| root@ubuntu1204-vm1:~# tail -1 /etc/lsb-release DISTRIB_DESCRIPTION="Ubuntu 12.04.2 LTS" root@ubuntu1204-vm1:~# uname -ri 3.2.0-37-generic x86_64 |
install vsftpd via apt-get.
| root@ubuntu1204-vm1:~# apt-get install vsftpd -y root@ubuntu1204-vm1:~# vsftpd -v vsftpd: version 2.3.5 |
backup the original config file.
| root@ubuntu1204-vm1:~# cp /etc/vsftpd.conf /etc/vsftpd.conf.org |
make a private key and a self signed certificate for FTPS.
private key
| root@ubuntu1204-vm1:~# openssl genrsa -des3 -out /etc/vsftpd_ssl_keys/private.key 2048 Generating RSA private key, 2048 bit long modulus ..................................................................................+++ .+++ e is 65537 (0x10001) Enter pass phrase for /etc/vsftpd_ssl_keys/private.key: Verifying - Enter pass phrase for /etc/vsftpd_ssl_keys/private.key: |
make a CSR
| root@ubuntu1204-vm1:~# openssl genrsa -des3 -out /etc/vsftpd_ssl_keys/private.key 2048 Generating RSA private key, 2048 bit long modulus ..................................................................................+++ .+++ e is 65537 (0x10001) Enter pass phrase for /etc/vsftpd_ssl_keys/private.key: Verifying - Enter pass phrase for /etc/vsftpd_ssl_keys/private.key: root@ubuntu1204-vm1:~# openssl req -new -key /etc/vsftpd_ssl_keys/private.key -out /etc/vsftpd_ssl_keys/server.csr Enter pass phrase for /etc/vsftpd_ssl_keys/private.key: You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [AU]:JP State or Province Name (full name) [Some-State]: Locality Name (eg, city) []: Organization Name (eg, company) [Internet Widgits Pty Ltd]: Organizational Unit Name (eg, section) []: Common Name (e.g. server FQDN or YOUR name) []:foo.com Email Address []: Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []: An optional company name []: |
remove passphrase from the private key.
| root@ubuntu1204-vm1:~# cp /etc/vsftpd_ssl_keys/private.key /etc/vsftpd_ssl_keys/private.key.org root@ubuntu1204-vm1:~# openssl rsa -in /etc/vsftpd_ssl_keys/private.key.org -out /etc/vsftpd_ssl_keys/private.key Enter pass phrase for /etc/vsftpd_ssl_keys/private.key.org: writing RSA key |
make a self signed certificate
| root@ubuntu1204-vm1:~# openssl x509 -req -days 365 -in /etc/vsftpd_ssl_keys/server.csr -signkey /etc/vsftpd_ssl_keys/private.key -out /etc/vsftpd_ssl_keys/server.crt Signature ok subject=/C=JP/ST=Some-State/O=Internet Widgits Pty Ltd/CN=foo.com Getting Private key |
vsftpd.conf
| root@ubuntu1204-vm1:~# cat /etc/vsftpd.conf # use vsftpd as a standalone mode instead of using vsftpd via inetd listen=YES # listen port for control channel listen_port=21 # Limit passive ports to this range to assis firewalling pasv_enable=YES pasv_min_port=30000 pasv_max_port=30003 # active mode connect_from_port_20=YES ftp_data_port=20 # Set to ssl_enable=YES if you want to enable SSL ssl_enable=YES idle_session_timeout=900 log_ftp_protocol=YES ssl_sslv2=YES ssl_sslv3=YES ssl_tlsv1=YES # Path to the certificate and the private key rsa_cert_file=/etc/vsftpd_ssl_keys/server.crt rsa_private_key_file=/etc/vsftpd_ssl_keys/private.key # disallow anonymous users allow_anon_ssl=NO # All local logins (i.e. non-anonymous) are forced to use ssl. force_local_logins_ssl=YES force_local_data_ssl=YES require_ssl_reuse=NO root@ubuntu1204-vm1:~# |
start vsftpd
| root@ubuntu1204-vm1:~# service vsftpd restart vsftpd stop/waiting vsftpd start/running, process 6372 root@ubuntu1204-vm1:~# service vsftpd status vsftpd start/running, process 6372 root@ubuntu1204-vm1:~# lsof -ni:21 COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME vsftpd 6372 root 3u IPv4 18498 0t0 TCP *:ftp (LISTEN) |
prepare FTPS client. I installed lftp as FTPS client. ( I installed vsftpd and lftp on the same box )
| root@ubuntu1204-vm1:~# apt-get install -y lftp root@ubuntu1204-vm1:~# lftp --version LFTP | Version 4.3.3 | Copyright (c) 1996-2011 Alexander V. Lukyanov LFTP is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with LFTP. If not, see <http://www.gnu.org/licenses/>. Send bug reports and questions to the mailing list <lftp@uniyar.ac.ru>. Libraries used: Readline 6.2, GnuTLS 2.12.14, zlib 1.2.3.4 |
connect to the vsftpd over FTPS
nn , can’t connect ..
