3

I'm using a Ubuntu Server on a VirtualBox machine. Apache and SSH are working, but FTP after successfully connect to the server and login, it sends a error message:

 - Command: PORT 127,0,0,1,180,221 
 - Response: 500 Illegal PORT command.
 - Error: Failed to retrieve directory listing

Port Forwarding:
TCP | Host Port 2100 | Guest Port 21

My vstpd.conf file: 

listen=YES
pasv_enable=YES
pasv_min_port=2005
pasv_max_port=2010
port_enable=YES
anonymous_enable=YES
local_enable=YES
write_enable=YES
anon_upload_enable=YES
anon_mkdir_write_enable=YES
dirmessage_enable=YES
use_localtime=YES
xferlog_enable=YES
connect_from_port_20=NO
ftpd_banner=Welcome.
chroot_local_user=NO
chroot_list_enable=YES
chroot_list_file=/etc/vsftpd.chroot_list
secure_chroot_dir=/var/run/vsftpd/empty
pam_service_name=vsftpd
rsa_cert_file=/etc/ssl/private/vsftpd.pem
Improve this question
2
  • Check your logs to see if they give a reason. Also check and see what it says the IP address of the client is when you connect. If it is your real IP address instead of 127.0.0.1, then that's the problem.
    – psusi
    Commented Jan 14, 2014 at 19:18
  • @guntbert It's already fixed, this question it's from months ago.
    – Kenny
    Commented Jan 17, 2014 at 6:55

2 Answers 2

Reset to default
6

jackbenny is close...

I am running on AWS with Ubuntu here is what I did to make vsftpd behave correctly:

seccomp_sandbox=NO
allow_writeable_chroot=YES
pasv_address=<(public ip) or (AWS public domain or DNS)>
pasv_enable=Yes
pasv_min_port=30000
pasv_max_port=30100
port_enable=YES

Then you have to make sure you are allowing ports, 20,21,30000-30100 through. Keep in mind that the port choices 30000-30100 are completely arbitrary and can be whatever you want. Although, I would stick to ports above 10000 and a range of 100 or more.

Improve this answer
5
  • Again, he's not using pssive mode.
    – psusi
    Commented Jan 14, 2014 at 19:17
  • I know that... however, certain programs will ONLY use passive mode for some commands. For example, the program I was using, I had passive explicitly set to off yet I received this error. So, I did the above and it worked.
    – Brandon Bearden
    Commented Jan 16, 2014 at 14:48
  • If it had been using passive mode, then it wouldn't get a failure from the PORT command. Passive means use the PASV command instead of PORT.
    – psusi
    Commented Jan 16, 2014 at 15:39
  • This error manifests when the FTP server changes from listening on port 21 to another, higher port. When a command is issued that uses passive mode, the server establishes a new back connection to the client. This connection extends from the server (outside the firewall boundaries) to a dynamically allocated port number on the client computer. Because the port number is not known in advance, it chooses a random port above 1023 unless specifically given a range to choose within. This port error can most definitely be caused by a command using passive when the server is not setup for passive.
    – Brandon Bearden
    Commented Jan 16, 2014 at 15:49
  • Thx, it also work for aliyun.
    – suiwenfeng
    Commented Jul 8, 2017 at 4:52
5

Did you get that error while connecting from "the outside"? In that case you might need to add your external IP to vsftpd so that it know which IP to send to it's clients when using passive mode FTP.

Try adding pasv_address=<YOUR_IP_HERE> to your config.

You can also try to switch your FTP-client to active mode and see if you still get the same error.

You might also need to set the port range for passiv FTP and also enabling passiv mode FTP. Try addning these lines (replace START_PORT and END_PORT with your desired ports, and also don't forget to port forward them in your router):

pasv_enable=Yes
pasv_min_port=<START_PORT>
pasv_max_port=<END_PORT>
Improve this answer
3
  • Locally. I'm still searching information about vftpd behind NAT with no luck. And yes, I switched a few times the mode, but same error appears.
    – Kenny
    Commented Oct 13, 2013 at 17:49
  • 1
    I think something it's wrong here, passive mode it's from port 2005 to 2010. But FileZilla connects to port 842 (192*4+74). I restarted the service a few times.
    – Kenny
    Commented Oct 13, 2013 at 17:55
  • That's for when the PASV response has the wrong address...
    – psusi
    Commented Jan 14, 2014 at 19:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .