[Proftpd-user] Problem setting up FTPS

Proftpd Version: 1.3.6
OS: CentOS 6.10 (kernel: 2.6.32-754.11.1.el6.x86_64)

We have a FTP server that we are attempting to add FTPS support onto,
so I've set up an experimental server to test things.  I can FTP to
the test server just fine, but FTPS fails.  Since this is a test
server, I just created a self-signed key and certificate using this
command:

openssl req -x509 -newkey rsa:4096 -keyout test.ftps.key.pem -out
test.ftps.cert.pem -days 365 -nodes -sha256

Proftpd Config file (with some slight privacy modifications):
ServerName        "NRT (TESTING FTPS)"
ServerType        standalone
DefaultServer        on
DefaultAddress 19x.1y8.1z5.18
PidFile /var/run/simpson_proftpd.pid
ScoreboardFile /var/run/simpson_proftpd.scoreboard
DelayTable /var/run/simpson_proftpd.delay

DeferWelcome    off

Port           21
Umask                   002
TimeoutLogin            120
TimeoutIdle             300
TimeoutNoTransfer       600
TimeoutStalled          1800
PassivePorts            64000 65000
UseReverseDNS   off
IdentLookups   off

UseIPv6           on
MaxInstances         300
User           nobody
Group          nobody

DefaultRoot ~ virtftp

AllowOverwrite    on

TransferLog     /var/log/proftpd/simpson_xferlog
LogFormat       default "%h %l %u %t \"%r\" %s %b"
LogFormat       auth    "%v [%P] %h %t \"%r\" %s"
LogFormat       write   "%h %l %u %t \"%r\" %s %b"
LogFormat       full    "%{%Y%m%d:%T:%Z}t|%h|%v|%P|\"%r\"|%F|%s|%b|"
LogFormat       fulluser    "%{%Y%m%d:%T:%Z}t|%h|%U|%P|\"%r\"|%F|%s|%b|"

<Limit SITE_CHMOD>
  DenyAll
</Limit>
<Limit LOGIN>
   AllowGroup virtftp
   DenyAll
</Limit>

<Limit WRITE>
   Order allow, deny
   Deny from All
</Limit>

<IfModule mod_tls.c>
    TLSEngine on
    TLSLog /var/log/proftpd/simpson_tls.log
    TLSProtocol TLSv1.2
    TLSRequired off
    TLSRSACertificateFile /PANFS/local/etc/certs/test.ftps.cert.pem
    TLSRSACertificateKeyFile /PANFS/local/etc/certs/test.ftps.key.pem
    TLSVerifyClient off
    TLSRenegotiate none
    TLSOptions NoSessionReuseRequired
</IfModule>

<Global>
   DisplayConnect /etc/issue
   DisplayLogin   welcome.msg
   DisplayChdir   readme true
   ExtendedLog    /var/log/proftpd/simpson_access.log WRITE,READ write
   ExtendedLog    /var/log/proftpd/simpson_centralizexfer WRITE,READ write
   ExtendedLog    /var/log/proftpd/simpson_auth.log AUTH auth
   ExtendedLog    /var/log/proftpd/simpson_all.log ALL full
   ExtendedLog    /var/log/proftpd/simpson_centralize ALL full
   ExtendedLog    /var/log/proftpd/simpson_alluser.log ALL fulluser
   AuthUserFile   /PANFS/local/etc/proftpd.virtualuser.passwd
</Global>

lftp ftps://gpmremote08 -u [email protected],*****
lftp [email protected]@remote08:~> ls
`ls' at 0 [Delaying before reconnect: 27]

Nothing logged in simpson_tls.log for above


Attempting connect with openssl s_client:
# openssl s_client -tls1_2 -connect gpmremote08:21 -starttls ftp
CONNECTED(00000003)
47675449906120:error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong
version number:s3_pkt.c:339:
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 398 bytes and written 7 bytes
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : 0000
    Session-ID:
    Session-ID-ctx:
    Master-Key:
    Key-Arg   : None
    Krb5 Principal: None
    PSK identity: None
    PSK identity hint: None
    Start Time: 1552496479
    Timeout   : 7200 (sec)
    Verify return code: 0 (ok)
---

Log entry for above in simpson_tls.log:
2019-03-13 17:01:19,547 mod_tls/2.7[359138]: TLS/TLS-C requested,
starting TLS handshake
2019-03-13 17:01:19,567 mod_tls/2.7[359138]: unable to accept TLS
connection: system call error: [104] Connection reset by peer
2019-03-13 17:01:19,567 mod_tls/2.7[359138]: TLS/TLS-C negotiation
failed on control channel


Based on the lack any key or cert information in the openssl s_client
connect attempt, I'm assuming that I don't have something with those
set up correctly.  So I'm assuming that's the first place to start,
and then I can progress to why 'lftp' doesn't even seem to make a
connection, i.e. nothing shows up in logs about a connection request
at all.

I've been following the example found here:
http://www.proftpd.org/docs/howto/TLS.html, along with additional info
here: http://www.proftpd.org/docs/contrib/mod_tls.html

I'm hopeful that this is just due to me doing something completely
block-headed or missing something simple.  Help is greatly
appreciated!


_______________________________________________
ProFTPD Users List   <[email protected]>
Unsubscribe problems?
http://www.proftpd.org/list-unsub.html