| root@ubuntu1204-vm1:~# lftp lftp test01@127.0.0.1:~> set ssl:verify-certificate no lftp test01@127.0.0.1:~> set ftp:ssl-protect-data true lftp test01@127.0.0.1:~> set ftp:ssl-force true lftp test01@127.0.0.1:~> set ftp:ssl-auth TLS lftp test01@127.0.0.1:~> set ftp:initial-prot "" lftp test01@127.0.0.1:~> open -u test01 -p21 ftp://127.0.0.1 Password: lftp test01@127.0.0.1:~> ls `ls' at 0 [Delaying before reconnect: 32] Interrupt lftp test01@127.0.0.1:~> set ssl:verify-certificate no lftp test01@127.0.0.1:~> set ftp:ssl-protect-data true lftp test01@127.0.0.1:~> set ftp:ssl-force true lftp test01@127.0.0.1:~> set ftp:ssl-auth SSL lftp test01@127.0.0.1:~> set ftp:initial-prot "" lftp test01@127.0.0.1:~> open -u test01 -p21 ftp://127.0.0.1 Password: lftp test01@127.0.0.1:~> ls `ls' at 0 [Delaying before reconnect: 17] |
How about adding “ssl_ciphers=HIGH” in vsftpd.conf ??
| root@ubuntu1204-vm1:~# cat /etc/vsftpd.conf # use vsftpd as a standalone mode instead of using vsftpd via inetd listen=YES # listen port for control channel listen_port=21 # Limit passive ports to this range to assis firewalling pasv_enable=YES pasv_min_port=30000 pasv_max_port=30003 # active mode connect_from_port_20=YES ftp_data_port=20 # Set to ssl_enable=YES if you want to enable SSL ssl_enable=YES idle_session_timeout=900 log_ftp_protocol=YES ssl_sslv2=YES ssl_sslv3=YES ssl_tlsv1=YES # Path to the certificate and the private key rsa_cert_file=/etc/vsftpd_ssl_keys/server.crt rsa_private_key_file=/etc/vsftpd_ssl_keys/private.key # disallow anonymous users allow_anon_ssl=NO # All local logins (i.e. non-anonymous) are forced to use ssl. force_local_logins_ssl=YES force_local_data_ssl=YES require_ssl_reuse=NO # Select which SSL ciphers vsftpd will allow for encrypted SSL connections (required by FileZilla) ssl_ciphers=HIGH |
restart vsftpd.
| # /etc/init.d/vsftpd restart |
still can’t connect..
| root@ubuntu1204-vm1:~# lftp lftp :~> set ssl:verify-certificate no lftp :~> set ftp:ssl-protect-data true lftp :~> set ftp:ssl-force true lftp :~> set ftp:ssl-auth TLS lftp :~> set ftp:initial-prot "" lftp :~> open -u test01 -p21 ftp://127.0.0.1 Password: lftp test01@127.0.0.1:~> ls Interrupt lftp test01@127.0.0.1:~> lftp test01@127.0.0.1:~> set ssl:verify-certificate no lftp test01@127.0.0.1:~> set ftp:ssl-protect-data true lftp test01@127.0.0.1:~> set ftp:ssl-force true lftp test01@127.0.0.1:~> set ftp:ssl-auth SSL lftp test01@127.0.0.1:~> set ftp:initial-prot "" lftp test01@127.0.0.1:~> open -u test01 -p21 ftp://127.0.0.1 Password: lftp test01@127.0.0.1:~> ls Interrupt lftp test01@127.0.0.1:~> bye |
I edited vsftpd.conf like this:
| root@ubuntu1204-vm1:~# cat /etc/vsftpd.conf listen=YES anonymous_enable=NO local_enable=YES write_enable=YES ascii_upload_enable=YES ascii_download_enable=YES ls_recurse_enable=YES use_localtime=YES # FTPS log_ftp_protocol=YES idle_session_timeout=900 ssl_enable=YES # Path to the certificate and the private key rsa_cert_file=/etc/vsftpd_ssl_keys/server.crt rsa_private_key_file=/etc/vsftpd_ssl_keys/private.key |
I could connect to the vsftpd box over FTPS.
