我正在设置我们的ftp服务器（pure-ftpd-1.0.21-r1）以使用TLS / SSL。 它在我不使用TLS时起作用。
从命令选项开始：
-S 21 -c 30 -C 10 -B -k 90% -A -R -Z -p 49152:65534 -U 013 -s --tls=1 。
Response: 230 OK. Current restricted directory is / Command: SYST Response: 215 UNIX Type: L8 Command: FEAT Response: 211-Extensions supported: Response: EPRT Response: IDLE Response: MDTM Response: SIZE Response: REST STREAM Response: MLST type*;size*;sizd*;modify*;UNIX.mode*;UNIX.uid*;UNIX.gid*;unique*; Response: MLSD Response: TVFS Response: ESTP Response: PASV Response: EPSV Response: SPSV Response: ESTA Response: AUTH TLS Response: PBSZ Response: PROT Response: 211 End. Status: Connected Status: Retrieving directory listing... Command: PWD Response: 257 "/" is your current location Command: TYPE I Response: 200 TYPE is now 8-bit binary Command: PASV Response: 227 Entering Passive Mode (76,65,xxx,xxx,228,146) #last octets removed to protect the guilty Command: MLSD Response: 150 Accepted data connection Response: 226-ASCII Response: 226-Options: -l Response: 226 54 matches total Status: Directory listing successful Status: Disconnected from server
当我使用TLS时：
Response: 220---------- Welcome to Pure-FTPd [privsep] [TLS] ---------- Response: 220-You are user number 4 of 30 allowed. Response: 220-Local time is now 09:19. Server port: 21. Response: 220-IPv6 connections are also welcome on this server. Response: 220 You will be disconnected after 15 minutes of inactivity. Command: AUTH TLS Response: 234 AUTH TLS OK. Status: Initializing TLS... Status: Verifying certificate... Command: USER john Status: TLS/SSL connection established. Response: 331 User john OK. Password required Command: PASS ******** Response: 230-User john has group access to: svn anonymou proftpd powercor john Response: 230- users usb ftp Response: 230 OK. Current restricted directory is / Command: SYST #....same as above Response: 200 TYPE is now 8-bit binary Command: PASV Response: 227 Entering Passive Mode (192,168,15,2,198,194) Status: Server sent passive reply with unroutable address. Using server address instead. Command: MLSD Error: Connection timed out Error: Failed to retrieve directory listing
我的猜测是你的FTP服务器位于NAT防火墙的后面，并且你已经在防火墙设备上运行了ip_conntrack_ftp帮助模块（或者等效的模块）。 基本上，这个模块扫描数据stream，查找内部IP地址的实例，并将其重写为外部IP地址。 但是，对于TLS安全的FTP连接，它不能这样做，因为它无法解密在飞行中的数据包以查找IP地址（通常认为是好事）。
您的select是：
-P选项，“强制指定的IP地址回复到PASV / EPSV / SPSV命令”。 您必须在被动命令中指定伪装IP。
现在你的被动指令返回192,168,15,2（这是一个私人IP，不能通过公共互联网连接）