LinuxQuestions.org
Help answer threads with 0 replies.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices


Reply
  Search this Thread
Old 08-21-2012, 03:14 AM   #1
LBM
Member
 
Registered: Aug 2010
Location: Denmark
Distribution: Debian
Posts: 114

Rep: Reputation: 1
ssh ftp tunnel, not working - cannot list dirs


I cannot get an ftp tunnel to work. I can telnet to the port, but the directory listing is not working, when using a real connect.
The data/control port is defiantly giving issues.

The setup looks like this, and I am trying to connect from the client.
I can connect to the ftp fine, from privateserver, which have access.

ftpserver <-> privateserver <-> publicserver <-> client

ftpserver, is a FTP server, on the WWW
privateserver, is the only server that have access by firewall rules to the ftp server, but cannet be access by clients.
public server, can be access by clients.

I have tried this from public server, both without a dynamic host, and with a dynamic host.

When I try to connect to the socks proxy on port 1234 from the ftp client, i simply get an timeout.
If I do not use a proxy, it connects but, cannot list directories, neither in passive or non-passive.

With dynamic,
Code:
ssh -D 1234 -f -g -L 21:ftpserver:21 user@privateserver -N
Without dynamic
Code:
ssh -f -g -L 21:ftpserver:21 user@privateserver -N
 
Old 08-21-2012, 04:51 AM   #2
MCD555
Member
 
Registered: May 2009
Location: Milan, Italy
Distribution: Ubuntu, Debian, Fedora, Oracle Linux
Posts: 109

Rep: Reputation: 10
May the problem is how the FTP protocol works, i.e. using different sockets: one for command and the other data exchange.

In active mode the FTP server let you login in with the command:

Code:
ssh -f -g -L 21:ftpserver:21 user@privateserver -N
but once you need to get data (even for a dir) your client try to login using the port 20, so, to work, it should use your ssh tunnel

Code:
ssh -f -g -L 20:ftpserver:20 user@privateserver -N
but it doesn't ...
May you could configure Filezilla to perfom this ... or, even better, use directly sftp (but this could be out of scope .-))!

Hope this helps!
 
Old 08-21-2012, 05:26 AM   #3
LBM
Member
 
Registered: Aug 2010
Location: Denmark
Distribution: Debian
Posts: 114

Original Poster
Rep: Reputation: 1
Configure filezilla? How...?

sftp is unfortunately not an option.
 
Old 08-21-2012, 06:35 AM   #4
MCD555
Member
 
Registered: May 2009
Location: Milan, Italy
Distribution: Ubuntu, Debian, Fedora, Oracle Linux
Posts: 109

Rep: Reputation: 10
Well, Filezilla would be the solution ... sorry!
But do you already read this thread:

http://www.linuxquestions.org/questi...o-work-558516/

Have a look to appyface step-by-step config...
 
Old 08-21-2012, 07:15 AM   #5
LBM
Member
 
Registered: Aug 2010
Location: Denmark
Distribution: Debian
Posts: 114

Original Poster
Rep: Reputation: 1
I am trying with filezilla..
And I get this.

passive
Quote:
Response: 227 Entering Passive Mode (xxx,xxx,xxx,xxx,17,71).
Command: MLSD
Response: 150 File status okay; about to open data connection.
Error: Connection timed out
Error: Failed to retrieve directory listing
non-passive
Quote:
Status: Connected
Status: Retrieving directory listing...
Command: PWD
Response: 257 "/" is current directory.
Command: TYPE I
Response: 200 Type set to I.
Command: PORT xxx,xxx,xxx,xxx,220,248
Error: Connection closed by server
Error: Failed to retrieve directory listing
 
Old 08-21-2012, 11:18 AM   #6
MCD555
Member
 
Registered: May 2009
Location: Milan, Italy
Distribution: Ubuntu, Debian, Fedora, Oracle Linux
Posts: 109

Rep: Reputation: 10
Focusing on the PASSIVE mode (in that case you will act as client also for the data connection), you get the following message:

Quote:
Originally Posted by LBM View Post
Response: 227 Entering Passive Mode (xxx,xxx,xxx,xxx,17,71).
the xxx.xxx.xxx.xxx part should be 127.0.0.1 (i.e. your call must be through your ssh tunnel) while the passive port to connect to is the 17,71 (i.e. 17*256+71 = 4423).

Once you'll be able to say to Filezilla to open that connection via the tunnel you'll get the ftp up and running for both command and data channels.

The tricky part of the thread by appyface was this:

Quote:
5. Setup your ftp server to use a very small range of incoming
ports for passive ftp connections (I used 5 ports, 2022 - 2026)


6. Setup your SSH client to use SSH2, and set up the following
local port forwards (using my examples above, substitute your own
ports):
* 2021 (local port)--> 192.168.0.2:2021 (ftp server internal
ip:ftpserver local port for control session)
* 2022 (local port)--> 192.168.0.2:2022 (ftp server internal
ip:ftpserver local port for passive data session)
* 2023 (local port)--> 192.168.0.2:2023 (ftp server internal
ip:ftpserver local port for passive data session)
* 2024 (local port)--> 192.168.0.2:2024 (ftp server internal
ip:ftpserver local port for passive data session)
* 2025 (local port)--> 192.168.0.2:2025 (ftp server internal
ip:ftpserver local port for passive data session)
* 2026 (local port)--> 192.168.0.2:2026 (ftp server internal
ip:ftpserver local port for passive data session)
i.e. limit the range of passive port on your FTP server and open a tunnel for each of them.

Obviusly this is a bypass that cannot be performed if you have limited access to the FTP server and also is not a very good choice (limit the passive port range could not be a good idea!) but this should works ...

An alternative could be:

a. try to connect in passive mode to get the port for data connection (get the formula is always 1st no. * 256 + 2nd no.)
b. open the tunnel with the port + 1
c. cross your fingers and try to open the data connection again (if you guess the port you'll in)

Example:
a. you get
Code:
Response: 227 Entering Passive Mode (xxx,xxx,xxx,xxx,17,71).
and calculate 17*256+71 = 4423
b. open the tunnel onto the port 4424
c. try a dir

In any case also this option would be deprecable!

Hope this helps!

PS: instead Filezilla you can use simple command line ftp too! Pay attention to use the EPSV instead of PASV command to not consider the IP passed by the server
 
Old 08-22-2012, 02:48 AM   #7
LBM
Member
 
Registered: Aug 2010
Location: Denmark
Distribution: Debian
Posts: 114

Original Poster
Rep: Reputation: 1
Unfortunately, I do not have any access to the FTP server. It is an external system.
 
Old 08-22-2012, 05:03 AM   #8
MCD555
Member
 
Registered: May 2009
Location: Milan, Italy
Distribution: Ubuntu, Debian, Fedora, Oracle Linux
Posts: 109

Rep: Reputation: 10
So, just try the "guess" method and cross your fingers ;-D
 
Old 08-23-2012, 09:08 AM   #9
MCD555
Member
 
Registered: May 2009
Location: Milan, Italy
Distribution: Ubuntu, Debian, Fedora, Oracle Linux
Posts: 109

Rep: Reputation: 10
Did you try it?
 
Old 08-23-2012, 09:21 AM   #10
LBM
Member
 
Registered: Aug 2010
Location: Denmark
Distribution: Debian
Posts: 114

Original Poster
Rep: Reputation: 1
Yes, even if I am lucky to guess the correct port, which I did 2 or 3 times, I am unable to list the dirs.
Although if it had succeeded, I could not use this solution for the users...

currently I am looking into complete another solution.
Thanks for your time though.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
ftp over ssh tunnel; ftp refuses to work jakykong Linux - Networking 16 10-16-2011 07:34 AM
ftp proxy via ssh tunnel on server side using what? drobert Linux - Software 3 05-09-2011 04:38 PM
[SOLVED] SSH tunnel commands to list active/disconnect batfastad Linux - Newbie 1 04-01-2010 03:37 AM
SSH and secure FTP tunnel from remote computer : Is this scenario possible ? uncle-c Linux - Newbie 3 12-04-2008 04:14 PM
SSH Tunnel and FTP Issues ayrton Linux - Networking 2 02-16-2004 05:03 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Networking

All times are GMT -5. The time now is 07:19 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration