VSFTP (Pasv) its running, its not running :-(

MrLight · #1 10th November 2007, 02:19 PM

Hello Forum!

I installed on a fedora 7 Server "vsftpd", and I want to use it in pasv mode.

Here a part from vsftpd.conf:

Code:

pam_service_name=vsftpd
userlist_enable=YES
#enable for standalone mode
listen=YES
tcp_wrappers=YES

#user_config_dir=/etc/vsftpd_user_conf
chroot_local_user=YES
hide_ids=YES
write_enable=YES
guest_enable=YES
guest_username=virtual
anon_world_readable_only=NO
anon_other_write_enable=YES
anon_upload_enable=YES
#anon_umask=007
anon_umask=007
anon_mkdir_write_enable=YES
user_sub_token=$USER
#session_support=YES
setproctitle_enable=YES


#Add ons for passive FTP
pasv_enable=YES
pasv_address=XX.XXX.XXX.18
pasv_min_port=1051
pasv_max_port=1061

In the router I add the ports from 1051 to 1061 to point to the Server. So far so good! I was thinking that its! But it isn't.

When I try to conect to the server sometimes it is running, sometimes not. here an example:

Code:

ftp adresse.de
Connected to adresse.de.
220 Welcome to The adresse FTP service.
530 Please login with USER and PASS.
530 Please login with USER and PASS.
KERBEROS_V4 rejected as an authentication type
Name (adresse.de:user): XXX
331 Please specify the password.
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls
227 Entering Passive Mode (XX,XXX,XXX,18,4,27)
150 Here comes the directory listing.
226 Directory send OK.
ftp> ls
227 Entering Passive Mode (XX,XXX,XXX,18,4,32)
ftp: connect: Connection timed out
ftp>

how You see the same "ls" function sometime nice, and 5 sec later doesnt, and if I do it again, it maybe works.

I have no idea, where I can look to fix this Problem I looked everywhere and googel is my friend, but no way...

--- please ---

If someone have a hint, or know how to help me, it would be very very nice...

thx a lot!

Mr Light :-)

pS. sorry my bad English ...

aleph · #2 10th November 2007, 02:45 PM

I'm not an expert with TCP/IP but a suggestion --- run ftp with debug infomation and see what is returned

Code:

ftp -d adresse.de

My only experience with FTP server is limited in my dormitory's intenal use (running pure-ftpd on Fedora 7/8 as an F8 installation source). I see you own a top-level domain name (is that the word "address" in German?) so my little experience may not help but probably I guess the problem is in the NAT or firewalling issues, either server-side or client-side. One of my friend runs a FTP in the college's lab and the router on his side is misconfigured and all the data ports are mangled into a mess...

And are your system's ip filter rules blocking certain port ranges used by FTP clients to initialize passive mode transfer?

MrLight · #3 10th November 2007, 04:02 PM

I switched the firewall off:

Code:

service iptables stop

The result of ftp -p adresse.de is: // adresse.de is a fictiv adress ... :-)

Code:

[user@zeus /]# ftp -d adresse.de
Connected to adresse.de.
220 Welcome to The adresse FTP service.
---> AUTH GSSAPI
530 Please login with USER and PASS.
---> AUTH KERBEROS_V4
530 Please login with USER and PASS.
KERBEROS_V4 rejected as an authentication type
Name (adresse.de:user): XXX
---> USER XXX
331 Please specify the password.
Password:
---> PASS XXXX
230 Login successful.
---> SYST
215 UNIX Type: L8
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls
---> PASV
227 Entering Passive Mode (XX,XXX,XXX,18,4,30)
---> LIST
150 Here comes the directory listing.
226 Directory send OK.
ftp> ls
---> PASV
227 Entering Passive Mode (XX,XXX,XXX,18,4,30)
---> LIST
150 Here comes the directory listing.
226 Directory send OK.
ftp> ls
---> PASV
227 Entering Passive Mode (XX,XXX,XXX,18,4,28)
---> LIST
150 Here comes the directory listing.
226 Directory send OK.
ftp> ls
---> PASV
227 Entering Passive Mode (XX,XXX,XXX,18,4,37)
ftp: connect: Connection timed out
ftp> quit
---> QUIT
221 Goodbye.
[user@zeus /]#

Sometimes it goes like here view times, sometimes it doesn't go generaly...

How to configure a NAT, without a firewall or generaly I don't know :-(

What to write to chek if there is everything ok?

Mr Light :-)
THX ...

MrLight · #4 11th November 2007, 12:31 PM

The Internetconnection, where the Server is placed has only a upload of 256 KByte. But if in the same time other Computers are up- and downloading, Skyping and do other strange things, it could be, that there is not allways enough bandwidth for response.

Second at one other place I hear that some D-Link routers have problems with it, so You have to switch off two thing, so it will function proper:

SPI-Mode

und

DoS-Protection.

When I fixed both points (router and bandwidth), the problem disapier, like never was ...

I hope, with this post to help someone, who stay infront of the same Problem ...

Mr Light

pS: THX for Help :-)