However I’m not sure which options in vsftpd.conf are wrong , so I need to look into the root cause.
| root@ubuntu1204-vm1:~# lftp lftp :~> set ssl:verify-certificate no lftp :~> set ftp:ssl-protect-data true lftp :~> set ftp:ssl-force true lftp :~> set ftp:ssl-auth TLS lftp :~> set ftp:initial-prot "" lftp :~> open -u test01 -p21 ftp://127.0.0.1 Password: lftp test01@127.0.0.1:~> ls -rw-r--r-- 1 1001 1001 6 Feb 14 23:38 hello.txt lftp test01@127.0.0.1:~> bye root@ubuntu1204-vm1:~# root@ubuntu1204-vm1:~# lftp lftp :~> set ssl:verify-certificate no lftp :~> set ftp:ssl-protect-data true lftp :~> set ftp:ssl-force true lftp :~> set ftp:ssl-auth SSL lftp :~> set ftp:initial-prot "" lftp :~> open -u test01 -p21 ftp://127.0.0.1 Password: lftp test01@127.0.0.1:~> ls -rw-r--r-- 1 1001 1001 6 Feb 14 23:38 hello.txt lftp test01@127.0.0.1:~> bye |
cap data when using FTPS
| root@ubuntu1204-vm1:~# tshark -nr ftps.pcap 1 0.000000 127.0.0.1 -> 127.0.0.1 TCP 74 36468 > 21 [SYN] Seq=0 Win=32792 Len=0 MSS=16396 SACK_PERM=1 TSval=1360230 TSecr=0 WS=8 2 0.000023 127.0.0.1 -> 127.0.0.1 TCP 74 21 > 36468 [SYN, ACK] Seq=0 Ack=1 Win=32768 Len=0 MSS=16396 SACK_PERM=1 TSval=1360230 TSecr=1360230 WS=8 3 0.000040 127.0.0.1 -> 127.0.0.1 TCP 66 36468 > 21 [ACK] Seq=1 Ack=1 Win=32792 Len=0 TSval=1360230 TSecr=1360230 4 0.007941 127.0.0.1 -> 127.0.0.1 FTP 86 Response: 220 (vsFTPd 2.3.5) 5 0.008022 127.0.0.1 -> 127.0.0.1 TCP 66 36468 > 21 [ACK] Seq=1 Ack=21 Win=32776 Len=0 TSval=1360232 TSecr=1360232 6 0.008234 127.0.0.1 -> 127.0.0.1 FTP 72 Request: FEAT 7 0.008251 127.0.0.1 -> 127.0.0.1 TCP 66 21 > 36468 [ACK] Seq=21 Ack=7 Win=32768 Len=0 TSval=1360232 TSecr=1360232 8 0.008392 127.0.0.1 -> 127.0.0.1 FTP 81 Response: 211-Features: 9 0.008485 127.0.0.1 -> 127.0.0.1 FTP 77 Response: AUTH TLS 10 0.008538 127.0.0.1 -> 127.0.0.1 TCP 66 36468 > 21 [ACK] Seq=7 Ack=47 Win=32768 Len=0 TSval=1360232 TSecr=1360232 11 0.008610 127.0.0.1 -> 127.0.0.1 FTP 73 Response: EPRT 12 0.008767 127.0.0.1 -> 127.0.0.1 FTP 73 Response: EPSV 13 0.008818 127.0.0.1 -> 127.0.0.1 TCP 66 36468 > 21 [ACK] Seq=7 Ack=61 Win=32768 Len=0 TSval=1360233 TSecr=1360232 14 0.008886 127.0.0.1 -> 127.0.0.1 FTP 73 Response: MDTM 15 0.008960 127.0.0.1 -> 127.0.0.1 FTP 73 Response: PASV 16 0.009008 127.0.0.1 -> 127.0.0.1 TCP 66 36468 > 21 [ACK] Seq=7 Ack=75 Win=32768 Len=0 TSval=1360233 TSecr=1360233 17 0.009072 127.0.0.1 -> 127.0.0.1 FTP 73 Response: PBSZ 18 0.009142 127.0.0.1 -> 127.0.0.1 FTP 73 Response: PROT 19 0.009252 127.0.0.1 -> 127.0.0.1 TCP 66 36468 > 21 [ACK] Seq=7 Ack=89 Win=32768 Len=0 TSval=1360233 TSecr=1360233 20 0.009320 127.0.0.1 -> 127.0.0.1 FTP 80 Response: REST STREAM 21 0.009394 127.0.0.1 -> 127.0.0.1 FTP 73 Response: SIZE 22 0.009440 127.0.0.1 -> 127.0.0.1 TCP 66 36468 > 21 [ACK] Seq=7 Ack=110 Win=32768 Len=0 TSval=1360233 TSecr=1360233 23 0.009458 127.0.0.1 -> 127.0.0.1 FTP 73 Response: TVFS 24 0.009478 127.0.0.1 -> 127.0.0.1 FTP 73 Response: UTF8 25 0.009491 127.0.0.1 -> 127.0.0.1 TCP 66 36468 > 21 [ACK] Seq=7 Ack=124 Win=32768 Len=0 TSval=1360233 TSecr=1360233 26 0.009512 127.0.0.1 -> 127.0.0.1 FTP 75 Response: 211 End 27 0.009592 127.0.0.1 -> 127.0.0.1 FTP 76 Request: AUTH TLS 28 0.009660 127.0.0.1 -> 127.0.0.1 FTP 97 Response: 234 Proceed with negotiation. 29 0.036846 127.0.0.1 -> 127.0.0.1 FTP 183 Request: \026\003\000\000p\001\000\000l\003\003Q\035"[ԯ\205\177��l$e^�\026qRB\000d�cSti�\035d\255�\230\000\0000\0003\000g\000E\0009\000k\000\210\000\026\0002\000@\000D\0008\000j\000\207\000\023\000f\000/\000<\000A\0005\000=\000\204\000 30 0.037101 127.0.0.1 -> 127.0.0.1 FTP 1034 Response: \026\003\003\000Q\002\000\000M\003\003Q\035"[a֩\006'�\204�\220\t\f��\204\230=\a�,���rWR!�R �/\200R�ad����dP\212 31 0.037987 127.0.0.1 -> 127.0.0.1 FTP 345 Request: \026\003\003\000\a\v\000\000\003\000\000\000\026\003\003\001\006\020\000\001\002\001\000`\006��4^A�\231�\220=\034jB�⤴6�\234 I0�����\220�B\016�}(�\035��\035\004ө^ 32 0.076757 127.0.0.1 -> 127.0.0.1 TCP 66 21 > 36468 [ACK] Seq=1132 Ack=413 Win=32768 Len=0 TSval=1360250 TSecr=1360240 33 0.076802 127.0.0.1 -> 127.0.0.1 FTP 221 Request: \024\003\003\000\001\001\026\003\003\000\220�&0\226�\035�I 34 0.077257 127.0.0.1 -> 127.0.0.1 TCP 66 21 > 36468 [ACK] Seq=1132 Ack=568 Win=32768 Len=0 TSval=1360250 TSecr=1360250 35 0.077524 127.0.0.1 -> 127.0.0.1 FTP 125 Response: \024\003\003\000\001\001\026\003\003\0000M�t\002/E\227\255\v��HD\002\255���\220�j\215��\b\b(�a\034X\231\224Ĩ��W��>j\vX�AI\207 36 0.116639 127.0.0.1 -> 127.0.0.1 TCP 66 36468 > 21 [ACK] Seq=568 Ack=1191 Win=32768 Len=0 TSval=1360260 TSecr=1360250 37 0.124476 127.0.0.1 -> 127.0.0.1 FTP 295 Request: \027\003\003\000�\�*3�-_4l\002\017�L�W5\207�\255*�K�=��X��i�\226}\001{\212�\037y.���"�\214�#A�\f��I�\230=\016j��{tM\027��x&�\0240�\v�]*�Y鴳'\233J�\233�s\031+[K~�x"\031\221x\f<\016\a����(\001`�\005��\031\207lW|_<�(�~\002u����\237�\035�\034ì\202}���0�\006\255g�\034f�]��\A ���\000\222\212\220D\t\b�\003\236\215\u\255��\234�\v\016\036�\201�l�\211w�lA�k�\030���\177\200F\217\030y\222\23096\a��\032Lc;�k�G�\203� 38 0.124562 127.0.0.1 -> 127.0.0.1 FTP 127 Response: \027\003\003\0008�\223\200\002��\206��-;\207V\206�)d(06\003�����>�\000�\233�\233\217�\213�\205\225Y\022��\023%F��-\2263�\005G\036\231 39 0.124569 127.0.0.1 -> 127.0.0.1 TCP 66 36468 > 21 [ACK] Seq=797 Ack=1252 Win=32768 Len=0 TSval=1360261 TSecr=1360261 40 0.124729 127.0.0.1 -> 127.0.0.1 FTP 135 Request: \027\003\003\000@z\fWZ\030e!X8\177��\214�n��\030�M�\217�\031\215\017w\216�gh���B�k��b����d�\035���]\221^I\231\224|��(��A\231 41 0.124772 127.0.0.1 -> 127.0.0.1 FTP 135 Response: \027\003\003\000@\000C~\236Jv\212�&"�\233\223_\230*�\v��jV\003\206(\2024\206JG\032��e 42 0.124964 127.0.0.1 -> 127.0.0.1 FTP 127 Request: \027\003\003\0008t"�\202��4���0�\216*B�gJ&D\021u�\2057��'��\231 43 0.137038 127.0.0.1 -> 127.0.0.1 FTP 127 Response: \027\003\003\0008\026\232��K\035z�H�W\025��\226��i%~��^s�\203.