Oracle ZFS Storage Appliance: How to enable both FTP and Encrypted FTP (FTPS) Concurrently

Asset ID:	1-72-2035595.1
Update Date:	2018-01-05
Keywords:

Solution Type Problem Resolution Sure

Solution 2035595.1 : Oracle ZFS Storage Appliance: How to enable both FTP and Encrypted FTP (FTPS) Concurrently

Applies to:

Sun Storage 7310 Unified Storage System - Version All Versions to All Versions [Release All Releases]
Sun Storage 7110 Unified Storage System - Version All Versions to All Versions [Release All Releases]
Sun ZFS Storage 7420 - Version All Versions to All Versions [Release All Releases]
Sun ZFS Storage 7320 - Version All Versions to All Versions [Release All Releases]
Sun ZFS Storage 7120 - Version All Versions to All Versions [Release All Releases]
7000 Appliance OS (Fishworks)

Symptoms

Does ZFS Storage Appliance Support Both FTP and FTPS concurrently?

After enabling TLS (Transport Layer Security), normal FTP fails - but FTPS works

Error message - 550 SSL/TLS required on the control channel

Changes

Enable Encrypted ftp (TLS) at ftp service

Cause

Both FTP and Encrypted FTP can not listen on the same port.

Solution

FTP - File transfer protocol

FTPS - FTP Secure

By default, both the FTP and Encrypted FTP services are set to listen on default port '21'

While enabling the Encrypted FTP, the port for TLS should be set to different from the standard FTP, as both can't listen on same port.

Set the TLS port to 300 and commit (CLI) / Apply (BUI) the changes.

Navigate to configuration --> Services ---> select FTP / Enable 'tls_required' / Set 'tls_port' to 300

zfs-nas1:configuration services ftp> ls
Properties:
                       <status> = online
                   listen_port = 21
                  tls_required = true              <<<<<< Enabled
                      tls_port = 300              <<<<<< set to different port
                    root_login = true
                  delay_engine = false
            max_login_attempts = 3
               max_connections = 30
             logging_verbosity = notice
                  default_root = /
                         umask = 022
         allow_foreign_address = false

Test case
==========
zfs-nas1:configuration services ftp> ls
Properties:
                      <status> = online
                   listen_port = 21
                  tls_required = false
                      tls_port = 21
                    root_login = true
                  delay_engine = false
            max_login_attempts = 3
               max_connections = 30
             logging_verbosity = notice
                  default_root = /
                         umask = 022
         allow_foreign_address = false

% ftp
ftp> open zfs-nas1
Connected to zfs-nas1.
220 ProFTPD 1.3.2e Server (ProFTPD) [::ffff:10.186.85.218]
Name (zfs-nas1:oratest): oratest
331 Password required for oratest
Password:
230 User oratest logged in
Remote system type is UNIX.
Using binary mode to transfer files.
ftp>

======================
### Enabling TLS

zfs-nas1:configuration services ftp> ls
Properties:
                      <status> = online
                   listen_port = 21
                  tls_required = true                                 <<<<<< Enabled
                      tls_port = 21
                    root_login = true
                  delay_engine = false
            max_login_attempts = 3
               max_connections = 30
             logging_verbosity = notice
                  default_root = /
                         umask = 022
         allow_foreign_address = false

% ftp
ftp> open zfs-nas1
Connected to zfs-nas1
220 ProFTPD Server
Name (zfs-nas1:oratest): oratest
550 SSL/TLS required on the control channel          <<<<<< Error message
Login failed.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp>

====================================

zfs-nas1:configuration services ftp> ls
Properties:
                      <status> = online
                   listen_port = 21
                  tls_required = true                             <<<<<< Enabled
                      tls_port = 300                              <<<<<< Set to different port
                    root_login = true
                  delay_engine = false
            max_login_attempts = 3
               max_connections = 30
             logging_verbosity = notice
                  default_root = /
                         umask = 022
         allow_foreign_address = false

% ftp
ftp> open zfs-nas1
Connected to zfs-nas1.
220 ProFTPD 1.3.2e Server (ProFTPD) [::ffff:10.186.85.218]
Name (zfs-nas1:oratest): oratest
331 Password required for oratest
Password:
230 User oratest logged in
Remote system type is UNIX.
Using binary mode to transfer files.
ftp>

References

<NOTE:1555081.1> - Sun Storage 7000 Unified Storage System: How to configure FTP append or proftp AllowStoreRestart
https://en.wikipedia.org/wiki/FTPS

Attachments

This solution has no attachment