current community

chat
log out

Super User

Meta Super User

your communities

edit
cancel

Stack Overflow
1,068

Ask Ubuntu
8

Cryptography
101

Bitcoin

reset to default list

more stack exchange communities

company blog

Stack Exchange

Inbox

Reputation and Badges

106

3

help

Tour

Start here for a quick overview of the site

Help Center

Detailed answers to any questions you might have

Meta

Discuss the workings and policies of this site

About Us

Learn more about Stack Overflow the company

Business

Learn more about hiring developers or posting ads with us

Super User

Questions

Tags

Users

Badges

Unanswered

Ask Question

Received TLS alert from the server: Handshake failed (40)

up vote
0
down vote

favorite

I've got new web server with proftpd onboard. The problem is I can't connect to it through filezilla FTP client because it gives me an error

Status: Connection established, waiting for welcome message...
Response: 220 FTP Server ready.
Command: AUTH TLS
Response: 234 AUTH TLS successful
Status: Initializing TLS...
Error: Received TLS alert from the server: Handshake failed (40)
Error: Could not connect to server

I found that the error corresponds to the proftpd log /var/log/proftpd/tls.log/var/log/proftpd/tls.log record:

Jul 24 13:50:47 mod_tls/2.4.2[1572]: unable to accept TLS connection: protocol error:
(1) error:1408A0C1:SSL routines:SSL3_GET_CLIENT_HELLO:no shared cipher

Which means that the ftp client supports none of the encryption algorythms proposed by the server. As a result, the connection fails.

I have also found a TLSCipherSuite directive in /etc/proftpd.conf that disables ADH, DES, SSLv2 and SSLv3 ciphers.

TLSCipherSuite ALL:!ADH:!DES:!SSLv2:!SSLv3

When I remove :!SSLv3 from the directive and restart the server, filezilla connects without any problems. But enabling SSLv3 seems to be a bad idea because it is vulnerable and insecure, according to the http://disablessl3.com/

Question

So my question is what can I do to make proftpd provide at least one secure cipher to successfully negotiate with filezilla FTP client?

Additional note

There is a similar question Recieved TLS alert from the server: Handshake failed (40) that tells

Use only plain FTP (insecure)

but I want connection to be secure thus the answer for me is unsuitable.

Additional note #2

List of available ciphers:

