()
Trace:          CTlsSocket::OnRead()
Trace:          CTlsSocket::ContinueHandshake()
Trace:          TLS Handshake successful
Trace:          Protocol: TLS1.2, Key exchange: RSA, Cipher: AES-256-GCM, MAC: AEAD
Status:         Verifying certificate...
Trace:          CFtpControlSocket::SendNextCommand()
Command:    USER jflory
Status:         TLS/SSL connection established.
Trace:          CTlsSocket::OnRead()
Trace:          CFtpControlSocket::OnReceive()
Response:   331 Please specify the password.
Trace:          CFtpControlSocket::SendNextCommand()
Command:    PASS ****************
Trace:          CTlsSocket::OnRead()
Trace:          CTlsSocket::Failure(-15, 53)
Error:          GnuTLS error -15: An unexpected TLS packet was received.
Trace:          CRealControlSocket::OnClose(53)
Trace:          CControlSocket::DoClose(64)
Trace:          CFtpControlSocket::ResetOperation(66)
Trace:          CControlSocket::ResetOperation(66)
Error:          Could not connect to server
Trace:          CFileZillaEnginePrivate::ResetOperation(66)

I am very confusing as to what I am doing wrong. I followed this DigitalOcean guide for setting up VSFTPd with TLS.

The following is my config from /etc/vsftpd/vsftpd.conf.

anonymous_enable=NO
local_enable=YES
write_enable=YES
local_umask=022
dirmessage_enable=YES
xferlog_enable=YES
connect_from_port_20=YES
xferlog_std_format=YES
chroot_local_user=YES
#chroot_list_enable=YES
# (default follows)
#chroot_list_file=/etc/vsftpd/chroot_list
listen=YES
listen_ipv6=NO

pam_service_name=vsftpd
userlist_enable=YES
tcp_wrappers=YES

rsa_cert_file=/etc/ssl/private/vsftpd.pem
rsa_private_key_file=/etc/ssl/private/vsftpd.pem

ssl_enable=YES
allow_anon_ssl=NO
force_local_data_ssl=YES
force_local_logins_ssl=YES

ssl_tlsv1=YES
ssl_sslv2=NO
ssl_sslv3=NO

require_ssl_reuse=NO
ssl_ciphers=HIGH

pasv_enable=YES
pasv_min_port=21
pasv_max_port=21
pasv_address=<IP address>

#allow_writable_chroot=YES

I hadn't added the passive sections until I was prompted to by other troubleshooting tactics – however, even before adding the entire part about passive mode, I was still receiving the same issue.

Also, I tried turning on allow_writable_chroot as many others reported this to be the solution on this Ubuntu forum thread, but this was not the case for me. Whenever I tried running sudo systemctl restart vsftpd, it would fail to start up, and removing that line from the config would fix it for me.

Any troubleshooting help is welcome! Thanks.

  • What's in your logs? – Michael Hampton Nov 14 '14 at 5:46
  • @Michael Hampton: Which logs are you needing in particular? Not sure which ones are holding the info you need. – Justin W. Flory Nov 14 '14 at 9:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.