FTP SSL trouble

Hi,
I want to close our plain-text FTP to the internet. Some customers migrated
to a SSH FTP connection. Another one wnats to use SSL-FTP (Explicit)
We are trieing to connect with a explicit connection in passive mode. We've
tried Filezilla and WS_FTP 9.01 as a clint.
We've tried two different Netware FTP servers (SP5 and SP6) on two different
internet location.
Both servers react the same way. When you connect... the certificate is
offered to the clint. Once the clint accepts the certificate nothing
happens. Listing is not possible. We also tried a clint in the local
network of the SP6 server. Same result. :(
Any info on this? How do I get NWFTPD work in SSL mode succesfully?

What most often causes the symptoms you are describing is the combination
of SSL encryption and passing through a NAT firewall. Most firewalls are
educated about FTP and they watch inside the FTP data for some of the
extra information that gets passed back and forth about IP addresses.
This is one of the few cases where NAT will translate inside the data
portion of a packet rather than just in the TCP/IP headers.
But once you put FTP inside of SSL, the NAT firewalls can no longer see
inside the data an can't translate some of those addresses anymore,
preventing the extra data connections (needed for dir lists and file
transfers) from addressing their targets correctly.
For NetWare FTP Servers that need to do SSL, are behind NAT (FTP server
has private address), and passive data connections are needed, see TID
3931251.
For FTP clients that need to do SSL and are behind NAT, and active data
connections are needed, you will need to find a setting in the FTP client
which says something like, "use this address for active (nonpassive) data
connections."
> Hi,
>
> I want to close our plain-text FTP to the internet. Some customers
migrated
> to a SSH FTP connection. Another one wnats to use SSL-FTP (Explicit)
>
> We are trieing to connect with a explicit connection in passive mode.
We've
> tried Filezilla and WS_FTP 9.01 as a clint.
>
> We've tried two different Netware FTP servers (SP5 and SP6) on two
different
> internet location.
>
> Both servers react the same way. When you connect... the certificate is
> offered to the clint. Once the clint accepts the certificate nothing
> happens. Listing is not possible. We also tried a clint in the local
> network of the SP6 server. Same result. :(
>
> Any info on this? How do I get NWFTPD work in SSL mode succesfully?
>
>

Similar Messages

FTP/SSL Connection Problem for FTP Receiver Adapter

Hello All,
We are trying to establish an FTPS/SSL connection with one of our customers from our XI(Unix) system, and are receive following error:
iaik.security.ssl.SSLException: Server certificate rejected by ChainVerifier
Communication Channel Parameters:
Connection Security: FTP (FTP Using SSL/TLS) for Control Connection or FTP (FTP Using SSL/TLS) for Control Connection and Data Connection
Command Order: AUTH TLS, USER, PASS, PBSZ, PROT
Checkbox - Use X.509 Certificate.... checked (Certificate was provided by third party (customer issued) and uploaded to service_ssl certificate store on J2EE server)
Data Connection: Passive
Port: 10021
Keystore: service_ssl
X.509 Certificate & Private Key: ssl-credentials
Note: Initial handshaking occurs but connection is being dropped by the third party FTP Server when SSL certificate credentials are being validated. We also tried connecting to the third party FTPS server using standard FTPS client(FileZilla software), this connection gets established successfully with no certificate issues which means certificate and third party FTP Server is functioning correctly.
We therefore are thinking that the problem lies with our XI system being unable to load the certificate information correctly at the point when FTPS session is being established.
Your help and suggestions will be greatly appreciated.
Thanks and Best Regards
Prashant Rajani