[root@server ~]# openssl ciphers -v 'ALL:!ADH:!DES:!SSLv2:!SSLv3'
ECDHE-RSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH Au=RSA Enc=AESGCM(256) Mac=AEAD
ECDHE-ECDSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH Au=ECDSA Enc=AESGCM(256) Mac=AEAD
ECDHE-RSA-AES256-SHA384 TLSv1.2 Kx=ECDH Au=RSA Enc=AES(256) Mac=SHA384
ECDHE-ECDSA-AES256-SHA384 TLSv1.2 Kx=ECDH Au=ECDSA Enc=AES(256) Mac=SHA384
DHE-DSS-AES256-GCM-SHA384 TLSv1.2 Kx=DH Au=DSS Enc=AESGCM(256) Mac=AEAD
DHE-RSA-AES256-GCM-SHA384 TLSv1.2 Kx=DH Au=RSA Enc=AESGCM(256) Mac=AEAD
DHE-RSA-AES256-SHA256 TLSv1.2 Kx=DH Au=RSA Enc=AES(256) Mac=SHA256
DHE-DSS-AES256-SHA256 TLSv1.2 Kx=DH Au=DSS Enc=AES(256) Mac=SHA256
ECDH-RSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH/RSA Au=ECDH Enc=AESGCM(256) Mac=AEAD
ECDH-ECDSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH/ECDSA Au=ECDH Enc=AESGCM(256) Mac=AEAD
ECDH-RSA-AES256-SHA384 TLSv1.2 Kx=ECDH/RSA Au=ECDH Enc=AES(256) Mac=SHA384
ECDH-ECDSA-AES256-SHA384 TLSv1.2 Kx=ECDH/ECDSA Au=ECDH Enc=AES(256) Mac=SHA384
AES256-GCM-SHA384 TLSv1.2 Kx=RSA Au=RSA Enc=AESGCM(256) Mac=AEAD
AES256-SHA256 TLSv1.2 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA256
ECDHE-RSA-AES128-GCM-SHA256 TLSv1.2 Kx=ECDH Au=RSA Enc=AESGCM(128) Mac=AEAD
ECDHE-ECDSA-AES128-GCM-SHA256 TLSv1.2 Kx=ECDH Au=ECDSA Enc=AESGCM(128) Mac=AEAD
ECDHE-RSA-AES128-SHA256 TLSv1.2 Kx=ECDH Au=RSA Enc=AES(128) Mac=SHA256
ECDHE-ECDSA-AES128-SHA256 TLSv1.2 Kx=ECDH Au=ECDSA Enc=AES(128) Mac=SHA256
DHE-DSS-AES128-GCM-SHA256 TLSv1.2 Kx=DH Au=DSS Enc=AESGCM(128) Mac=AEAD
DHE-RSA-AES128-GCM-SHA256 TLSv1.2 Kx=DH Au=RSA Enc=AESGCM(128) Mac=AEAD
DHE-RSA-AES128-SHA256 TLSv1.2 Kx=DH Au=RSA Enc=AES(128) Mac=SHA256
DHE-DSS-AES128-SHA256 TLSv1.2 Kx=DH Au=DSS Enc=AES(128) Mac=SHA256
ECDH-RSA-AES128-GCM-SHA256 TLSv1.2 Kx=ECDH/RSA Au=ECDH Enc=AESGCM(128) Mac=AEAD
ECDH-ECDSA-AES128-GCM-SHA256 TLSv1.2 Kx=ECDH/ECDSA Au=ECDH Enc=AESGCM(128) Mac=AEAD
ECDH-RSA-AES128-SHA256 TLSv1.2 Kx=ECDH/RSA Au=ECDH Enc=AES(128) Mac=SHA256
ECDH-ECDSA-AES128-SHA256 TLSv1.2 Kx=ECDH/ECDSA Au=ECDH Enc=AES(128) Mac=SHA256
AES128-GCM-SHA256 TLSv1.2 Kx=RSA Au=RSA Enc=AESGCM(128) Mac=AEAD
AES128-SHA256 TLSv1.2 Kx=RSA Au=RSA Enc=AES(128) Mac=SHA256

ftp ssl filezilla tls proftpd

share|edit|delete|flag

edited 3 hours ago

asked 5 hours ago

user619271

1063

add a comment |

question eligible for bounty in 2 days

2 Answers
2

active

oldest

votes

up vote
1
down vote

accept

Assuming you're using the system-installed OpenSSL libraries (e.g. your RedHat RPM installation), you can view the available ciphers by running:

openssl ciphers -v 'ALL:!ADH:!DES:!SSLv2:!SSLv3'

If filezilla simply doesn't speak SSLv3/TLSv1 (roughly equivalent), you're out of luck and should look if there is an updated version available that does.

There may be another configuration/ciphersuite setting that is suitable for your workload, but getting it from this forum without properly analysing the requirements of your situation is not advisable.

share|edit|flag

answered 3 hours ago

Liam Dennehy

212

1

up voted

flag

Now you need to see which ciphers and SSL/TLS versions are supported by your filezilla client. If there isn't at least one that overlaps, this will never work.
– Liam Dennehy
3 hours ago

add a comment |

up vote
0
down vote

accept

The root of problem was an absence of TLSProtocol directive in /etc/proftpd.conf. Default value is TLSv1 and it prevents usage of TLSv1.2.

I have added

TLSProtocol TLSv1.2

to /etc/proftpd.conf, restarted the server and the problem was solved.

https://forum.filezilla-project.org/viewtopic.php?f=2&t=45829&p=157134#p157134
http://www.proftpd.org/docs/contrib/mod_tls.html#TLSProtocol

Although it solved my case, it is also recommended to use

TLSProtocol ALL -SSLv3

instead.

https://forum.filezilla-project.org/viewtopic.php?p=157135#p157135

share|edit|delete|flag

edited 5 mins ago

answered 15 mins ago

user619271

1063

add a comment |

Your Answer

draft saved

draft discarded

community wiki

discard

asked

today

viewed

14 times

active

today

Blog

Podcast #113 – Frustrating Miracles

Hot Meta Posts

15

Which proper action should be taken to handle this suspicious post?

4

Questioned marked as a duplicate (5 times) and original is answered but…

5

How to handle pointless answers when reviewing?

194 People Chatting

Root Access
30 mins ago - Felix Dombek

Ask a Super User Moderator
Jul 20 at 16:08 - Journeyman Geek

Linked

3

Recieved TLS alert from the server: Handshake failed (40)

Related

4
Unable to connect to FTP server using Filezilla with router in-between

0
ftp-client works fine. ftp-tls-client fails on one computer and works on another

3
Recieved TLS alert from the server: Handshake failed (40)

0
SSL connection on Java 7 based server fails with RECV TLSv1 ALERT: fatal, handshake_failure

1
Can not connect to vsftpd FTP server on Ubuntu 14.04 LTS?

1
proftpd - Insecure server, it does not support FTP over TLS

0
Connection error to FTP server using FileZilla

2
FileZilla reporting “GnuTLS error -48: Key usage violation in certificate has been detected”

0
FreeBSD 11 port acme-client's tls handshake fails

0
Nextcloud live doc editing w/ Collabora Online (CODE) cURL error 60: Peer's certificate issuer has been marked as not trusted by the user

Hot Network Questions

How to handle over qualified applicants for an entry level position

Is it appropriate to adopt features of the dialect or accent of your ancestors?

Does the "never wear white to a wedding" rule of etiquette only apply to weddings attended in the United States?

What were Mad-Eye and Neville talking about after the Unforgivable curses scene?

Why did the percentage of CS bachelor's degrees going to women peak in 1984?

Stop Firefox from putting the I-Beam on non-editable texts

Does an Executive Order keep JFK murder evidence unavailable until 2039, 2038 or 2017?

What does "people of good will" mean in Encyclicals?

Why is mixing column collations in a single database considered bad?

Dealing with PC that constantly lies to NPCs

Which safety features of the German Autobahn make it possible to have no speed limits as opposed to every other country?

Shortest Error Message

Is there any way to make a PC obtain the Forsaker Prestige class at 2nd level?

12V input on microcontroller pin

Remove Confirm password field in magento 2 Registration form

Will it halt? (Robbers)

Is the ethical necromancer still viable in 5e?

Is it important to file a new soldering iron tip before tinning?

Why don't climbers use electrically heated suits?

Get SObjectType from 'ObjectName' without using getGlobalDescribe()?

In the Talmud, which is in Aramaic, how is the Tetragrammaton rendered?

What caused Jesse Pinkman to go spiralling down after killing Gale?

How to generate a table with i != j

Can you kill the physical body of someone in the middle of using Astral Projection?

more hot questions

question feed

about us

tour

help

blog

chat

data

legal

privacy policy

work here

advertising info

mobile

contact us

feedback

Technology

Life / Arts

Culture / Recreation

Science

Other

Stack Overflow

Server Fault

Super User

Web Applications

Ask Ubuntu

Webmasters

Game Development

TeX - LaTeX

Software Engineering

Unix & Linux

Ask Different (Apple)

WordPress Development

Geographic Information Systems

Electrical Engineering

Android Enthusiasts

Information Security

Database Administrators

Drupal Answers

SharePoint

User Experience

Mathematica

Salesforce

ExpressionEngine® Answers

Blender

Network Engineering

Cryptography

Code Review

Magento

Software Recommendations

Signal Processing

Emacs

Raspberry Pi

Programming Puzzles & Code Golf

Ethereum

Data Science

Arduino

more (26)

Photography

Science Fiction & Fantasy

Graphic Design

Movies & TV

Music: Practice & Theory

Worldbuilding

Seasoned Advice (cooking)

Home Improvement

Personal Finance & Money

Academia

Law

more (17)

English Language & Usage

Skeptics

Mi Yodeya (Judaism)

Travel

Christianity

English Language Learners

Japanese Language

Arqade (gaming)

Bicycles

Role-playing Games

Anime & Manga

Puzzling

Motor Vehicle Maintenance & Repair

more (32)

MathOverflow

Mathematics

Cross Validated (stats)

Theoretical Computer Science

Physics

Chemistry

Biology

Computer Science

Philosophy

more (10)

Meta Stack Exchange

Stack Apps

Area 51

Stack Overflow Talent

site design / logo © 2017 Stack Exchange Inc; user contributions licensed under cc by-sa 3.0
with attribution required

rev 2017.7.24.26599