�\t���(�7i�\221�$y%�\t(ۼ�î�q��� 44 0.137192 127.0.0.1 -> 127.0.0.1 FTP 311 Request: \027\003\003\000��L/¤7\203G�s��輥J�I\202\025!���uu6\001]�H�fJ\215\006�������7y\016���@�#>�\025\217�\021Ԭb\022"\227\216�+�\036[_�W�\003}/w�=\030\227]��Z�!kG���\212%��\032ry�\035��q?O>�\000zTD�\035\207�@\235�x\221%��\226;&4km\037ĥ\036f\004�]\206i�al��k=�\232\177�v��\2347���\205o�s�\017=\217�z�*�{�v\221�\232@\001O\005�)�*��\�z�mR��C�P�\024&�\232!w�m'�=�s{���\002\215�`\234���?\231POp4��\020-\032 45 0.137315 127.0.0.1 -> 127.0.0.1 FTP 127 Response: \027\003\003\0008_8��\016Q�5 S\b2��<\000�\a.\f��Ū�e�\026�\2148n\235��ѻ�^_\233Q\221\234ֹ���d\027\b� 46 0.138526 127.0.0.1 -> 127.0.0.1 FTP 135 Request: \027\003\003\000@+��\236n!\024�7\235\006��\222\033�\000Ĥ�~{[��\214�?\216d�\213.\004��c�D����\016OI\230�VE\230O\035��d\234\035�"L�$ 47 0.138632 127.0.0.1 -> 127.0.0.1 FTP 127 Response: \027\003\003\0008�w\036��"�w 48 0.138721 127.0.0.1 -> 127.0.0.1 FTP 183 Request: \027\003\003\000p�ut\221P�qp�L�b��sɦ�q1��,��J\232`0�il\004\236��\2102>\233\225\003Z/M\236\025��M\037�\025��\001lH}f�fO5\215A�o�\200\204۪\222g\221�����^�\202�y\223%�����\002}�?\0370�vBw��*gZ\230O� 49 0.138813 127.0.0.1 -> 127.0.0.1 FTP 127 Response: \027\003\003\0008�Yg?�0q\204��78�G#5���\004��MpK�\215Q����1�{��\225m p\206\035A���?\205\236�\037RN\006\017 50 0.138904 127.0.0.1 -> 127.0.0.1 FTP 303 Request: \027\003\003\000��@\213\2237!\002\004x\016#4�D|�Ϋ9jo�\035��S\003{C��1 51 0.138999 127.0.0.1 -> 127.0.0.1 FTP 127 Response: \027\003\003\0008+X�\016�"y\236]�YzW` 52 0.139170 127.0.0.1 -> 127.0.0.1 FTP 247 Request: \027\003\003\000�\211\035��%�\213�8\004���=�aXW@��\210�\f-\035\222�mo\233d��(8n\230\206\236�p'p\201\005�s�\255*�\026\0039Р\002_\{�mB�\004h��I\006I(S�\235lU\212X�,*��C�R-(��D\210F��w��i\f�\206W��\216y��\202\215\221��9\203�\230\255\022�o�T�\233\000\214s�EEn\035�\020\025\027\006\227,�DS�S��R�.�)\215|e.\214\2167ν\025\023}��o�\000\223�t\000 53 0.139330 127.0.0.1 -> 127.0.0.1 FTP 151 Response: \027\003\003\000P\210zg�\2243�N\033��6p\vs�d�\023Pv-\001�ܳ\237\033�\211\234I�\226\200\003�{�Ҩ\217�L\214\t9\005�)�\v�\026�tj����\230RE緿�\234>�ys~x\233q��$ 54 0.139455 127.0.0.1 -> 127.0.0.1 TCP 74 53114 > 61287 [SYN] Seq=0 Win=32792 Len=0 MSS=16396 SACK_PERM=1 TSval=1360265 TSecr=0 WS=8 55 0.139463 127.0.0.1 -> 127.0.0.1 TCP 74 61287 > 53114 [SYN, ACK] Seq=0 Ack=1 Win=32768 Len=0 MSS=16396 SACK_PERM=1 TSval=1360265 TSecr=1360265 WS=8 56 0.139468 127.0.0.1 -> 127.0.0.1 TCP 66 