Hello All,
Further in order to test connection set up and communication channel configuration we tried simulating the FTP connection locally by configuring FTP Server using FileZilla at a local machine and accessed it from Client's XI Server.
This set up simulates the problem we encounter with our customer's FTP Server.
If connection security parameter in communication channel for Sender FTP Adapter is set to "FTPs( FTP Using SSL/TLS) with Control Connection" only, file gets successfully created with data at the FTP server but as soon as we switch the connection security parameter to "FTPs( FTP Using SSL/TLS) with Control and Data Connection", we receive error "Certificate rejected by Chain Verifier". The initial handshaking happens successfully and file gets created at the FTP Server but its empty, connection fails when attempt is made to write data into file and we end up with said error thereby closing the connection.
This is what the FTP (FileZilla) sees when the XI system attempts to set-up a fully encrypted data (FTPS) connection i.e., connection security parameter value as"FTPs( FTP Using SSL/TLS) with Control and Data Connection" :-
- (not logged in) (10.18.106.34)> Connected, sending welcome message...
- (not logged in) (10.18.106.34)> 220-FileZilla Server version 0.9.18 beta
- (not logged in) (10.18.106.34)> 220-written by Tim Kosse ([email protected])
- (not logged in) (10.18.106.34)> 220 Please visit http://sourceforge.net/projects/filezilla/
- (not logged in) (10.18.106.34)> AUTH TLS
- (not logged in) (10.18.106.34)> 234 Using authentication type TLS
- (not logged in) (10.18.106.34)> SSL connection established
- (not logged in) (10.18.106.34)> USER test
- (not logged in) (10.18.106.34)> 331 Password required for test
- (not logged in) (10.18.106.34)> PASS ***********
- test (10.18.106.34)> 230 Logged on
- test (10.18.106.34)> PBSZ 0
- test (10.18.106.34)> 200 PBSZ=0
- test (10.18.106.34)> PROT P
- test (10.18.106.34)> 200 Protection level set to P
- test (10.18.106.34)> SYST
- test (10.18.106.34)> 215 UNIX emulated by FileZilla
- test (10.18.106.34)> PWD
- test (10.18.106.34)> 257 "/" is current directory.
- test (10.18.106.34)> CWD /payment/
- test (10.18.106.34)> 250 CWD successful. "/payment" is current directory.- test (10.18.106.34)> TYPE I
- test (10.18.106.34)> 200 Type set to I
- test (10.18.106.34)> PASV
- test (10.18.106.34)> 227 Entering Passive Mode (10,27,7,103,15,63)- test (10.18.106.34)> STOR BHPDSB20060911-153840-834.txt
- test (10.18.106.34)> 150 Connection accepted
- test (10.18.106.34)> Data connection SSL warning: SSL3 alert read: fatal: bad certificate
- test (10.18.106.34)> Data connection SSL warning: SSL_accept: failed in SSLv3 read client certificate A- test (10.18.106.34)> Data connection SSL warning: error:14094412:SSL routines:SSL3_READ_BYTES:sslv3 alert bad certificate- test (10.18.106.34)> Data connection SSL warning: error:140940E5:SSL routines:SSL3_READ_BYTES:ssl handshake failure- test (10.18.106.34)> 426 Connection closed; transfer aborted.- test (10.18.106.34)> QUIT
- test (10.18.106.34)> 221 Goodbye
- test (10.18.106.34)> SSL connection established
Please suggest your valuable inputs if we are missing out something. Any helpful inputs in this regard is highly appreciated.
Thanks and Best Regards
Prashant

FTP SSL/TTL protocol?

Anyone know of an FTP client for the iPad hat supports SSL/TTL protocol?

You can download our trial of our FTP/SSL Java client, edtFTPj/SSL, and try it out. This works with most FTP servers supporting SSL.
See
http://www.enterprisedt.com/products/edtftpjssl/overview.html
If it works for you it may be cheaper to purchase it than tussle with the intricacies of FTP/SSL.
regards
Bruce Blackshaw

Enable FTPS, SSL, File Adapter, Configuration, Certificates

Hi All,
   Right now I have some file to file (FTP_XI_FTP)scenarios that are working fine. With SP14 we got a option to use FTPS(FTP over SSL).
1. Can any one tell me the exact steps we need to follow to use FTPS?
2. What is the config we need to do in RZ10.
3. What is the confing we need to do in the Visual admin?
4. What are all the steps we need to do with the ftp server.
4. How to test the configuration.
   1. We are on sp14/XI3.0/kernal640/Solaris/oracle
   2. Installed SAP Cryptographic Software.
   3. Right now i could be able to connect to FTP server at a secure port 32, using PUTTY software.
Thank you
Raj Akula

Hi,
There is a blog on SSL- have look at that-
/people/aniket.tare/blog/2005/03/22/ssl-certificate-installation-procedure-for-sap-j2ee-engine-630-150-steps-in-visual-administrator
I hope you have gone thru following link-
http://help.sap.com/saphelp_nw04/helpdata/en/e3/94007075cae04f930cc4c034e411e1/frameset.htm
May be useful
Regards,
Moorthy

File Adapter FTP SSL SSL Certificate Exception

After reviewing the results of searching on this error, I do not find anything that fits my situation:
SAP File Adapter (PI 7.1) using FTP with FTPS connection security.
I am not using X.509 certificate for client authentication.
My connection is using a non-public certificate.
I have added the SSL certificate to TrustedCAs and DEFAULT keystores.
I am getting the following error:
Message processing failed. Cause: com.sap.engine.interfaces.messaging.api.exception.MessagingException: Error when getting an FTP connection from connection pool: com.sap.aii.af.lib.util.concurrent.ResourcePoolException: Unable to create new pooled resource: iaik.security.ssl.SSLCertificateException: Peer certificate rejected by ChainVerifier
Since I am using an non-public certificate, it will not validate. Even adding to the TrustedCAs and DEFAULT keystore it seems the configuration is still attempting to validate the certificate.
Any recommendations?

Hi,
The main reasons for this error are:
1. The correct server certificate could not be present in the TrustedCA
keystore view of NWA. Please ensure you have done all the steps
described in these two URLs:
Security Configuration at Message Level
http://help.sap.com/saphelp_nwpi71/helpdata/EN/ea/c91141e109ef6fe1000000
0a1550b0/frameset.htm
2. The server certificate chain contains expired certificate. Check for
it (that was the cause for other customers as well) and if it's the case
renew it or extend the validation.
3. Some other people have reported similar problem and mainly the
problem was that the certificate chain was not in correct
order. Basically the server certificate chain should be in order
Own->Intermedite->Root. To explain in detail, if your server certificate
is A which is issued by an intermediate CA B and then B's certificate is
issued by the C which is the root CA (having a self signed certificate).
Then your certificate chain contains 3 elements A->B->C. So you need to
have the right order of certificate in the chain. If the order is B
first followed by A followed by C, then the IAIK library used by PI
cannot verify the server as trusted. Please generate the certificate in
the right order and then import this certificate in the TrustedCA
keystore view and try again. Please take this third steps as the
principal one.
Hope it solves your querie.
Regards,
Caio Cagnani

Need a good FTP/SSL client

Hi,
Can anyone suggest a good FTP client with SSL capabilities. I was looking at Jakarta's FTP Client but I don't think it works on SSL. Has anyone used edtFTPj/SSL? Are there any other such FTP clients?
Thanks.

hi!
you searching for a client, a client library or what exactly?
if you are searching for a free client library supporting implicit ssl, ssl, tls and many more features - soon it will support proxy's then you should have a look on:
http://sourceforge.net/projects/ftp4che/
greets

Secure FTP using FTPS (SSL/TLS) - need help!

I am trying to use an FTP Sender Channel using Secure FTP. I am currently getting a "java.net.ConnectException: Connection timed out: connect" error.
I am on XI 3.0 with SP13.
Settings are FTPS (FTP Using SSL/TLS for Control and Data)
Command Order Auth TLS, USER, PASS, PBSZ, PROT.
I am able to connect from my pc using WSFTP Pro which looks to be using the same command order. I made sure WSFTP Pro was set for passive connections as XI only supports this until SP15.
I have asked our Basis support to make sure the proper ports are open that are used for the connection and file transfer. They have deployed the Java Cryptographic Toolkit on XID, and changed the startup mode for SSL runtime from 'manual' to 'always'. The site I will connect to uses a certificate from Equifax which was added to the TrustedCAs keystore view. After still not being able to get a file, I also added the certificate of the site, which I was able to export from WSFTP Pro and import onto XI with STRUST.
I have increased the J2EE trace for com.sap.aii.adapter.file to Debug, but I haven't been able to get much out of the log. I see entries, such as some SSL activity and the timeout, but nothing that points me to an answer. Of course, I really don't know what to look for.
I have tried to connect to the remote server by name or ip with the same connection timeout.
I currently don't have it set to use X.509 certificate for Client Auth, but I did try a few of those options with no luck.
Any pointers would be appreciated.
Thanks,
Eric Peterson

Eric,
Did you ever solve the problem ? I am having the same issue.
Cheers
Jon

FTP SSL Client

Hi, I would like to have a java client to a secure FTP server.
is there a simple way to connect to a FTP server using SSL ?
or do I have to implement the protocol and work with SSLSocket ?
Thanks in advance
(any sample code welcome)

Well, in fact I finally opted for a simple and dirty option:
I will use the FTP client of WS-FTP, enterprise edition.
It enables the SSL connection in a script, so I will only have to launch my client as an external program.
Of course I will loose portability but in my case it is not a major problem. Certainly less than having to develop an FTP client supporting SSL from scratch in Java (i haven't found any open source project/this on the web).
Note: to launch this program I use the following snippet:
try {
String line;
Process p = Runtime.getRuntime().exec("...mypath.../wsftp.exe");
BufferedReader input =
new BufferedReader
(new InputStreamReader(p.getInputStream()));
while ((line = input.readLine()) != null) {
System.out.println(line);
input.close();
catch (Exception err) {
err.printStackTrace();

Seeburger Host FTP SSL Error

I have a scenario that has been working in production for some time (> 6mo). Today I am getting the following error on all communication channels that use Host FTP (they all go to our same VAN account). I have reloaded the certificate in Java Administrator, reset the password, and confirmed from the system that the remote ftp host is accessible. I did check the user (SEEBURGER) is not locked. 
 
Message : com.seeburger.jftp.app.exception.FtpExceptionConfigurationError: Error while creating socket chain CAUSED BY: java.lang.Exception: Error while preparing SSLContext CAUSED BY: com.seeburger.ksm.cryptoapi.exception.CryptoApiException: Access Denied. CAUSED BY: com.sap.engine.services.security.exceptions.BaseSecurityException: Internal server error. An error log with ID [001517B19DC9001F0000036500002670000488BA247963F4] is created. For more information contact your system administrator.
Stack trace:
Exception: com.seeburger.jftp.app.exception.FtpExceptionRethrowError: Error in session:
 at com.seeburger.jftp.app.JFtpSession.executeTask(JFtpSession.java:399)
 at com.seeburger.jftp.app.JFtpSession.execute(JFtpSession.java:211)
 at com.seeburger.jftp.JFTPProcessor.execute(JFTPProcessor.java:132)
 at com.seeburger.frame.core.FrameWorkListener.syncNewData(FrameWorkListener.java:523)
 at com.seeburger.xi.connector.fw.SynchronousTaskExecutor.executeTask(SynchronousTaskExecutor.java:40)
 at com.seeburger.xi.connector.queue.QueueProcessorImpl.doOutboundTransmission(QueueProcessorImpl.java:791)
 at com.seeburger.xi.connector.queue.QueueProcessorImpl.executeAsynchronously(QueueProcessorImpl.java:664)
 at com.seeburger.xi.connector.queue.QueueProcessorImpl.execute(QueueProcessorImpl.java:455)
 at com.seeburger.xi.connector.queue.QueueProcessorImpl.process(QueueProcessorImpl.java:482)
 at com.seeburger.xi.connector.queue.QueueProcessorImpl.run(QueueProcessorImpl.java:213)
 at com.sap.engine.core.thread.impl3.ActionObject.run(ActionObject.java:37)
 at java.security.AccessController.doPrivileged(Native Method)
 at com.sap.engine.core.thread.impl3.SingleThread.execute(SingleThread.java:100)
 at com.sap.engine.core.thread.impl3.SingleThread.run(SingleThread.java:170)
Caused by: com.seeburger.jftp.app.exception.FtpExceptionConnectionError: Error while connection to remote host
 at com.seeburger.jftp.app.process.ftp.FtpEngine.connect(FtpEngine.java:192)
 at com.seeburger.jftp.app.process.ScriptEngine.commandOpen(ScriptEngine.java:368)
 at com.seeburger.jftp.app.process.ScriptEngine.executeCommand(ScriptEngine.java:234)
 at com.seeburger.jftp.app.process.ScriptEngine.executeScriptInRange(ScriptEngine.java:186)
 at com.seeburger.jftp.app.process.ScriptEngine.executeScriptBegin(ScriptEngine.java:136)
 at com.seeburger.jftp.app.JFtpSession.executeTask(JFtpSession.java:321)
 ... 13 more
Caused by: com.seeburger.jftp.app.exception.FtpExceptionConnectionError: Error while opening control socket
 at com.seeburger.jftp.app.process.ftp.FtpControlSocket.open(FtpControlSocket.java:85)
 at com.seeburger.jftp.app.process.ftp.FtpClient.open(FtpClient.java:80)
 at com.seeburger.jftp.app.process.ftp.FtpEngine.connect(FtpEngine.java:121)
 ... 18 more
Caused by: com.seeburger.jftp.app.exception.FtpExceptionConfigurationError: Error while creating socket chain
 at com.seeburger.jftp.app.process.ftp.FtpSocket.createSocketChain(FtpSocket.java:352)
 at com.seeburger.jftp.app.process.ftp.FtpSocket.connectOpen(FtpSocket.java:97)
 at com.seeburger.jftp.app.process.ftp.FtpControlSocket.open(FtpControlSocket.java:72)
 ... 20 more
Caused by: java.lang.Exception: Error while preparing SSLContext
 at com.seeburger.communication.socketmodel.wizards.SslConnectWizardKSMAlias.<init>SslConnectWizardKSMAlias.java:117)
 at com.seeburger.jftp.app.process.ftp.FtpSocket.createSocketChain(FtpSocket.java:316)
 ... 22 more
Caused by: com.seeburger.ksm.cryptoapi.exception.CryptoApiException: Access Denied.
 at com.seeburger.ksm.xi.cryptoapi.XICryptoApi.constructException(XICryptoApi.java:743)
 at com.seeburger.ksm.xi.cryptoapi.XICryptoApi.getAliasCollection(XICryptoApi.java:136)
 at com.seeburger.communication.socketmodel.wizards.SslConnectWizardKSMAlias.<init>SslConnectWizardKSMAlias.java:101)
Edited by: Tadd Bryan on Jun 10, 2010 10:46 PM

Just to provide the community the final answer to my problem... After working with Seeburger support the issue was identified. During a BASIS team review of the Java settings, the Security Model was changed from "no" to "Token."
In J2EE Visual Administrator, Under Server, Services, Security Provider:
Components - SAP-J2EE-Engine
Authentication Template: "no" (correct value)
BasicPasswordLoginModule: SUFFICIENT

FTP Socket trouble - need help

I'm not going to pretend that I knew enough about this before I began. My code came from this link:
<url>http://forum.java.sun.com/thread.jsp?forum=31&thread=54731</url>
Anyway, I understand it know, but I can't seem to get through some of my errors. The biggest problem is that if I don't timeout then the program just hangs. For instance, I do a controlOut and have the timeout set at 2000 ms. After 2000 ms the code moves on to the next step, but it throws a Read Timed Out error. If I have the timeout set at 15000 ms then the code waits 15000 ms and then does the same thing. If I set the timeout to 0 (persistant) the code never moves beyond that controlOut statement.
I'm really confused...please help! Thank you!

