Hi All,
I have EC2 Micro Instance which has FTP server (VSFTPD) installed. I ftp it from server itself, it works fine! That means service is ON and working fine.
but if I try to get FTP from any other client (via internet) it logs-in and works fine over 21 port(for commands) but as client request for the data it says, - "421 Service not available, remote server has closed connection Passive mode refused."
If I put "passive" command in ftp after login, It says:"passive mode is off" and then works fine in active mode!!
I m confused that why passive mode is not working??
Although firewall is off in both sides, Other security tools are also disable.

---- vsftpd.conf---

anonymous_enable=NO
local_enable=YES
write_enable=YES
local_umask=022
dirmessage_enable=YES
tcp_wrappers=YES
pasv_promiscuous=YES
port_enable=YES
pasv_enable=YES
pasv_max_port=11200
pasv_min_port=11100
---------------------------------------
Need your help!!!

Thanks In Advance!

I just ran into an issue with this on RHEL and found my issue was in the iptables configuration file (not the rules file).

On RHEL there is a file /etc/sysconfig/iptables-config. One should check to see if the IPTABLES_MODULES line is uncommented and allows for ip_conntrack_ftp.
e.g.
IPTABLES_MODULES="ip_conntrack_ftp"

On the server I had the issue on I found the line as:
IPTABLES_MODULES="ip_conntrack_netbios_ns"

I changed it to:
IPTABLES_MODULES="ip_conntrack_netbios_ns ip_conntrack_ftp"

That got everything working (after running "service iptables restart").

Also you need to open ports 20/21 in iptables itself.

The post that helped me figure out my issue was:
http://balajitheone.blogspot.com/201...or-vsftpd.html

Note that the foregoing talks is about RHEL and would be valid for CentOS but may be different on your distro (e.g. a different config file to set conntrack).

One quick way to narrow down the issue to iptables is to stop iptables then do the test. If it works then iptables is the issue and you can focus on whether it is the config file or the rules. (The rules on RHEL are also in /etc/sysconfig/iptables.) Before changing any rules or stopping iptables make sure you run iptables-save to save a copy of your existing rules so you can revert to them if necessary.

Hi,
Thanks for your Reply!! But do you think this (IPTABLES_MODULES="ip_conntrack_ftp") can create any issue if IPtables is off??
as I told in last post "Although firewall is off in both sides, Other security tools are also disable. "


Thanks!!

In my case when I turned off iptables temporarily the issue went away. After I made the modification and turned iptables back on the issue was resolved. Since I don't know your distro I can't be sure how it works with this. Note that iptables is actually built into the kernel so even when "off" there is a minimal rule set shown. What do you see when you run "iptables -nL" on both hosts?

It is possible you have something else going on:
There are conntrack settings in the kernel (look at "man sysctl" documentation) and possibly one of those is affecting you.
Are you sure there is no firewall device exists between the systems? (e.g. Is there a switch you're going through that possibly has its own firewall settings?)
Also you might want to explore tcp wrappers - I didn't have to deal with those and don't know off the top of my head if vsftp is tcp wrappers aware.

Are you running vsftpd as a daemon or is it being run under xinetd (or inetd)? What is in the relevant configuration file(s)?

In my case RHEL-6 is installed in both Hosts.when I command "iptables -nL" both hosts show no rules.
I m sure that no firewall exist in between and also TCPwrapper is not affecting here.
also there is nothing for conntrack in man sysctl, can conntrack effect me here?
and vsftpdf is running as a daemon. here are related configs :-
/etc/pam.d/vsftpd
/etc/vsftpd/ftpusers
/etc/vsftpd/user_list

Please post the output of the following commands from the server running vsftpd:

iptables -nL

lsof -i :20

lsof -i :21

"ps -ef |egrep -i "xinetd|vsftp"

]# lsof -i :20
(NO output...)

]# lsof -i :21
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
vsftpd 27719 root 3u IPv4 571351 0t0 TCP *:ftp (LISTEN)

]# iptables -nL
Chain INPUT (policy ACCEPT)
target prot opt source destination

Chain FORWARD (policy ACCEPT)
target prot opt source destination

Chain OUTPUT (policy ACCEPT)
target prot opt source destination
(NO rules coz iptables is off...)

]# ps -ef |egrep -i "xinetd|vsftp"
root 27719 1 0 11:50 ? 00:00:00 /usr/sbin/vsftpd /etc/vsftpd/vsftpd.conf
root 29581 29546 0 19:07 pts/0 00:00:00 egrep -i xinetd|vsftp

What is in your vsftpd.conf?

On my RHEL6 where it is working I have:
You might want to diff mine from yours.

Also I notice mine has tcp_wrappers set to YES. However, I don't have anything in /etc/hosts.allow or hosts.deny. Do you have it at YES and if so do you have any uncommented lines in those two files?

here is my vsftpd.conf:
# Example config file /etc/vsftpd/vsftpd.conf
#
# The default compiled in settings are fairly paranoid. This sample file
# loosens things up a bit, to make the ftp daemon more usable.
# Please see vsftpd.conf.5 for all compiled in defaults.
#
# READ THIS: This example file is NOT an exhaustive list of vsftpd options.
# Please read the vsftpd.conf.5 manual page to get a full idea of vsftpd's
# capabilities.
#
# Allow anonymous FTP? (Beware - allowed by default if you comment this out).
anonymous_enable=YES
#
# Uncomment this to allow local users to log in.
local_enable=YES
#
# Uncomment this to enable any form of FTP write command.
write_enable=YES
#
# Default umask for local users is 077. You may wish to change this to 022,
# if your users expect that (022 is used by most other ftpd's)
local_umask=022
#
# Uncomment this to allow the anonymous FTP user to upload files. This only
# has an effect if the above global write enable is activated. Also, you will
# obviously need to create a directory writable by the FTP user.
#anon_upload_enable=YES
#
# Uncomment this if you want the anonymous FTP user to be able to create
# new directories.
#anon_mkdir_write_enable=YES
#
# Activate directory messages - messages given to remote users when they
# go into a certain directory.
dirmessage_enable=YES
#
# The target log file can be vsftpd_log_file or xferlog_file.
# This depends on setting xferlog_std_format parameter
xferlog_enable=YES
#
# Make sure PORT transfer connections originate from port 20 (ftp-data).
connect_from_port_20=YES
#
# If you want, you can arrange for uploaded anonymous files to be owned by
# a different user. Note! Using "root" for uploaded files is not
# recommended!
#chown_uploads=YES
#chown_username=whoever
#
# The name of log file when xferlog_enable=YES and xferlog_std_format=YES
# WARNING - changing this filename affects /etc/logrotate.d/vsftpd.log
#xferlog_file=/var/log/xferlog
#
# Switches between logging into vsftpd_log_file and xferlog_file files.
# NO writes to vsftpd_log_file, YES to xferlog_file
xferlog_std_format=YES
#
# You may change the default value for timing out an idle session.
#idle_session_timeout=600
#
# You may change the default value for timing out a data connection.
#data_connection_timeout=120
#
# It is recommended that you define on your system a unique user which the
# ftp server can use as a totally isolated and unprivileged user.
#nopriv_user=ftpsecure
#
# Enable this and the server will recognise asynchronous ABOR requests. Not
# recommended for security (the code is non-trivial). Not enabling it,
# however, may confuse older FTP clients.
#async_abor_enable=YES
#
# By default the server will pretend to allow ASCII mode but in fact ignore
# the request. Turn on the below options to have the server actually do ASCII
# mangling on files when in ASCII mode.
# Beware that on some FTP servers, ASCII support allows a denial of service
# attack (DoS) via the command "SIZE /big/file" in ASCII mode. vsftpd
# predicted this attack and has always been safe, reporting the size of the
# raw file.
# ASCII mangling is a horrible feature of the protocol.
#ascii_upload_enable=YES
#ascii_download_enable=YES
#
# You may fully customise the login banner string:
#ftpd_banner=Welcome to blah FTP service.
#
# You may specify a file of disallowed anonymous e-mail addresses. Apparently
# useful for combatting certain DoS attacks.
#deny_email_enable=YES
# (default follows)
#banned_email_file=/etc/vsftpd/banned_emails
#
# You may specify an explicit list of local users to chroot() to their home
# directory. If chroot_local_user is YES, then this list becomes a list of
# users to NOT chroot().
#chroot_list_enable=YES
# (default follows)
#chroot_list_file=/etc/vsftpd.chroot_list
#
# You may activate the "-R" option to the builtin ls. This is disabled by
# default to avoid remote users being able to cause excessive I/O on large
# sites. However, some broken FTP clients such as "ncftp" and "mirror" assume
# the presence of the "-R" option, so there is a strong case for enabling it.
#ls_recurse_enable=YES
#
# When "listen" directive is enabled, vsftpd runs in standalone mode and
# listens on IPv4 sockets. This directive cannot be used in conjunction
# with the listen_ipv6 directive.
listen=YES
#
# This directive enables listening on IPv6 sockets. To listen on IPv4 and IPv6
# sockets, you must run two copies of vsftpd with two configuration files.
# Make sure, that one of the listen options is commented !!
#listen_ipv6=YES

pam_service_name=vsftpd
userlist_enable=YES
#tcp_wrappers=YES
pasv_promiscuous=YES

#to add passive ftp:
#port_enable=YES
pasv_enable=YES
pasv_max_port=11200
pasv_min_port=11100
#pasv_address="your external i nstance ip or address"

You seem to have other lines in yours that I don't have in mine.

I notice specifically:
pasv_max_port=11200
pasv_min_port=11100

If you type "man vsftpd.conf" it will tell you the purpose of each setting. Anything started with a "#" is commented out so can be ignored. Everything else you should look into. The two lines above have the effect of saying to use any port from 11100 to 11200 for your pasv connection. You might want to verify those ports aren't in use for something else.

One idea would be to save a copy of yours (cp -p vsftpd.conf vsftpd.conf20121022) then put mine in its place and restart vsftpd to see if it makes a difference. You can then copy your original back over mine to get back to where you started.

Hello all

I'm struggeling with the same problem. I followed the advice of several guides, I found on the internet and added the following lines to /etc/vsftpd.conf:

I can connect in active mode without problems but not in passive mode.

I have configured my router to forward ports 60000 - 60100 and 20 - 21 to the pc running vsftpd. There is no firewall installed on the pc running vsftpd and I have tried connecting from an Arch Linux computer and a Windows 7 computer, both with no firewall enabled.

Since I'm running systemd I issue the command "systemctl enable vsftpd.service" to enable the service, and "systemctl restart vsftpd.service" to restart it after I made changes to vsftpd.conf. I don't know if this makes any difference.

I have spent many hours trying to figure this one out so suggestions are more than welcome :-)

Thanks :-)

EDIT: I tried to connect to the vsftp-server from a computer outside my LAN (from an ADSL at work) and it worked!

I tested with a Filezilla-client.

First, I tried to connect in default mode (which is passive) and it worked fine.

Then I forced the Filezilla-client to connect in active mode and it worked too without any problems. The only obvious difference was that the Windows-firewall asked me to allow Filezilla to connect to my FTP-server.

After reading 'man vsftpd', I found out that default mode in vsftpd is passive so 'pasv_enable=YES' is not needed.

/Dolmio