53114 > 61287 [ACK] Seq=1 Ack=1 Win=32792 Len=0 TSval=1360265 TSecr=1360265 57 0.139538 127.0.0.1 -> 127.0.0.1 FTP 263 Request: \027\003\003\000�\214x\224\004g\235�o�\024sx�j\031zf\000��\213\031�\212)��&\230\234[ඨ\031{�\217�#��P�\222\0371\027r�l�*�\2021-\t�ON��\026\207\225[\202r-��Ϊ���*P�\000\212�X\211"rη�\t�\024�F��Ϋ�\214�\023\201�"��N�4��4f\230+C>&Q�\210�\213xegڧ9��\027Jj\005���(�5��\202,#�\033\002��\224c5��I\2310\210�\037��`�\022d���̵D@�A\212*C�\210\\214\177\233�\026 58 0.139735 127.0.0.1 -> 127.0.0.1 FTP 143 Response: \027\003\003\000H\213:��={hJd�p\023�\230��\223(�\026\206�gIá�\226\231��SY�2\004�\211V���\215��Y\032�u0�\030\235\255�\025\032�z�qt��I>d��\210;� 59 0.140054 127.0.0.1 -> 127.0.0.1 TCP 215 53114 > 61287 [PSH, ACK] Seq=1 Ack=1 Win=32792 Len=149 TSval=1360265 TSecr=1360265 60 0.140061 127.0.0.1 -> 127.0.0.1 TCP 66 61287 > 53114 [ACK] Seq=1 Ack=150 Win=32768 Len=0 TSval=1360265 TSecr=1360265 61 0.140289 127.0.0.1 -> 127.0.0.1 TCP 211 61287 > 53114 [PSH, ACK] Seq=1 Ack=150 Win=32768 Len=145 TSval=1360265 TSecr=1360265 62 0.140297 127.0.0.1 -> 127.0.0.1 TCP 66 53114 > 61287 [ACK] Seq=150 Ack=146 Win=32768 Len=0 TSval=1360265 TSecr=1360265 63 0.140708 127.0.0.1 -> 127.0.0.1 TCP 72 53114 > 61287 [PSH, ACK] Seq=150 Ack=146 Win=32768 Len=6 TSval=1360266 TSecr=1360265 64 0.176641 127.0.0.1 -> 127.0.0.1 TCP 66 36468 > 21 [ACK] Seq=1973 Ack=1788 Win=32768 Len=0 TSval=1360275 TSecr=1360265 65 0.184665 127.0.0.1 -> 127.0.0.1 TCP 66 61287 > 53114 [ACK] Seq=146 Ack=156 Win=32768 Len=0 TSval=1360277 TSecr=1360266 66 0.184680 127.0.0.1 -> 127.0.0.1 TCP 167 53114 > 61287 [PSH, ACK] Seq=156 Ack=146 Win=32768 Len=101 TSval=1360277 TSecr=1360277 67 0.184716 127.0.0.1 -> 127.0.0.1 TCP 66 61287 > 53114 [ACK] Seq=146 Ack=257 Win=32768 Len=0 TSval=1360277 TSecr=1360277 68 0.184910 127.0.0.1 -> 127.0.0.1 TCP 167 61287 > 53114 [PSH, ACK] Seq=146 Ack=257 Win=32768 Len=101 TSval=1360277 TSecr=1360277 69 0.224752 127.0.0.1 -> 127.0.0.1 TCP 66 53114 > 61287 [ACK] Seq=257 Ack=247 Win=32768 Len=0 TSval=1360287 TSecr=1360277 70 0.224905 127.0.0.1 -> 127.0.0.1 TCP 103 61287 > 53114 [PSH, ACK] Seq=247 Ack=257 Win=32768 Len=37 TSval=1360287 TSecr=1360287 71 0.224924 127.0.0.1 -> 127.0.0.1 TCP 66 53114 > 61287 [ACK] Seq=257 Ack=284 Win=32768 Len=0 TSval=1360287 TSecr=1360287 72 0.225731 127.0.0.1 -> 127.0.0.1 TCP 66 53114 > 61287 [FIN, ACK] Seq=257 Ack=284 Win=32768 Len=0 TSval=1360287 TSecr=1360287 73 0.225978 127.0.0.1 -> 127.0.0.1 TCP 66 61287 > 53114 [FIN, ACK] Seq=284 Ack=258 Win=32768 Len=0 TSval=1360287 TSecr=1360287 74 0.226000 127.0.0.1 -> 127.0.0.1 TCP 66 53114 > 61287 [ACK] Seq=258 Ack=285 Win=32768 Len=0 TSval=1360287 TSecr=1360287 75 0.226239 127.0.0.1 -> 127.0.0.1 FTP 127 Response: \027\003\003\0008�+?t`\177&�}�Y<�\v\2155\031P�\223}R���&|Ҥ/I�&\201^��ݢ�f}\021\231��\223\006R�� �\234 