Arch Linux

ETNyx

Member

From: Czech republic

Registered: 2010-06-08

Posts: 29

Can't acept self-signed cert in nautilus/gvfs for ftps connection

Hello,

since last upgrade of Gnome to 3.22 (gvfs was upgraded from 1.38 to 1.40) i got problem to connect over FTPS, I put ftps://address to Nautilus "location line", got prompt about verifying certificate (it's self signed) and it's just stuck (normally you get credential dialog to log in,...), This same behavior is for Nautilus and also Nemo, so I think its more-likely related to gvfs. So i tried to debug it:

GVFS_DEBUG=1 $(find /usr/lib* -name gvfsd 2>/dev/null) --replace 2>&1 | tee gvfsd.log
fuse: bad mount point `/run/user/1000/gvfs': Transport endpoint is not connected
trash: Added new job source 0x5623dad16ae0 (GVfsBackendTrash)
trash: Queued new job 0x5623dad23010 (GVfsJobMount)
trash: send_reply(0x5623dad23010), failed=0 ()
trash: backend_dbus_handler org.gtk.vfs.Mount:CreateFileMonitor (pid=1688)
trash: Queued new job 0x5623dad23370 (GVfsJobCreateMonitor)
trash: send_reply(0x5623dad23370), failed=0 ()
trash: backend_dbus_handler org.gtk.vfs.Mount:QueryInfo (pid=1688)
trash: Queued new job 0x5623dad0e2d0 (GVfsJobQueryInfo)
trash: send_reply(0x5623dad0e2d0), failed=0 ()
trash: backend_dbus_handler org.gtk.vfs.Mount:CreateFileMonitor (pid=1908)
trash: Queued new job 0x5623dad42050 (GVfsJobCreateMonitor)
trash: send_reply(0x5623dad42050), failed=0 ()
trash: backend_dbus_handler org.gtk.vfs.Mount:QueryInfo (pid=1908)
trash: Queued new job 0x5623dad0e4b0 (GVfsJobQueryInfo)
trash: send_reply(0x5623dad0e4b0), failed=0 ()
ftp: Added new job source 0x563ab91350e0 (GVfsBackendFtp)
ftp: Queued new job 0x563ab9118ed0 (GVfsJobMount)
ftp: <- 0 --  220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------
ftp: <- 0 --  220-You are user number 1 of 200 allowed.
ftp: <- 0 --  220-Local time is now 13:17. Server port: 54321.
ftp: <- 0 --  220-This is a private system - No anonymous login
ftp: <- 0 --  220-IPv6 connections are also welcome on this server.
ftp: <- 0 --  220 You will be disconnected after 15 minutes of inactivity.
ftp: -- 0 ->  AUTH TLS
ftp: <- 0 --  234 AUTH TLS OK.
ftp: generalTime generalTime: decoded tag did not match expectedftp: generalTime generalTime: decoded tag did not match expectedftp: teletexString teletexString: decoded tag did not match expectedftp: printableString printableString: decoded tag did not match expectedftp: universalString universalString: decoded tag did not match expectedftp: bmpString bmpString: decoded tag did not match expectedftp: ia5String ia5String: decoded tag did not match expectedftp: teletexString teletexString: decoded tag did not match expectedftp: printableString printableString: decoded tag did not match expectedftp: universalString universalString: decoded tag did not match expectedftp: bmpString bmpString: decoded tag did not match expectedftp: ia5String ia5String: decoded tag did not match expectedtrash: backend_dbus_handler org.gtk.vfs.Mount:CreateFileMonitor (pid=1964)

Last line (ftp:) is generated when dialog allow self sign cert is shown, after confirmation there is no new line in log and I can't read any senfull info from it,..

When i change certificate on this FTP server (just certificate nothing else), to Let's Encrypt signed cert, everything is fine:

GVFS_DEBUG=1 $(find /usr/lib* -name gvfsd 2>/dev/null) --replace 2>&1 | tee gvfsd.log
fuse: bad mount point `/run/user/1000/gvfs': Transport endpoint is not connected
trash: Added new job source 0x5590ea2beae0 (GVfsBackendTrash)
trash: Queued new job 0x5590ea2cb010 (GVfsJobMount)
trash: send_reply(0x5590ea2cb010), failed=0 ()
trash: backend_dbus_handler org.gtk.vfs.Mount:CreateFileMonitor (pid=3276)
trash: Queued new job 0x5590ea2cb370 (GVfsJobCreateMonitor)
trash: send_reply(0x5590ea2cb370), failed=0 ()
trash: backend_dbus_handler org.gtk.vfs.Mount:QueryInfo (pid=3276)
trash: Queued new job 0x5590ea2b62d0 (GVfsJobQueryInfo)
trash: send_reply(0x5590ea2b62d0), failed=0 ()
trash: backend_dbus_handler org.gtk.vfs.Mount:CreateFileMonitor (pid=3276)
trash: Queued new job 0x5590ea2cb5b0 (GVfsJobCreateMonitor)
trash: send_reply(0x5590ea2cb5b0), failed=0 ()
trash: backend_dbus_handler org.gtk.vfs.Mount:QueryInfo (pid=3276)
trash: Queued new job 0x5590ea2b6370 (GVfsJobQueryInfo)
trash: send_reply(0x5590ea2b6370), failed=0 ()
ftp: Added new job source 0x562dd471e0e0 (GVfsBackendFtp)
ftp: Queued new job 0x562dd4701ed0 (GVfsJobMount)
ftp: <- 0 --  220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------
ftp: <- 0 --  220-You are user number 1 of 200 allowed.
ftp: <- 0 --  220-Local time is now 13:35. Server port: 54321.
ftp: <- 0 --  220-This is a private system - No anonymous login
ftp: <- 0 --  220-IPv6 connections are also welcome on this server.
ftp: <- 0 --  220 You will be disconnected after 15 minutes of inactivity.
ftp: -- 0 ->  AUTH TLS
ftp: <- 0 --  234 AUTH TLS OK.
ftp: -- 0 ->  PBSZ 0
ftp: <- 0 --  200 PBSZ=0
ftp: -- 0 ->  PROT P
ftp: <- 0 --  200 Data protection level set to "private"
ftp: -- 0 ->  FEAT
ftp: <- 0 --  211-Extensions supported:
ftp: <- 0 --   EPRT
ftp: <- 0 --   IDLE
ftp: <- 0 --   MDTM
ftp: <- 0 --   SIZE
ftp: <- 0 --   MFMT
ftp: <- 0 --   REST STREAM
ftp: <- 0 --   MLST type*;size*;sizd*;modify*;UNIX.mode*;UNIX.uid*;UNIX.gid*;unique*;
ftp: <- 0 --   MLSD
ftp: <- 0 --   AUTH TLS
ftp: <- 0 --   PBSZ
ftp: <- 0 --   PROT
ftp: <- 0 --   UTF8
ftp: <- 0 --   TVFS
ftp: <- 0 --   ESTA
ftp: <- 0 --   PASV
ftp: <- 0 --   EPSV
ftp: <- 0 --   SPSV
ftp: <- 0 --  211 End.
ftp: # feature EPRT supported
ftp: # feature MDTM supported
ftp: # feature SIZE supported
ftp: # feature AUTH TLS supported
ftp: # feature UTF8 supported
ftp: # feature TVFS supported
ftp: # feature EPSV supported

Can't find similar problem by Googling it, so if someone should verified it as bug, or if someone have some solution? Maybe I should report it Gnome issue tracker?

qinohe

Member

From: Netherlands

Registered: 2012-06-20

Posts: 1,599

Re: Can't acept self-signed cert in nautilus/gvfs for ftps connection

Hi, could be it's a bug I don't know, also I don't use FTPS and am not familiar with it's logging!
But, is your CA still in store?
If not, did you add & trust the CA(again)?
You can still try and trust the CA again!
If none of this helps I'm out of ideas;)

ETNyx

Member

From: Czech republic

Registered: 2010-06-08

Posts: 29

Re: Can't acept self-signed cert in nautilus/gvfs for ftps connection

Hi,

cert it self or CA is not an issue here, on this specific server (It's mine server) I'm able to solve this issue by switching certificate to one that's sign by commonly trusted CA and connection works fine. But in some connection I can't change server settings in these cases I need to bypass CA (cert) check. Nautilus ask you if you trust this source or not, but after upgrade it's not working properly. (It's similar to: if you want use curl --insecure and it's not working). I don't need to solve this one connection, but common problem I came across in nautilus/gvfs.

But thanks for trying to help.

qinohe

Member

From: Netherlands

Registered: 2012-06-20

Posts: 1,599

Re: Can't acept self-signed cert in nautilus/gvfs for ftps connection

Hi,

..in these cases I need to bypass CA (cert) check. Nautilus ask you if you trust this source or not...
I don't need to solve this one connection, but common problem I came across in nautilus/gvfs.

If you would use a chain! and add the CA to your system store you would never need to 'bypass' a check!
The common problem is not Nautilus, there are many applications that don't accept self-signed certs.
The only way to let applications believe the certificate is trustworthy is to create a chain and add the CA to the store and trust it:)
If you did that, there will be no user interaction in the process as it should be...