Very slow ftp connection using explicit tls

I use ftp to connect to a large number of sites. They all work. I have added a new site but,unlike the others, it requires the use of the secure TLS explicit method. I can connect to the site using it but the response for each connection takes a couple of minutes. I have spoken with the host that manages that server and they said the problem was on my end. Since I've never used this connection method before, I thought maybe there was some other setting in DO that I needed to change for it to work without the delay. I found a post from 2009 for this problem but no fix was mentioned. Does anyone know if there is a way to speed up the connection?

Directory Opus Pro 12.3 Build 6183 x64
OS 6.1 (B:7601 P:2 T:1) SP 1.0 "Service Pack 1"

Have you checked what happens when connecting with the same method, same site and same PC, but using a different FTP client?

Does the FTP log show anything useful, e.g. timeouts and retrying via different encryption protocols?

I just tried Filezilla. When connecting, it displays a message saying the ssl certificate is not known. But after OK'ing that, the connection is fast. I was connected with DO and clicked on a directory. While waiting for that to respond, I went into many directories with Filezilla and back again so the problem has to do with DO, it seems.

Here is the ftp log. I think that DO is waiting on that response from the server.

227 Entering Passive Mode (67,210,125,224,117,161)
150 Accepted data connection
** RDIR NO FD_CLOSE Response from Server **
8406 bytes received in 92.228 seconds (0.0 Kbytes/sec)
226-Options: -a -l
226 106 matches total

I found the 90 second value in the network tab and changed it to 9 seconds. The connection is fast now. Is that the proper fix? What problem might it cause?

Which setting? The Keep link alive setting is the only one set to 90 seconds here, but that should not make any difference to speeds at all.

Under the Use Pasv setting there is a Timeout control where the value can be adjusted.

That suggests something is timing out. Reducing the timeout to a very small value isn't a good idea as it may not wait long enough for things to happen that were going to work.

Based on the log above, have you tried toggling PASV mode in Opus? Is it and everything else set the same way in both clients you have tried?

I tried changing to passive mode and the connection fails with this message, where Servers IP is the remote servers IP and My IP is my computers IP"

500 I won't open a connection to Servers IP (only to My IP)

As far as I can tell, the settings between DO and Filezilla are the same. Filezilla has a "server timeout" setting which I assume is the same timeout DO uses. It is set to 0. But I tried changing it to 2 minutes and it didn't cause a slowdown.

[Merged back into this thread]

I followed the directions for linking support to my posts but never received support for them. When I click on the Account Linking link I get "Oops! That page doesn’t exist or is private." I didn't bother with this before since I thought I found a way around my main issue but it is back and causing me grief. Is there an alternative way to get support or to fix the broken link?

An update to the forum software caused the Account Linking URL to break briefly, but it should be working again now.

But your account is already linked so you don't need that page. You only need to link once.

Which forum post are you waiting for an answer on?

This is the post. I'm not waiting on a reply for it but a fix for the problem since it has now happened with a second site and changing the settings as mentioned doesn't help in this case. There have also been a few posts about usage that I posted but they may have been before the new ticket system was implemented and I just deal with them.. The ftp problem is something I can't ignore though.

[The two threads have been merged, and are the same now.]


The link points to this thread that we're talking in now. :slight_smile:

Do you mean Very slow ftp connection using explicit tls about FTP timeouts?

Let me know which thread you're waiting on and I'll follow-up in the thread, and probably merge this one into it to keep everything in one place.

I'm sorry. I did a copy paste for the link but didn't check it. Yes, the one you linked to is the one I meant to reference.

No response on this. Is it being looked at? Will it be looked at?

I'm having the exact same problem here. Spent all day with the support team for our VPS hosting and they can't work it out either. Oddly I've also tried FTP Rush, XFtp and Directory Opus 12 and they all have serious connection issues with FTP via Explicit TLS. FillaZilla is the only one I've found that connects quickly.

The problem, at least with Jack's server, turns out to be a bug in the Pure-FTPd server, which probably affects a lot of other software as well, since their own site recommends disabling encryption on the data channel when using TLS with several different clients:

https://download.pureftpd.org/pub/pure-ftpd/doc/README.TLS

After a day spent debugging this, we've found a way to work around the bug in the server, so it will work in Opus from version 12.8.2 onwards. The server is at fault but we can detect it and work around it. Of course, the problem may still affect other clients, which is outside our control; the server side should really be fixed.

Prior to Opus 12.8.2, you can also make things work by changing a setting for the site on the Special tab of the FTP Bookmark entry in Opus. If you turn on SSL Data Channel - Use Clear Data, the problem won't happen. However, this will also mean that the directory listings and file data you transfer will be sent in the clear, unencrypted, and only the control channel (username, password, commands) will be encrypted.

The workaround in Opus 12.8.2 will let you keep full encryption enabled, so the flag need not be set. (Unless using an old version of Pure-FTPd, where it did not support encrypting the data channel; only
the control channel. But the server in question here is newer than that, and works with full encryption once the workaround is in place.)

1 Like

Hi
My ISP has just changed to using explicit ftp, and I am having the same problems of slow connections, taking 2 minutes to download the root directory, and trying to downlodd a subdirectory of 1100 files stopped after 188 files. I've tried the SSL clear option, but no success.
Has anyone any ideas?

What is the server-side software that your ISP is using now?

Have you checked in other FTP clients to see if they have similar problems?

Hi
They are using Pure-FTPd, so I have sent to them

+++11111111111111111111111+++
Hi Peter
I've tried all that and no success.
My client's forum say their may be a bug on your server.
Please look at
https://download.pureftpd.org/pub/pure-ftpd/doc/README.TLS

I'm no expert, not even understanding most of that.
Perhaps your techy folk know more.
Regards Derek
+++11111111111111111111111+++

I then get response
+++2222222222222222222+++
Hi Derek,
Thank you for the reply and apologies for the delayed update.
The other support ticket is still not closed as my colleague advised you:
Host: polaris.servers.prgn.misp.co.uk
Username: moxdgtmy
Password: Your cPanel password
Port: 21
Encryption: Explicit FTP over TLS
Passive Mode
You can try to login with those credntials.
Could you provide me with your current IP address?
You can find it out from >> http://ip.me.uk/ and could you also make sure that you are using the latest version of your FTP client and it supports TLS 1.2.
I could suggest to try Filezilla >> https://filezilla-project.org/ it is a free 3rd party piece of software that is updated on a regular basis and compliant with all the latest server security requirements.
Kind regards, Martin
+++2222222222222222222+++
So they don't care about the bug in Pure-FTPd
I've tried Filezilla, as they suggest and it works perfectly ( at my limited level).
So, why isn't the workaround that Filezilla use build into Opus?
I can send you a test login to my server if you would like to play, but can't send you the password over this insecure forum. Do you have a private, secure contact route?
Regards Derek

If you send login details via a private message or to crashdumps@gpsoft.com.au we can see if we can reproduce the problem and what might be causing it.

Thanks, sent you email.