76 0.226448 127.0.0.1 -> 127.0.0.1 TCP 66 36468 > 21 [ACK] Seq=1973 Ack=1849 Win=32768 Len=0 TSval=1360287 TSecr=1360287 77 1.783819 127.0.0.1 -> 127.0.0.1 FTP 295 Request: \027\003\003\000�xi\016�\234�_\210�����㯴C\224%\226e%r�yb��Fרpke\023^G?T\212�G�aWa\000�;(�Sx���\201��|;\b\025C�{\233\032�\216��Nɴ<s 78 1.784247 127.0.0.1 -> 127.0.0.1 FTP 119 Response: \027\003\003\0000B���8���a\213\227��zK\026Q�\024�Q�Ǿ�/\223\207\025N\1�\bp1\f'��\232wj�Y\026*< 79 1.784269 127.0.0.1 -> 127.0.0.1 TCP 66 36468 > 21 [ACK] Seq=2202 Ack=1902 Win=32768 Len=0 TSval=1360676 TSecr=1360676 80 1.784310 127.0.0.1 -> 127.0.0.1 TCP 66 21 > 36468 [FIN, ACK] Seq=1902 Ack=2202 Win=32768 Len=0 TSval=1360676 TSecr=1360676 81 1.787788 127.0.0.1 -> 127.0.0.1 TCP 66 36468 > 21 [RST, ACK] Seq=2202 Ack=1903 Win=32768 Len=0 TSval=1360677 TSecr=1360676 |
cap data when using non FTP
| root@ubuntu1204-vm1:~# lftp lftp :~> open -u test01 -p21 ftp://127.0.0.1 Password: lftp test01@127.0.0.1:~> ls -rw-r--r-- 1 1001 1001 6 Feb 14 23:38 hello.txt lftp test01@127.0.0.1:~> bye root@ubuntu1204-vm1:~# |
| root@ubuntu1204-vm1:~# tshark -nr non-ftps.pcap 1 0.000000 127.0.0.1 -> 127.0.0.1 TCP 74 36471 > 21 [SYN] Seq=0 Win=32792 Len=0 MSS=16396 SACK_PERM=1 TSval=1422273 TSecr=0 WS=8 2 0.000024 127.0.0.1 -> 127.0.0.1 TCP 74 21 > 36471 [SYN, ACK] Seq=0 Ack=1 Win=32768 Len=0 MSS=16396 SACK_PERM=1 TSval=1422273 TSecr=1422273 WS=8 3 0.000040 127.0.0.1 -> 127.0.0.1 TCP 66 36471 > 21 [ACK] Seq=1 Ack=1 Win=32792 Len=0 TSval=1422273 TSecr=1422273 4 0.007654 127.0.0.1 -> 127.0.0.1 FTP 86 Response: 220 (vsFTPd 2.3.5) 5 0.007740 127.0.0.1 -> 127.0.0.1 TCP 66 36471 > 21 [ACK] Seq=1 Ack=21 Win=32776 Len=0 TSval=1422275 TSecr=1422275 6 0.007905 127.0.0.1 -> 127.0.0.1 FTP 72 Request: FEAT 7 0.007922 127.0.0.1 -> 127.0.0.1 TCP 66 21 > 36471 [ACK] Seq=21 Ack=7 Win=32768 Len=0 TSval=1422275 TSecr=1422275 8 0.008135 127.0.0.1 -> 127.0.0.1 FTP 81 Response: 211-Features: 9 0.008233 127.0.0.1 -> 127.0.0.1 FTP 73 Response: EPRT 10 0.008284 127.0.0.1 -> 127.0.0.1 TCP 66 36471 > 21 [ACK] Seq=7 Ack=43 Win=32768 Len=0 TSval=1422276 TSecr=1422276 11 0.008354 127.0.0.1 -> 127.0.0.1 FTP 73 Response: EPSV 12 0.008427 127.0.0.1 -> 127.0.0.1 FTP 73 Response: MDTM 13 0.008475 127.0.0.1 -> 127.0.0.1 TCP 66 36471 > 21 [ACK] Seq=7 Ack=57 Win=32768 Len=0 TSval=1422276 TSecr=1422276 14 0.008539 127.0.0.1 -> 127.0.0.1 FTP 73 Response: PASV 15 0.008638 127.0.0.1 -> 127.0.0.1 FTP 80 Response: REST STREAM 16 0.008687 127.0.0.1 -> 127.0.0.1 TCP 66 36471 > 21 [ACK] Seq=7 Ack=78 Win=32768 Len=0 TSval=1422276 TSecr=1422276 17 0.008751 127.0.0.1 -> 127.0.0.1 FTP 73 Response: SIZE 18 0.008820 127.0.0.1 -> 127.0.0.1 FTP 73 Response: TVFS 19 0.008866 127.0.0.1 -> 127.0.0.1 TCP 66 36471 > 21 [ACK] Seq=7 Ack=92 Win=32768 Len=0 TSval=1422276 TSecr=1422276 20 0.008927 127.0.0.1 -> 127.0.0.1 FTP 73 Response: UTF8 21 0.009006 127.0.0.1 -> 127.0.0.1 FTP 75 Response: 211 End 22 0.009054 127.0.0.1 -> 127.0.0.1 TCP 66 36471 > 21 [ACK] Seq=7 Ack=108 Win=32768 Len=0 TSval=1422276 TSecr=1422276 23 0.009341 127.0.0.1 -> 127.0.0.1 FTP 80 Request: OPTS UTF8 ON 24 0.009436 127.0.0.1 -> 127.0.0.1 FTP 92 Response: 200 Always in UTF8 mode. 25 0.009646 127.0.0.1 -> 127.0.0.1 FTP 79 Request: USER test01 26 0.009749 127.0.0.1 -> 127.0.0.1 FTP 100 Response: 331 Please specify the password. 27 0.010080 127.0.0.1 -> 127.0.0.1 FTP 79 Request: PASS test01 28 0.028178 127.0.0.1 -> 127.0.0.1 FTP 89 Response: 230 Login successful. 29 0.028245 127.0.0.1 -> 127.0.0.1 FTP 71 Request: PWD 30 0.028290 127.0.0.1 -> 127.0.0.1 FTP 86 Response: 257 "/home/test01" 31 0.029473 127.0.0.1 -> 127.0.0.1 FTP 72 Request: PASV 32 0.029572 127.0.0.1 -> 127.0.0.1 FTP 113 Response: 227 Entering Passive Mode (127,0,0,1,145,78). 33 0.029660 127.0.0.1 -> 127.0.0.1 TCP 74 51140 > 37198 [SYN] Seq=0 Win=32792 Len=0 MSS=16396 SACK_PERM=1 TSval=1422281 TSecr=0 WS=8 34 0.029668 127.0.0.1 -> 127.0.0.1 TCP 74 37198 > 51140 [SYN, ACK] Seq=0 Ack=1 Win=32768 Len=0 MSS=16396 SACK_PERM=1 TSval=1422281 TSecr=1422281 WS=8 35 0.029672 127.0.0.1 -> 127.0.0.1 TCP 66 51140 > 37198 [ACK] Seq=1 Ack=1 Win=32792 Len=0 TSval=1422281 TSecr=1422281 36 0.029712 127.0.0.1 -> 127.0.0.1 FTP 72 Request: LIST 37 0.029806 127.0.0.1 -> 127.0.0.1 FTP 105 Response: 150 Here comes the directory listing. 38 0.029905 127.0.0.1 -> 127.0.0.1 FTP-DATA 133 FTP Data: 67 bytes 39 0.029912 127.0.0.1 -> 127.0.0.1 TCP 66 51140 > 37198 [ACK] Seq=1 Ack=68 Win=32768 Len=0 TSval=1422281 TSecr=1422281 40 0.031286 127.0.0.1 -> 127.0.0.1 TCP 66 37198 > 51140 [FIN, ACK] Seq=68 Ack=1 Win=32768 Len=0 TSval=1422281 TSecr=1422281 41 0.031336 127.0.0.1 -> 127.0.0.1 TCP 66 51140 > 37198 [FIN, ACK] Seq=1 Ack=69 Win=32768 Len=0 TSval=1422281 TSecr=1422281 42 0.031343 127.0.0.1 -> 127.0.0.1 TCP 66 37198 > 51140 [ACK] Seq=69 Ack=2 Win=32768 Len=0 TSval=1422281 TSecr=1422281 43 0.031380 127.0.0.1 -> 127.0.0.1 FTP 90 Response: 226 Directory send OK. 44 0.031396 127.0.0.1 -> 127.0.0.1 TCP 66 36471 > 21 [ACK] Seq=64 Ack=321 Win=32768 Len=0 TSval=1422281 TSecr=1422281 45 1.335075 127.0.0.1 -> 127.0.0.1 FTP 72 Request: QUIT 46 1.335209 127.0.0.1 -> 127.0.0.1 FTP 80 Response: 221 Goodbye. 47 1.335236 127.0.0.1 -> 127.0.0.1 TCP 66 21 > 36471 [FIN, ACK] Seq=335 Ack=70 Win=32768 Len=0 TSval=1422607 TSecr=1422607 48 1.338249 127.0.0.1 -> 127.0.0.1 TCP 66 36471 > 21 [RST, ACK] Seq=70 Ack=336 Win=32768 Len=0 TSval=1422608 TSecr=1422607 root@ubuntu1204-vm1:~# |
No comments:
Post a Comment
Note: Only a member of this blog may post a comment.