FileZilla Forums
Welcome to the official discussion forums for FileZilla

Notifications [0]

Notifications
Settings

Reply from boco in topic:

"Received TLS alert from the server: Handshake failed (40)"
2017-07-24 21:30

Reply from botg in topic:

2017-07-24 20:40

See All

Private messages [0]   Logout

FAQ
Search     Members     User Control Panel

Last visit was: 2017-07-24 19:08

It is currently 2017-07-24 21:50

Unanswered topics | Active topics
Unread posts | New posts | Your posts

Board index » General » FileZilla Client Support

All times are UTC+03:00

Received TLS alert from the server: Handshake failed (40)

Moderator: Project members

Post new topic  Reply to topic

Page 1 of 1

[ 4 posts ]

Unsubscribe topic | Bookmark topic | Print view | Email topic

Previous topic | Next topic

Author

Message

handshake

Post subject: Received TLS alert from the server: Handshake failed (40)

PostPosted: 2017-07-24 18:58

Online

500 Command not understood

Joined: 2017-07-24 18:51
Posts: 2

Could someone please help me with this question? https://superuser.com/questions/1233895 ... -failed-40
I need at least to get somehow a list of ciphers supported by my filezilla FTP client.
I'll duplicate the linked question below:

I've got new web server with `proftpd` onboard. The problem is I can't connect to it through `filezilla` FTP client because it gives me an error

Code:

Status:   Connection established, waiting for welcome message...
Response:   220 FTP Server ready.
Command:   AUTH TLS
Response:   234 AUTH TLS successful
Status:   Initializing TLS...
Error:   Received TLS alert from the server: Handshake failed (40)
Error:   Could not connect to server

I found that the error corresponds to the proftpd log `/var/log/proftpd/tls.log/var/log/proftpd/tls.log` record:

Code:

Jul 24 13:50:47 mod_tls/2.4.2[1572]: unable to accept TLS connection: protocol error:
(1) error:1408A0C1:SSL routines:SSL3_GET_CLIENT_HELLO:no shared cipher

Which means that the ftp client supports none of the encryption algorythms proposed by the server. As a result, the connection fails.

I have also found a `TLSCipherSuite` directive in `/etc/proftpd.conf` that disables `ADH`, `DES`, `SSLv2` and `SSLv3` ciphers.

Code:

TLSCipherSuite                 ALL:!ADH:!DES:!SSLv2:!SSLv3

When I remove `:!SSLv3` from the directive and restart the server, filezilla connects without any problems. But enabling `SSLv3` seems to be a bad idea because it is vulnerable and insecure, according to the http://disablessl3.com/

Question

So my question is what can I do to make `proftpd` provide at least one secure cipher to successfully negotiate with `filezilla` FTP client?

Additional note

There is a similar question https://superuser.com/questions/874981/ ... -failed-40 that tells

Quote:

Use only plain FTP (insecure)

but I want connection to be secure thus the answer for me is unsuitable.

Additional note #2

List of available ciphers:

Code:

[root@server ~]# openssl ciphers -v 'ALL:!ADH:!DES:!SSLv2:!SSLv3'
ECDHE-RSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH     Au=RSA  Enc=AESGCM(256) Mac=AEAD
ECDHE-ECDSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH     Au=ECDSA Enc=AESGCM(256) Mac=AEAD
ECDHE-RSA-AES256-SHA384 TLSv1.2 Kx=ECDH     Au=RSA  Enc=AES(256)  Mac=SHA384
ECDHE-ECDSA-AES256-SHA384 TLSv1.2 Kx=ECDH     Au=ECDSA Enc=AES(256)  Mac=SHA384
DHE-DSS-AES256-GCM-SHA384 TLSv1.2 Kx=DH       Au=DSS  Enc=AESGCM(256) Mac=AEAD
DHE-RSA-AES256-GCM-SHA384 TLSv1.2 Kx=DH       Au=RSA  Enc=AESGCM(256) Mac=AEAD
DHE-RSA-AES256-SHA256   TLSv1.2 Kx=DH       Au=RSA  Enc=AES(256)  Mac=SHA256
DHE-DSS-AES256-SHA256   TLSv1.2 Kx=DH       Au=DSS  Enc=AES(256)  Mac=SHA256
ECDH-RSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH/RSA Au=ECDH Enc=AESGCM(256) Mac=AEAD
ECDH-ECDSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH/ECDSA Au=ECDH Enc=AESGCM(256) Mac=AEAD
ECDH-RSA-AES256-SHA384  TLSv1.2 Kx=ECDH/RSA Au=ECDH Enc=AES(256)  Mac=SHA384
ECDH-ECDSA-AES256-SHA384 TLSv1.2 Kx=ECDH/ECDSA Au=ECDH Enc=AES(256)  Mac=SHA384
AES256-GCM-SHA384       TLSv1.2 Kx=RSA      Au=RSA  Enc=AESGCM(256) Mac=AEAD
AES256-SHA256           TLSv1.2 Kx=RSA      Au=RSA  Enc=AES(256)  Mac=SHA256
ECDHE-RSA-AES128-GCM-SHA256 TLSv1.2 Kx=ECDH     Au=RSA  Enc=AESGCM(128) Mac=AEAD
ECDHE-ECDSA-AES128-GCM-SHA256 TLSv1.2 Kx=ECDH     Au=ECDSA Enc=AESGCM(128) Mac=AEAD
ECDHE-RSA-AES128-SHA256 TLSv1.2 Kx=ECDH     Au=RSA  Enc=AES(128)  Mac=SHA256
ECDHE-ECDSA-AES128-SHA256 TLSv1.2 Kx=ECDH     Au=ECDSA Enc=AES(128)  Mac=SHA256
DHE-DSS-AES128-GCM-SHA256 TLSv1.2 Kx=DH       Au=DSS  Enc=AESGCM(128) Mac=AEAD
DHE-RSA-AES128-GCM-SHA256 TLSv1.2 Kx=DH       Au=RSA  Enc=AESGCM(128) Mac=AEAD
DHE-RSA-AES128-SHA256   TLSv1.2 Kx=DH       Au=RSA  Enc=AES(128)  Mac=SHA256
DHE-DSS-AES128-SHA256   TLSv1.2 Kx=DH       Au=DSS  Enc=AES(128)  Mac=SHA256
ECDH-RSA-AES128-GCM-SHA256 TLSv1.2 Kx=ECDH/RSA Au=ECDH Enc=AESGCM(128) Mac=AEAD
ECDH-ECDSA-AES128-GCM-SHA256 TLSv1.2 Kx=ECDH/ECDSA Au=ECDH Enc=AESGCM(128) Mac=AEAD
ECDH-RSA-AES128-SHA256  TLSv1.2 Kx=ECDH/RSA Au=ECDH Enc=AES(128)  Mac=SHA256
ECDH-ECDSA-AES128-SHA256 TLSv1.2 Kx=ECDH/ECDSA Au=ECDH Enc=AES(128)  Mac=SHA256
AES128-GCM-SHA256       TLSv1.2 Kx=RSA      Au=RSA  Enc=AESGCM(128) Mac=AEAD
AES128-SHA256           TLSv1.2 Kx=RSA      Au=RSA  Enc=AES(128)  Mac=SHA256

Report this post

Top

Profile Send private message

Edit post Reply with quote

botg

Post subject: Re: Received TLS alert from the server: Handshake failed (40)

PostPosted: 2017-07-24 20:40

Offline

Site Admin

Joined: 2004-02-23 23:49
Posts: 29906

First name: Tim

Last name: Kosse

Clearly a server-side configuration issue.

http://www.proftpd.org/docs/contrib/mod ... LSProtocol

Report this post

Top

Profile Send private message

Reply with quote

handshake

Post subject: Re: Received TLS alert from the server: Handshake failed (40)

PostPosted: 2017-07-24 21:26

Online

500 Command not understood

Joined: 2017-07-24 18:51
Posts: 2

I have added

Code:

TLSProtocol                   TLSv1.2

to `/etc/proftpd.conf` and it solved the problem. Thank you.

Report this post

Top

Profile Send private message

Edit post Reply with quote

boco

Post subject: Re: Received TLS alert from the server: Handshake failed (40)

PostPosted: 2017-07-24 21:30

Online

Contributor

Joined: 2006-05-01 06:28
Posts: 23204

Location: Germany

That directive should look like:

TLSProtocol ALL -SSLv3

Would allow TLS 1.0, 1.1 and 1.2. TLS 1.3 isn't finalized, yet.

Supporting only TLS 1.2 might still lock some slightly-older clients out.

_________________
### BEGIN SIGNATURE BLOCK ###
No support requests per PM! You will NOT get any reply!!!
FTP connection problems? Do yourself a favor and read Network Configuration.
All FileZilla products fully support IPv6. http://worldipv6launch.org
### END SIGNATURE BLOCK ###

Report this post

Top

Profile Send private message

Reply with quote

Display posts from previous: All posts1 day7 days2 weeks1 month3 months6 months1 year Sort by AuthorPost timeSubject AscendingDescending

Post new topic  Reply to topic

Page 1 of 1

[ 4 posts ]

Board index » General » FileZilla Client Support

All times are UTC+03:00

Who is online

Users browsing this forum: No registered users and 15 guests

You can post new topics in this forum
You can reply to topics in this forum
You can edit your posts in this forum
You can delete your posts in this forum
You can post attachments in this forum

Search for:

Jump to:

Select a forum
------------------ Announcements
News
General
General Discussion
FileZilla Client Support
FileZilla Server Support
Development
FileZilla and FileZilla Server Development
libfilezilla
Off-Topic
All things HTML
Off-Topic

Powered by phpBB® Forum Software © phpBB Limited