Support

Akeeba Backup for Joomla!

#39204 Connection to FTP fails when TLS is enabled on FTP server

Posted in ‘Akeeba Backup for Joomla! 4 & 5’
This is a public ticket

Everybody will be able to see its contents. Do not include usernames, passwords or any other sensitive information.

Environment Information

Joomla! version
4.3.3
PHP version
8.2.8
Akeeba Backup version
9.6.2 Pro

Latest post by GJSchaller on Sunday, 23 July 2023 14:38 CDT

GJSchaller

I have multiple sites on several hosts, all of which currently back up to a TrueNAS server in my home on a weekly basis, using FTP.  So far, so good.

I wanted to enable TLS for FTP, so that the authentication and backup would be secure.  When I log into my TrueNAS and enable TLS for FTP, all of the sites stop being able to log in, giving the error message:

Cannot log in to FTP server [username:password] = myusername:mypassword

If I disable TLS, they are able to connect again.

If it matters / helps, this is happening across two hosts, (Virtualmin self-hosted and SiteGround), and with both Joomla and WordPress.

I am able to connect to the FTP server using FileZilla when TLS is enabled, so I know the server is still working when TLS is on.

(Edit for spelling)

nicholas
Akeeba Staff
Manager

I can imagine several things which could have gone wrong. Let's try to take them one at a time.

There are two ways to enable TLS with FTP. One is FTP over implicit TLS and the other is FTP over explicit TLS. PHP —therefore Akeeba Backup— only supports the latter. I have no experience with TrueNAS and what it supports. Please check that the implementation uses FTP over explicit TLS (the FTP client connects to the FTP server as per usual, then asks for the connection to be explicitly upgraded to TLS before logging in). If you see that the port has changed from 21 to 990 then you have FTP over implicit TLS which is incompatible with PHP.

FTP over Explicit TLS and SFTP are two completely unrelated, completely incompatible protocols. If you are using SFTP (file transfers over the SSH protocol) you need to use the Upload to SFTP post-processing engine in Akeeba Backup.

When using FTP over Explicit TLS you need to tell Akeeba Backup to use that feature by checking the “Use FTP over SSL” option. On top of that, make sure that the Port is correct. Some implementations change the FTP over Explicit TLS to no longer use port 21. They are rare but they do exist.

Finally, there's a point to be made about the TLS certificate itself. It must be signed by a known Certification Authority and its Subject Name must match the hostname you are connecting to. If you are using a home server this means that you need to have set up both some form of dynamic DNS to give your NAS a hostname, port forwarding on your router to make the NAS accessible from the outside world, and set up Let's Encrypt with the dynamic DNS hostname you are using to obtain a valid, signed certificate. If you are using a self-signed certificate it cannot be trusted and PHP will refuse to connect.

For what it's worth we have many clients —especially in Germany— who use Synology NAS with FTP over explicit TLS successfully. We have also the same setup in the office for testing Akeeba Backup's Upload to FTP, both from local servers and live servers (my live servers are with Rochen, CloudAccess.net, and Akamai formerly known as Linode). Based on this experience I know that the code in Akeeba Backup does work, and you most likely have a configuration issue as per the above paragraphs.

Nicholas K. Dionysopoulos

Lead Developer and Director

🇬🇷Greek: native 🇬🇧English: excellent 🇫🇷French: basic • 🕐 My time zone is Europe / Athens
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!

GJSchaller

This is a very good summary, thank you.  I do agree it's a configuration issue, but I wasn't sure where to look / what to check for.  Now that I know, I can hunt it down.  I'll report back once I get it figured out.

nicholas
Akeeba Staff
Manager

You're welcome!

Nicholas K. Dionysopoulos

Lead Developer and Director

🇬🇷Greek: native 🇬🇧English: excellent 🇫🇷French: basic • 🕐 My time zone is Europe / Athens
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!

GJSchaller

As a follow up to this, the TrueNAS community hasn't responded if TrueNAS uses (or can be configured to use) Explicit TLS - the common response so far is to set up a Jail / VM with a dedicated FTP server that uses it, or to use some other form of backup.

I was able to confirm that a Virtualmin VM running ProFTPD works, and I can connect using Explicit TLS - so that's a start.  The next challenge is going to me mounting NAS storage outside the VM to a path within it, but that's outside the scope of this ticket.  (If I am able to do it, I'll comment here for other people who may be trying the same thing.)

nicholas
Akeeba Staff
Manager

Awesome! I am happy I could help point you to the right direction. 

Nicholas K. Dionysopoulos

Lead Developer and Director

🇬🇷Greek: native 🇬🇧English: excellent 🇫🇷French: basic • 🕐 My time zone is Europe / Athens
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!

GJSchaller

OK, made a lot of progress, but hit another roadblock, this one I think is related to Akeeba (or at least how Akeeba works).

I was able to set up the ProFTPD server, and connect to it using Explicit TLS using FileZilla.  From my website on SiteGround, I am able to configure a profile for Akeeba that requires Explicit TLS, and when I test the connection, it comes back successful.  But when I run the actual backup, it runs into a problem, and fails.  I do not see the files in the FTP server.

Standard FTP without TLS still works, however.  I have two profiles set up now - the Default one (no TLS), and a copy with TLS enabled.  I've attached logs from a single run of both backups for comparison.  I can see the error in the logs that it failed to transfer the file, but not why.

nicholas
Akeeba Staff
Manager

I can tell you it's not a problem with Akeeba Backup. This feature has been available for 13 years. It's the oldest remote processing engine, added in December 2009 (released February 2010). I've been using it with a Synology NAS at the office since 2016. I know for a fact that if you have an FTP server which does work correctly with FTP over explicit TLS you can use Akeeba Backup with it. Plus, I am currently looking at a backup which was uploaded that way to said Synology NAS. 

Moreover, I can see it's a configuration or FTP server issue. The error always comes after 30 seconds. That's the connection timeout limit. Check that you have enabled Passive mode.

For reference, here's my FTP over Explicit TLS configuration:

Reference configuration

Nicholas K. Dionysopoulos

Lead Developer and Director

🇬🇷Greek: native 🇬🇧English: excellent 🇫🇷French: basic • 🕐 My time zone is Europe / Athens
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!

GJSchaller

At this point, after talking with several groups, I think my best bet is to try and move to file transfer over SSL.  I have that in the works, this ticket can be closed out.

-Geoffrey

Support Information

Working hours: We are open Monday to Friday, 9am to 7pm Cyprus timezone (EET / EEST). Support is provided by the same developers writing the software, all of which live in Europe. You can still file tickets outside of our working hours, but we cannot respond to them until we're back at the office.

Support policy: We would like to kindly inform you that when using our support you have already agreed to the Support Policy which is part of our Terms of Service. Thank you for your understanding and for helping us help you!