LinuxQuestions.org
Register a domain and help support LQ
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices

Reply
 
Search this Thread
Old 09-25-2012, 07:54 AM   #1
pramodbisht
LQ Newbie
 
Registered: Apr 2012
Location: Chandigarh (IN)
Distribution: CentOS
Posts: 12

Rep: Reputation: Disabled
Angry FTP Server Refused passive mode - Using VSFTPD


Hi All,
I have EC2 Micro Instance which has FTP server (VSFTPD) installed. I ftp it from server itself, it works fine! That means service is ON and working fine.
but if I try to get FTP from any other client (via internet) it logs-in and works fine over 21 port(for commands) but as client request for the data it says, - "421 Service not available, remote server has closed connection Passive mode refused."
If I put "passive" command in ftp after login, It says:"passive mode is off" and then works fine in active mode!!
I m confused that why passive mode is not working??
Although firewall is off in both sides, Other security tools are also disable.

---- vsftpd.conf---

anonymous_enable=NO
local_enable=YES
write_enable=YES
local_umask=022
dirmessage_enable=YES
tcp_wrappers=YES
pasv_promiscuous=YES
port_enable=YES
pasv_enable=YES
pasv_max_port=11200
pasv_min_port=11100
---------------------------------------
Need your help!!!

Thanks In Advance!
 
Old 09-25-2012, 08:17 AM   #2
MensaWater
Guru
 
Registered: May 2005
Location: Atlanta Georgia USA
Distribution: Redhat (RHEL), CentOS, Fedora, Debian, FreeBSD, HP-UX, Solaris, SCO
Posts: 6,015
Blog Entries: 5

Rep: Reputation: 787Reputation: 787Reputation: 787Reputation: 787Reputation: 787Reputation: 787Reputation: 787
I just ran into an issue with this on RHEL and found my issue was in the iptables configuration file (not the rules file).

On RHEL there is a file /etc/sysconfig/iptables-config. One should check to see if the IPTABLES_MODULES line is uncommented and allows for ip_conntrack_ftp.
e.g.
IPTABLES_MODULES="ip_conntrack_ftp"

On the server I had the issue on I found the line as:
IPTABLES_MODULES="ip_conntrack_netbios_ns"

I changed it to:
IPTABLES_MODULES="ip_conntrack_netbios_ns ip_conntrack_ftp"

That got everything working (after running "service iptables restart").

Also you need to open ports 20/21 in iptables itself.

The post that helped me figure out my issue was:
http://balajitheone.blogspot.com/201...or-vsftpd.html

Note that the foregoing talks is about RHEL and would be valid for CentOS but may be different on your distro (e.g. a different config file to set conntrack).

One quick way to narrow down the issue to iptables is to stop iptables then do the test. If it works then iptables is the issue and you can focus on whether it is the config file or the rules. (The rules on RHEL are also in /etc/sysconfig/iptables.) Before changing any rules or stopping iptables make sure you run iptables-save to save a copy of your existing rules so you can revert to them if necessary.
 
Old 09-25-2012, 10:13 PM   #3
pramodbisht
LQ Newbie
 
Registered: Apr 2012
Location: Chandigarh (IN)
Distribution: CentOS
Posts: 12

Original Poster
Rep: Reputation: Disabled
Hi,
Thanks for your Reply!! But do you think this (IPTABLES_MODULES="ip_conntrack_ftp") can create any issue if IPtables is off??
as I told in last post "Although firewall is off in both sides, Other security tools are also disable. "


Thanks!!
 
Old 09-26-2012, 08:27 AM   #4
MensaWater
Guru
 
Registered: May 2005
Location: Atlanta Georgia USA
Distribution: Redhat (RHEL), CentOS, Fedora, Debian, FreeBSD, HP-UX, Solaris, SCO
Posts: 6,015
Blog Entries: 5

Rep: Reputation: 787Reputation: 787Reputation: 787Reputation: 787Reputation: 787Reputation: 787Reputation: 787
In my case when I turned off iptables temporarily the issue went away. After I made the modification and turned iptables back on the issue was resolved. Since I don't know your distro I can't be sure how it works with this. Note that iptables is actually built into the kernel so even when "off" there is a minimal rule set shown. What do you see when you run "iptables -nL" on both hosts?

It is possible you have something else going on:
There are conntrack settings in the kernel (look at "man sysctl" documentation) and possibly one of those is affecting you.
Are you sure there is no firewall device exists between the systems? (e.g. Is there a switch you're going through that possibly has its own firewall settings?)
Also you might want to explore tcp wrappers - I didn't have to deal with those and don't know off the top of my head if vsftp is tcp wrappers aware.

Are you running vsftpd as a daemon or is it being run under xinetd (or inetd)? What is in the relevant configuration file(s)?
 
Old 09-29-2012, 07:27 AM   #5
pramodbisht
LQ Newbie
 
Registered: Apr 2012
Location: Chandigarh (IN)
Distribution: CentOS
Posts: 12

Original Poster
Rep: Reputation: Disabled
In my case RHEL-6 is installed in both Hosts.when I command "iptables -nL" both hosts show no rules.
I m sure that no firewall exist in between and also TCPwrapper is not affecting here.
also there is nothing for conntrack in man sysctl, can conntrack effect me here?
and vsftpdf is running as a daemon. here are related configs :-
/etc/pam.d/vsftpd
/etc/vsftpd/ftpusers
/etc/vsftpd/user_list
 
Old 10-01-2012, 09:00 AM   #6
MensaWater
Guru
 
Registered: May 2005
Location: Atlanta Georgia USA
Distribution: Redhat (RHEL), CentOS, Fedora, Debian, FreeBSD, HP-UX, Solaris, SCO
Posts: 6,015
Blog Entries: 5

Rep: Reputation: 787Reputation: 787Reputation: 787Reputation: 787Reputation: 787Reputation: 787Reputation: 787
Please post the output of the following commands from the server running vsftpd:

iptables -nL

lsof -i :20

lsof -i :21

"ps -ef |egrep -i "xinetd|vsftp"
 
Old 10-19-2012, 08:39 AM   #7
pramodbisht
LQ Newbie
 
Registered: Apr 2012
Location: Chandigarh (IN)
Distribution: CentOS
Posts: 12

Original Poster
Rep: Reputation: Disabled
]# lsof -i :20
(NO output...)

]# lsof -i :21
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
vsftpd 27719 root 3u IPv4 571351 0t0 TCP *:ftp (LISTEN)

]# iptables -nL
Chain INPUT (policy ACCEPT)
target prot opt source destination

Chain FORWARD (policy ACCEPT)
target prot opt source destination

Chain OUTPUT (policy ACCEPT)
target prot opt source destination
(NO rules coz iptables is off...)

]# ps -ef |egrep -i "xinetd|vsftp"
root 27719 1 0 11:50 ? 00:00:00 /usr/sbin/vsftpd /etc/vsftpd/vsftpd.conf
root 29581 29546 0 19:07 pts/0 00:00:00 egrep -i xinetd|vsftp
 
Old 10-19-2012, 12:48 PM   #8
MensaWater
Guru
 
Registered: May 2005
Location: Atlanta Georgia USA
Distribution: Redhat (RHEL), CentOS, Fedora, Debian, FreeBSD, HP-UX, Solaris, SCO
Posts: 6,015
Blog Entries: 5

Rep: Reputation: 787Reputation: 787Reputation: 787Reputation: 787Reputation: 787Reputation: 787Reputation: 787
What is in your vsftpd.conf?

On my RHEL6 where it is working I have:
Code:
# Example config file /etc/vsftpd/vsftpd.conf
#
# The default compiled in settings are fairly paranoid. This sample file
# loosens things up a bit, to make the ftp daemon more usable.
# Please see vsftpd.conf.5 for all compiled in defaults.
#
# READ THIS: This example file is NOT an exhaustive list of vsftpd options.
# Please read the vsftpd.conf.5 manual page to get a full idea of vsftpd's
# capabilities.
#
# Allow anonymous FTP? (Beware - allowed by default if you comment this out).
anonymous_enable=NO
#
# Uncomment this to allow local users to log in.
local_enable=YES
#
# Uncomment this to enable any form of FTP write command.
write_enable=YES
#
# Default umask for local users is 077. You may wish to change this to 022,
# if your users expect that (022 is used by most other ftpd's)
local_umask=022
#
# Uncomment this to allow the anonymous FTP user to upload files. This only
# has an effect if the above global write enable is activated. Also, you will
# obviously need to create a directory writable by the FTP user.
#anon_upload_enable=YES
#
# Uncomment this if you want the anonymous FTP user to be able to create
# new directories.
#anon_mkdir_write_enable=YES
#
# Activate directory messages - messages given to remote users when they
# go into a certain directory.
dirmessage_enable=YES
#
# Activate logging of uploads/downloads.
# The target log file can be vsftpd_log_file or xferlog_file.
# This depends on setting xferlog_std_format parameter
xferlog_enable=YES
#
# Make sure PORT transfer connections originate from port 20 (ftp-data).
connect_from_port_20=YES
#
# If you want, you can arrange for uploaded anonymous files to be owned by
# a different user. Note! Using "root" for uploaded files is not
# recommended!
#chown_uploads=YES
#chown_username=whoever
#
# The name of log file when xferlog_enable=YES and xferlog_std_format=YES
# WARNING - changing this filename affects /etc/logrotate.d/vsftpd.log
#xferlog_file=/var/log/xferlog
#
# Switches between logging into vsftpd_log_file and xferlog_file files.
# NO writes to vsftpd_log_file, YES to xferlog_file
xferlog_std_format=YES
#
# You may change the default value for timing out an idle session.
#idle_session_timeout=600
#
# You may change the default value for timing out a data connection.
#data_connection_timeout=120
#
# It is recommended that you define on your system a unique user which the
# ftp server can use as a totally isolated and unprivileged user.
#nopriv_user=ftpsecure
#
# Enable this and the server will recognise asynchronous ABOR requests. Not
# recommended for security (the code is non-trivial). Not enabling it,
# however, may confuse older FTP clients.
#async_abor_enable=YES
#
# By default the server will pretend to allow ASCII mode but in fact ignore
# the request. Turn on the below options to have the server actually do ASCII
# mangling on files when in ASCII mode.
# Beware that turning on ascii_download_enable enables malicious remote parties
# to consume your I/O resources, by issuing the command "SIZE /big/file" in
# ASCII mode.
# These ASCII options are split into upload and download because you may wish
# to enable ASCII uploads (to prevent uploaded scripts etc. from breaking),
# without the DoS risk of SIZE and ASCII downloads. ASCII mangling should be
# on the client anyway..
#ascii_upload_enable=YES
#ascii_download_enable=YES
#
# You may fully customise the login banner string:
#ftpd_banner=Welcome to blah FTP service.
#
# You may specify a file of disallowed anonymous e-mail addresses. Apparently
# useful for combatting certain DoS attacks.
#deny_email_enable=YES
# (default follows)
#banned_email_file=/etc/vsftpd.banned_emails
#
# You may specify an explicit list of local users to chroot() to their home
# directory. If chroot_local_user is YES, then this list becomes a list of
# users to NOT chroot().
chroot_list_enable=YES
# (default follows)
chroot_list_file=/etc/vsftpd.chroot_list
#
# You may activate the "-R" option to the builtin ls. This is disabled by
# default to avoid remote users being able to cause excessive I/O on large
# sites. However, some broken FTP clients such as "ncftp" and "mirror" assume
# the presence of the "-R" option, so there is a strong case for enabling it.
#ls_recurse_enable=YES

pam_service_name=vsftpd
userlist_enable=YES
#enable for standalone mode
listen=YES
tcp_wrappers=YES
You might want to diff mine from yours.

Also I notice mine has tcp_wrappers set to YES. However, I don't have anything in /etc/hosts.allow or hosts.deny. Do you have it at YES and if so do you have any uncommented lines in those two files?
 
Old 10-19-2012, 03:32 PM   #9
pramodbisht
LQ Newbie
 
Registered: Apr 2012
Location: Chandigarh (IN)
Distribution: CentOS
Posts: 12

Original Poster
Rep: Reputation: Disabled
here is my vsftpd.conf:
# Example config file /etc/vsftpd/vsftpd.conf
#
# The default compiled in settings are fairly paranoid. This sample file
# loosens things up a bit, to make the ftp daemon more usable.
# Please see vsftpd.conf.5 for all compiled in defaults.
#
# READ THIS: This example file is NOT an exhaustive list of vsftpd options.
# Please read the vsftpd.conf.5 manual page to get a full idea of vsftpd's
# capabilities.
#
# Allow anonymous FTP? (Beware - allowed by default if you comment this out).
anonymous_enable=YES
#
# Uncomment this to allow local users to log in.
local_enable=YES
#
# Uncomment this to enable any form of FTP write command.
write_enable=YES
#
# Default umask for local users is 077. You may wish to change this to 022,
# if your users expect that (022 is used by most other ftpd's)
local_umask=022
#
# Uncomment this to allow the anonymous FTP user to upload files. This only
# has an effect if the above global write enable is activated. Also, you will
# obviously need to create a directory writable by the FTP user.
#anon_upload_enable=YES
#
# Uncomment this if you want the anonymous FTP user to be able to create
# new directories.
#anon_mkdir_write_enable=YES
#
# Activate directory messages - messages given to remote users when they
# go into a certain directory.
dirmessage_enable=YES
#
# The target log file can be vsftpd_log_file or xferlog_file.
# This depends on setting xferlog_std_format parameter
xferlog_enable=YES
#
# Make sure PORT transfer connections originate from port 20 (ftp-data).
connect_from_port_20=YES
#
# If you want, you can arrange for uploaded anonymous files to be owned by
# a different user. Note! Using "root" for uploaded files is not
# recommended!
#chown_uploads=YES
#chown_username=whoever
#
# The name of log file when xferlog_enable=YES and xferlog_std_format=YES
# WARNING - changing this filename affects /etc/logrotate.d/vsftpd.log
#xferlog_file=/var/log/xferlog
#
# Switches between logging into vsftpd_log_file and xferlog_file files.
# NO writes to vsftpd_log_file, YES to xferlog_file
xferlog_std_format=YES
#
# You may change the default value for timing out an idle session.
#idle_session_timeout=600
#
# You may change the default value for timing out a data connection.
#data_connection_timeout=120
#
# It is recommended that you define on your system a unique user which the
# ftp server can use as a totally isolated and unprivileged user.
#nopriv_user=ftpsecure
#
# Enable this and the server will recognise asynchronous ABOR requests. Not
# recommended for security (the code is non-trivial). Not enabling it,
# however, may confuse older FTP clients.
#async_abor_enable=YES
#
# By default the server will pretend to allow ASCII mode but in fact ignore
# the request. Turn on the below options to have the server actually do ASCII
# mangling on files when in ASCII mode.
# Beware that on some FTP servers, ASCII support allows a denial of service
# attack (DoS) via the command "SIZE /big/file" in ASCII mode. vsftpd
# predicted this attack and has always been safe, reporting the size of the
# raw file.
# ASCII mangling is a horrible feature of the protocol.
#ascii_upload_enable=YES
#ascii_download_enable=YES
#
# You may fully customise the login banner string:
#ftpd_banner=Welcome to blah FTP service.
#
# You may specify a file of disallowed anonymous e-mail addresses. Apparently
# useful for combatting certain DoS attacks.
#deny_email_enable=YES
# (default follows)
#banned_email_file=/etc/vsftpd/banned_emails
#
# You may specify an explicit list of local users to chroot() to their home
# directory. If chroot_local_user is YES, then this list becomes a list of
# users to NOT chroot().
#chroot_list_enable=YES
# (default follows)
#chroot_list_file=/etc/vsftpd.chroot_list
#
# You may activate the "-R" option to the builtin ls. This is disabled by
# default to avoid remote users being able to cause excessive I/O on large
# sites. However, some broken FTP clients such as "ncftp" and "mirror" assume
# the presence of the "-R" option, so there is a strong case for enabling it.
#ls_recurse_enable=YES
#
# When "listen" directive is enabled, vsftpd runs in standalone mode and
# listens on IPv4 sockets. This directive cannot be used in conjunction
# with the listen_ipv6 directive.
listen=YES
#
# This directive enables listening on IPv6 sockets. To listen on IPv4 and IPv6
# sockets, you must run two copies of vsftpd with two configuration files.
# Make sure, that one of the listen options is commented !!
#listen_ipv6=YES

pam_service_name=vsftpd
userlist_enable=YES
#tcp_wrappers=YES
pasv_promiscuous=YES