Hi Auzlin, i had the same problem, the anwer is, the ftp programs change the ftp port for everyone of the files sended, after you receive (or send) each file, that is cause even if you close the connection, is not fully closed,it goes TIME_WAIT or something but the port is still open, thats the reason you cant receive another one, it needs a little while to close and this cant be controled by the program (or just i dont know how) so, the solution (or one of them) its to use a PASV command after each file, and force the server to change port, you can read that port, and send/receive another file using that port =) hope it helps, if not i cant put some code.
-JF-
Sorry for the english =)

Ftps/sftp troubles

I have a couple of ftp client apps on my iPad which are working great except with the servers of my University! (I have no problem to access them from my Macbook with Filezilla or Dreamweaver). I have also noted a weird thing: I can connect to the sftp server (not the ftps) but the files are invisibles! First I thought it was an issue with the iPad but now I'm suspecting the servers... Does anyone had a similar problem? Any ideas? Thanks.

upon browsing other forums i have realized the error
The reason the shell startup files are relevant at all, is that sshd employs the user's shell when starting any programs on the user's behalf (using e.g. /bin/sh -c "command").
--Snailbook
so it was my fault for my careless implementation of fortune in user's bash config files

"Group" calendars and SSL trouble...

Server: SL 10.6.3
Clients: SL 10.6.3, L 10.5.x
Because we're trying to run Mobile Access Server (MAS), we cannot use Kerberos for calendars on a mobile device like a laptop or iPhone. So SSL it is.
However I find that I have to create the calendar as Kerberos, relaunch iCal, then change it to SSL.
I can't ask my users to do that, especially since sometimes it takes 2 or 3 tries.
Do any of ya'll have any ideas that may help?
Thanks!

Hi,
The web group calendar works with its group. User iCals can interface to a web group calendar and make entries that get uploaded if they are group members, but the user of the web group is the group. In other words they are two different calendars and a specific users calendar is not viewed on the web. The web calendar is not an iCal like application.
Use Directory.app under Utilities to setup Locations and Resources.
For setting up a user to interact with group calendar through iCal take a look at
http://discussions.apple.com/thread.jspa?messageID=8606774&#8606774
HTH,
Harry

SOCKS + SSL = trouble (Safari crashes, Mail.app doesn't connect)

I use a SOCKS (v4) proxy over an SSH tunnel to connect to applications at work, as do many of my co-workers.
Safari will often (even usually) crash hard when using SOCKS if you try to connect to an SSL (i.e. https://) site.
We recently migrated to IMAP over SSL for Mail, and Mail.app cannot connect successfully to the IMAP server; it gets a generic "SSL error" (NOT a certificate error).
Both work fine over a plain SSH tunnel, and both work fine without SOCKS. Firefox and Thunderbird work fine over SOCKS for such sites (note that they don't use the system-wide settings/libraries). Other users at my workplace are seeing the same behaviour.
It seems to me that there might be a bug in the SOCKS implementation, or SSL libraries, or combination thereof, provided by OSX.
Can anyone else confirm this?
15" PowerBook G4 Mac OS X (10.4.8)

I know nothing about your problem, but wonder if this older article on 10.4.7 "fixing" the problem, mighn't give you a clue or two...
http://docs.info.apple.com/article.html?artnum=303771

SSL trouble

I have a CSS11501 with a SSL module, it is balancing two oracle AS, but if I try to access the application via http i can get a file (like a report) quickly but if I try to access via https the transfer of the file are very slowly. The app is interacting with a data base in another segment of the network. Do you have any idea about this issue?
I attach the config. Is a one arm config and the server have ip default a external router.

Hello Henry,
There's a couple of things you can try or look at. 1st if you like you can disable the ssl-queue-delay within the proxy-list for the VIP you are experiencing content delivery issues with. By default the CSS will wait 200 milliseconds before emptying the data from the queue and encrypt it to the client. Setting the value to 0 will disable the queuing of data which allows the CSS to immediately encrypt the data as soon as it is received from the backend-server and send it to the client. You can try this and see if the transmission of the HTTPS data is faster.
ssl-server 1 ssl-queue-delay 0
Also, when accessing the content via HTTPS is any of the content or URLs requested to deliver the content in HTTP? You can verify this through capturing your HTTP header information.
Another thing, when accessing the content through HTTPS do you experience any timeouts or content does not get displayed?
- Jason Espino

Where can I download free Java Libraries supporting FTPS(FTP+SSL)

as the title, thanks!

Ya, I have found some valuable information
but if anyone has encounted the same problem, his experience will be very favorable for me
Thanks

FTP SSL trouble

Similar Messages

Maybe you are looking for