Pure-FTPd version 1.0.21_1 was compiled from ports, with the following options passed to configure script:

--with-everything
--with-paranoidmsg
--with-virtualchroot
--with-tls             // Support for the secure authentication.
--with-largefile
--with-pgsql
--with-privsep
--without-banner
--with-sendfile


The pure-ftpd binary was run with the following configuration:

/usr/local/sbin/pure-ftpd -A -c50 -B -C8 -d -D -E -fftp -H -I15 -lpgsql:/usr/local/etc/pureftpd-pgsql.conf -L2000:8 -m4 -p49000:50000 -P<ext_IP> -s -U133:022 -u80 -i -g/var/run/pure-ftpd.pid -k99 -Z -Y1


I've noticed, that Pure-FTPd executed with both "-P" and "-Y" flags, doesn't work properly. It means, clients were not able to authenticate themselves using AUTH TLS. Pure-FTPd during feature negotation (FEAT) didn't include FEAT_TLS, so clients were using plain text authentication.


Feature negotation log without a fix:
---> FEAT
<--- 211-Extensions supported:
<---  EPRT
<---  IDLE
<---  MDTM
<---  SIZE
<---  REST STREAM
<---  MLST type*;size*;sizd*;modify*;UNIX.mode*;UNIX.uid*;UNIX.gid*;unique*;
<---  MLSD
<---  TVFS
<---  ESTP
<---  PASV
<---  EPSV
<---  SPSV
<--- 211 End.
---> QUIT    // Using secure authentication was forced.


Feature negotation log with a fix:
---> FEAT
<--- 211-Extensions supported:
<---  EPRT
<---  IDLE
<---  MDTM
<---  SIZE
<---  REST STREAM
<---  MLST type*;size*;sizd*;modify*;UNIX.mode*;UNIX.uid*;UNIX.gid*;unique*;
<---  MLSD
<---  TVFS
<---  ESTP
<---  PASV
<---  EPSV
<---  SPSV
<---  ESTA
<---  AUTH TLS
<---  PBSZ
<--- 211 End.
---> AUTH TLS
<--- 234 AUTH TLS OK.

Fix: Applay a patch included with this Problem Report.

Patch attached with submission follows:
How-To-Repeat: 1) Compile Pure-FTPd with TLS support (--with-TLS)
2) Run pure-ftpd binary with "-P" and "-Y" flags.
3) Try to connect with Pure-FTPd daemon with AUTH TLS (debug mode).