#to add passive ftp:
#port_enable=YES
pasv_enable=YES
pasv_max_port=11200
pasv_min_port=11100
#pasv_address="your external i nstance ip or address"
 
Old 10-22-2012, 12:47 PM   #10
MensaWater
Guru
 
Registered: May 2005
Location: Atlanta Georgia USA
Distribution: Redhat (RHEL), CentOS, Fedora, Debian, FreeBSD, HP-UX, Solaris, SCO
Posts: 6,015
Blog Entries: 5

Rep: Reputation: 787Reputation: 787Reputation: 787Reputation: 787Reputation: 787Reputation: 787Reputation: 787
You seem to have other lines in yours that I don't have in mine.

I notice specifically:
pasv_max_port=11200
pasv_min_port=11100

If you type "man vsftpd.conf" it will tell you the purpose of each setting. Anything started with a "#" is commented out so can be ignored. Everything else you should look into. The two lines above have the effect of saying to use any port from 11100 to 11200 for your pasv connection. You might want to verify those ports aren't in use for something else.

One idea would be to save a copy of yours (cp -p vsftpd.conf vsftpd.conf20121022) then put mine in its place and restart vsftpd to see if it makes a difference. You can then copy your original back over mine to get back to where you started.
 
Old 10-22-2012, 05:07 PM   #11
Dolmio
LQ Newbie
 
Registered: Jan 2008
Posts: 2

Rep: Reputation: 0
Quote:
Originally Posted by pramodbisht View Post
Hi All,
I have EC2 Micro Instance which has FTP server (VSFTPD) installed. I ftp it from server itself, it works fine! That means service is ON and working fine.
but if I try to get FTP from any other client (via internet) it logs-in and works fine over 21 port(for commands) but as client request for the data it says, - "421 Service not available, remote server has closed connection Passive mode refused."
If I put "passive" command in ftp after login, It says:"passive mode is off" and then works fine in active mode!!
I m confused that why passive mode is not working??
Although firewall is off in both sides, Other security tools are also disable.

Thanks In Advance!
Hello all

I'm struggeling with the same problem. I followed the advice of several guides, I found on the internet and added the following lines to /etc/vsftpd.conf:

Code:
pasv_enable=YES
pasv_min_port=60000
pasv_max_port=60100
pasv_address=91.100.xxx.xxx
port_enable=YES
I can connect in active mode without problems but not in passive mode.

I have configured my router to forward ports 60000 - 60100 and 20 - 21 to the pc running vsftpd. There is no firewall installed on the pc running vsftpd and I have tried connecting from an Arch Linux computer and a Windows 7 computer, both with no firewall enabled.

Since I'm running systemd I issue the command "systemctl enable vsftpd.service" to enable the service, and "systemctl restart vsftpd.service" to restart it after I made changes to vsftpd.conf. I don't know if this makes any difference.

I have spent many hours trying to figure this one out so suggestions are more than welcome :-)

Thanks :-)

EDIT: I tried to connect to the vsftp-server from a computer outside my LAN (from an ADSL at work) and it worked!

I tested with a Filezilla-client.

First, I tried to connect in default mode (which is passive) and it worked fine.

Then I forced the Filezilla-client to connect in active mode and it worked too without any problems. The only obvious difference was that the Windows-firewall asked me to allow Filezilla to connect to my FTP-server.

After reading 'man vsftpd', I found out that default mode in vsftpd is passive so 'pasv_enable=YES' is not needed.

/Dolmio

Last edited by Dolmio; 10-25-2012 at 10:12 AM. Reason: Soleved problem
 
  


Reply

Tags
passive ftp, vsftpdconf


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
VSFTPD - Passive mode refused hectorharvey Linux - Server 10 04-20-2012 04:31 PM
vsftpd with port 2021 not going to passive mode jjjj12212 Linux - Software 6 02-13-2012 01:14 PM
Vsftpd Entering passive mode pramka Suse/Novell 1 07-18-2008 07:20 PM
Problem with vsftpd and passive mode 0001001 Linux - Server 1 09-12-2006 07:18 AM
why does FTP server send local network address in passive mode? edesmarais Linux - Newbie 11 03-16-2005 12:33 AM


All times are GMT -5. The time now is 11:15 AM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration