Upgraded to version 10.9.1-3 and FTP backup no longer works

[Andrey Fyodorov]

Hey Everyone.

We just upgraded our UAT SMG Control Center to version 10.9.1-3, and FTP backup stopped working.

When we run Backup Now, we get this error.

Cannot backup the database.
FTP:Can't log in: User cannot log in. ERROR: Unable to send to the specified URL.

All the backup settings, the FTP account and password are the same.  We use the  same settings on the Prod SMG Control Center which is still version 10.9.0-3, and FTP backup still works fine there.

Have any of you run into this problem?

We have already tried upgrading to version 10.9.2-6, hoping that it would fix the bug, but it didn't.

Also we have tried to use the workaround described in this article, and it didn't help either

https://knowledge.broadcom.com/external/article/281550/unable-to-create-the-backup-on-remote-se.html

This article says that the problem could be caused by our FTP server running in PASV mode, but I checked, and our FTP server has PASV turned off, as indicated by the port range 0-0.

https://knowledge.broadcom.com/external/article/155142/a-backup-of-the-symantec-messaging-gatew.html

-------------------------------------------

[Andrey Fyodorov]

Turns out I mis-understood my colleague who was doing the upgrades.

FTP backup continued working after the upgrade to version 10.9.1-3.

But the subsequent upgrade to the latest version 10.9.2-6 broke it.

-------------------------------------------

[Accounts Payable]

We have the same problem with the same version of SMG, 10.9.2-6.

We ran ran a packet capture and it turns out SMG is dropping the first character of the FTP account password.

We verified this to be true as we changed the password on the FTP server by omitting the first character yet supplying the full password in the SMG GUI and FTP login was successful.

HOWEVER, the second problem still remains whereas SMG prematurely disconnects the session before data transmission begins.

We have a case open with Broadcom support on this issue and I'll report once a resolution is identified.

-------------------------------------------

[alexander smg]

Unclassified | Non classifi?

Correct

[Accounts Payable]

Here's the root cause if the failure:

Problem 1): Apparently starting in 10.9.2-6, SMG errored and botched the password field as SMG drops the first character of the FTP password on authenticated attempts. They fixed this in patch patch 10.9.2-300.

Problem 2): SMG now forces PASV mode for all FTP transfers so you must have PASV enabled on your FTP server (we did not as the FTP server is on the same router as SMG) and if you have firewall enabled on your FTP server (we did), make sure the same PASV ports are open on your firewall as you have identified in your PASV setting on your FTP daemon.

Broadcom should have indicated PASV was now enabled in their SMG 10.9.2-6 release notes.

Our FTP backups are now working after reconfiguring our FTP server firewall and enabling PASV mode on our FTP server since this upgrade to SMG 10.9.2-6.

Cheers...

-------------------------------------------

[alexander smg]

Unclassified | Non classifi?

Hate pasv mode.

[Andrey Fyodorov]

Our FTP server for SMG backups is a Windows server with IIS. How do we enable PASV there?

[alexander smg]

Unclassified | Non classifi?

Yes please.

[Accounts Payable]

We use Filezilla FTP server on our Windows box but I did a quick search and there are numerous HOW TO references (depending on the version of Windows) I found by searching Google "How to enable PASV mode in Windows server".

-------------------------------------------

[Markko Meriniit]

Andrey, the first post shows IIS configuration page where you specify ports for ftp to use in case of PASV. You also have to let these ports through firewall. There are also quite many pages on internet when you search something like - iis ftp enable pasv

For example https://jenkins96.github.io/2024-02-03-Almost-Everything-You-Need-To-Know-About-IIS-FTP-Server/

-------------------------------------------

[cab3]

Is it everyone's understanding that use of FTP now mandates the use of PASV?  My backup target for these things happens to be an (older) purpose built NAS device, which from what I can tell does not offer PASV FTP mode.  So if it's mandatory, then I'm going to have to find an alternative process, which is unfortunate, as what's not broke doesn't need to be fixed. 😠

-------------------------------------------

[Markko Meriniit]

 PASV for ftp is recommended for decades now and is considered as standard for ftp. In addition scp is always recommended over ftp. I also wonder how old this NAS device is because rfc1123 which was published at 1989 required all FTP servers to support PASV

-------------------------------------------

[alexander smg]

Unclassified | Non classifié

Its awesome