2

Here is the scenario:

  • We have one AWS Ubuntu server Server
  • This server is working as ftp client
  • Now when we try to connect to XYZ companies ftp server using this AWS server as client, it is sending it's local LAN IP while connecting to the ftp server, because of which listing of directories does not work.
  • Log shows that we are connected to the FTP server + we are authenticated correctly... port listing goes successful + only directory listing fails.
  • we can provide specific IP in FTP using filezilla which it will use while going out of the gateway.
  • here we can't use that because it does not have GUI & it is going to be used by a php script.
  • This problem was also there in windows at that time we solved it by giving a elastic IP to FileZilla. before the solution we used to receive the error & log showed like This. this point is added just to give you more details. & it's the same issue with Ubuntu & we want to give a elastic IP somewhere in ftp so that it will start working... we hope so at least. ;)

Recent updates

  • please click here for vsftpd.conf file.

  • little more clarification :

    In this case machine "A" is our FTP Server (which is AWS Ubuntu server) for internal usage, because of the lot of other process and data which is regularly uploaded on this FTP Server (Machine "A") & Machine "B" is our client's FTP Server which they use for their internal purposes. Now we need to pull some data from our clients FTP Server (i.e. Machine "B") to our server (i.e. Machine "A") and then process it. after that we need to put the processed data back on to the client's FTP Server (i.e. Machine "B"). that's what is not working

  • Logs of clients firewall when we tried to connect with machine "B" as shown in below image.

Firewall Log 1

Firewall Log 2

  • I'm not sure if the title of this question matches the description. Your AWS Ubuntu server connects to other FTP servers to fetch files. Is this correct? What ftp client is doing that? – Hugo Vieira Aug 28 '13 at 18:40
  • @HugoVieira I Just can't understand your last question... can you please elaborate on that. & u are right my AWS Ubuntu Server is suppose to connect to other FTP Server (Which is of our clients) to fetch files, which is not happening as my client allows connections from our Public IP of AWS Server. and here our AWS Ubuntu Server is sending the Private IP while trying to connect to our clients FTP Server which is creating a problem. However my AWS ubuntu Server has vsftpd installed on it as this AWS Ubuntu Server is also an FTP server which is used by us. – Hrish Aug 29 '13 at 3:29
  • Your AWS Ubuntu Server is machine "A" and the other FTP Server is machine "B". Machine B requires an FTP server like vsftpd, but your machine A does not require it because its fetching files and not serving them. Vsftpd is an FTP server and you don't need it. What program are you using in machine A to fetch the files? It can be something like "ftp", "wget", among others... – Hugo Vieira Aug 29 '13 at 9:46
  • @HugoVieira Apologize for the late response. In this case machine "A" is our FTP Server (which is AWS Ubuntu server) for internal usage, because of the lot of other process and data which is regularly uploaded on this FTP Server (Machine "A") & Machin "B" is our client's FTP Server which they use for their internal purposes. Now we need to pull some data from our clients FTP Server (i.e. Machine "B") to our server (i.e. Machine "A") and then process it. after that we need to put the processed data back on to the client's FTP Server (i.e. Machine "B"). that's what is not working. – Hrish Oct 8 '13 at 4:13
  • @HugoVieira please check the vsftpd.conf file in the question that I have recently added. – Hrish Oct 8 '13 at 4:17
3

This is my understanding of your scenario:

  • You have Machine A in Your Network with an FTP Server and an FTP Client;
  • You want to pull files from Machine B that is in Client's Network;
  • There is a firewall in Your Network and possibly in Client's Network;
  • You will use FTP client to push and pull files from Machine B.

Network

FTP works in two modes:

- Active Mode -

In active mode FTP, the client connects from a random unprivileged port (N > 1023) to the FTP server's command port, port 21. Then, the client starts listening to port N+1 and sends the FTP command PORT N+1 to the FTP server. The server will then connect back to the client's specified data port (...)

Example:

  1. FTP client in machine "A" connects to FTP server in machine "B" on port 21;
  2. Machine "A" sends "ls" to machine "B", but because it is Active Mode, the result of "ls" will be delivered to port N+1 (N>1023) of machine "A";
  3. This fails because FTP client in machine "A" asks machine "B" to connect to a private IP. Even if the IP is public, the ports N+1 must be open in the firewall.

- Passive Mode -

In passive mode FTP, the client initiates both connections to the server, solving the problem of firewalls filtering the incoming data port connection to the client from the server. When opening an FTP connection, the client opens two random unprivileged ports locally (N > 1023 and N+1). The first port contacts the server on port 21, but instead of then issuing a PORT command and allowing the server to connect back to its data port, the client will issue the PASV command. The result of this is that the server then opens a random unprivileged port (P > 1023) and sends P back to the client in response to the PASV command. The client then initiates the connection from port N+1 to port P on the server to transfer data. (...)

Example:

  1. FTP client in machine "A" connects to FTP server in machine "B" on port 21;
  2. Machine "A" sends "ls" to machine "B";
  3. This time, the result will not be delivered to port N+1 of machine "A". Instead, machine "B" informs machine "A" that the result is waiting to be fetched in a given IP and port of machine "B".
  4. This fails when this IP is private and port is not open in client's firewall. That is why the client must configure his FTP server to use a public IP and a known port (see Cubiq's answer).

These are the solutions you have:

  1. Using Active Mode (considering that machine "A" has IP 175.41.135.142): Right after connection and authentication, issue this command: PORT 175,41,135,142,14,178 You will need to open port 3762 in you firewall. The ,14,178 comes from the convertion of octets to decimal ((14*256) + 178).
  2. Using Passive Mode: For this method to work, the client must have a configuration like Cubiq's answer. Right after the connection and authentication, issue this command: passive

Now you should be able to "ls".

You can read more about how FTP works here: http://slacksite.com/other/ftp.html

This page is also good to understand the FTP modes: http://www.deskshare.com/resources/articles/ftp-how-to.aspx

| improve this answer | |
4

Add to your vsftpd config (/etc/vsftpd.conf):

pasv_enable=YES
port_enable=YES
pasv_min_port=<port-start>
pasv_max_port=<port-end>
pasv_address=<your-machine-ip>
pasv_addr_resolve=NO

In the security config of your instance open port 20-21 for FTP, also enable passive ports to the range you specified above (pasv_min/max_port, eg: 64000-64100).

Restart vsftpd.

if that doesn't work you can try to replace the last two lines with:

pasv_address=<public-address>
pasv_addr_resolve=YES
| improve this answer | |
  • I tried what you suggested still it's going out with local IP and not the Pubic IP that I have given in the conf file as you stated above... :( any other suggestions! – Hrish Aug 23 '13 at 4:56
  • are you sure you are using the correct pasv_address? one is the machine ip the other the public one – Cubiq Aug 23 '13 at 6:53
  • Yes I am not using the Private IP of the server which shows up in result of ifconfig command. I am using the Public IP which is used for NATing of our AWS Ubuntu Server's Private IP. – Hrish Aug 29 '13 at 3:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.