2

So, I've been researching FTP/FTPS, and have been trying to set up a working FTPS server. To use FTP(S), I've been using the service vsftpd, and the my server is an amazon EC2 instance running Ubuntu 14.04. 

masq@ftp:~$ uname -a
Linux ftp 3.15.0-031500rc2-generic #201404201435 SMP Sun Apr 20 18:36:18 UTC 2014 x86_64 x86_64 x86_64 GNU/Linux

Now, the configuration file seems pretty straightforward in setting up. HOW-EVER, things.. aren't working properly... for some reason...

The problem I'd like addressed in this thread is the problem of passive vs. active configuration. Now, I've enabled pasv mode in the config file. I've specified some ports for pasv to utilize, and I've specified the address that it's on... etc. (I'll post my file's config below) and yet... I still get this error when i issue an "ls" command over ftp! Here is an example run of that (I'm just FTPing to localhost so i know that firewall stuff isn't getting in the way (that does ensure that firewall doesn't get in the way... right?!)):

masq@ftp:~$ ftp localhost
Connected to localhost.
220 (vsFTPd 3.0.2)
Name (localhost:masq): john
331 Please specify the password.
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls
200 PORT command successful. Consider using PASV.
150 Here comes the directory listing.
-rw-rw-r--    1 1000     1000            0 Feb 18 04:55 random
226 Directory send OK.
ftp> passive
Passive mode on.
ftp> ls
227 Entering Passive Mode (xxx,xxx,xxx,xxx,46,229).
ftp: connect: Connection refused
ftp>

and here is my config file...

# allow anyone to connect?
anonymous_enable=NO

# is it turned on?
listen=YES
xferlog_enable=YES
log_ftp_protocol=YES

# allow people to upload?
write_enable=NO

# allow people to download?
download_enable=YES

# passive/active mode configuration
port_enable=YES
pasv_enable=YES
pasv_min_port=12000
pasv_max_port=12050
pasv_address=<retracted public IP>
# if pasv_address_resolve=YES, pasv_address should be a name, e.g. ftp.blah.com
#pasv_addr_resolve=YES

# local account enable
local_enable=YES
chroot_local_user=YES
user_sub_token=$USER
local_root=/home/$USER
allow_writeable_chroot=YES

# ssl config
#ssl_enable=YES

So... I've got pasv_enable=YES... and all of the other options set as properly as all my research has told me, and yet it's not actually able to work in pasv mode. Does anyone know why this isn't working? >_>

I've tried to reach this server from the internet using a computer that will not work with active connections and it fails to get directory listings, i.e. pasv is definitely not working. :/

Thanks, guys, I'm really stumped with this one. I can provide any more information if necessary.

P.S. I did configure my ec2 security group to open ports 12000-12050, ports 20-21, TCP... so i don't think that's a problem either.

EDIT 1: Ubuntu version is 14.04 LTS Trusty. vsftpd: version 3.0.2

masq@ftp:~$ sudo cat /var/log/vsftpd.log                                  
Thu Mar 12 00:35:38 2015 [pid 19825] 
CONNECT: Client "127.0.0.1"          
Thu Mar 12 00:35:46 2015 [pid 19824] 
[masq] OK LOGIN: Client "127.0.0.1"  
Thu Mar 12 00:37:19 2015 [pid 19834] 
CONNECT: Client "127.0.0.1"          
Thu Mar 12 00:37:24 2015 [pid 19833] 
[masq] OK LOGIN: Client "127.0.0.1"

^ there is a run of me logging in via localhost and requesting a directory. then i logged out and logged back in and issued the passive command, and it failed despite having pasv_enable=YES in the config file as i showed in the original post.

Something else i noticed is that if i just run 

$sudo vsftpd
500 OOPS: could not bind listening IPv4 socket

I get this error. once again, I'm using amazon ec2 and so as my pasv_address=xxx.xxx.xxx.xxx is my public ip address, not my private one. do you know where in the logs i could find logs being more verbose about what that failure to bind to the socket error? I just discovered this since posting, and I'm starting to think this is the cause of my problem.

EDIT_2: I tried connecting from an external source, and tried locally (just FTPing localhost on my server box)

Wed Mar 18 01:36:10 2015 [pid 8194] CONNECT: Client "127.0.0.1"
Wed Mar 18 01:36:10 2015 [pid 8194] FTP response: Client "127.0.0.1", "220 (vsFTPd 3.0.2)"
Wed Mar 18 01:36:16 2015 [pid 8194] FTP command: Client "127.0.0.1", "USER masq"
Wed Mar 18 01:36:16 2015 [pid 8194] [masq] FTP response: Client "127.0.0.1", "331 Please specify the password."
Wed Mar 18 01:36:20 2015 [pid 8194] [masq] FTP command: Client "127.0.0.1", "PASS <password>"
Wed Mar 18 01:36:20 2015 [pid 8193] [masq] OK LOGIN: Client "127.0.0.1"
Wed Mar 18 01:36:20 2015 [pid 8195] [masq] FTP response: Client "127.0.0.1", "230 Login successful."
Wed Mar 18 01:36:20 2015 [pid 8195] [masq] FTP command: Client "127.0.0.1", "SYST"
Wed Mar 18 01:36:20 2015 [pid 8195] [masq] FTP response: Client "127.0.0.1", "215 UNIX Type: L8"
Wed Mar 18 01:36:22 2015 [pid 8195] [masq] FTP command: Client "127.0.0.1", "PORT 127,0,0,1,204,221"
Wed Mar 18 01:36:22 2015 [pid 8195] [masq] FTP response: Client "127.0.0.1", "200 PORT command successful. Consider using PASV."
Wed Mar 18 01:36:22 2015 [pid 8195] [masq] FTP command: Client "127.0.0.1", "LIST"
Wed Mar 18 01:36:22 2015 [pid 8195] [masq] FTP response: Client "127.0.0.1", "150 Here comes the directory listing."
Wed Mar 18 01:36:22 2015 [pid 8195] [masq] FTP response: Client "127.0.0.1", "226 Directory send OK."
Wed Mar 18 01:36:35 2015 [pid 8195] [masq] FTP command: Client "127.0.0.1", "PASV"
Wed Mar 18 01:36:35 2015 [pid 8195] [masq] FTP response: Client "127.0.0.1", "227 Entering Passive Mode (52,10,22,18,46,246)."
Wed Mar 18 01:36:47 2015 [pid 8195] [masq] FTP command: Client "127.0.0.1", "QUIT"
Wed Mar 18 01:36:47 2015 [pid 8195] [masq] FTP response: Client "127.0.0.1", "221 Goodbye."
Wed Mar 18 01:58:11 2015 [pid 8257] CONNECT: Client "127.0.0.1"
Wed Mar 18 01:58:11 2015 [pid 8257] FTP response: Client "127.0.0.1", "220 (vsFTPd 3.0.2)"
Wed Mar 18 01:58:13 2015 [pid 8257] FTP command: Client "127.0.0.1", "USER john"
Wed Mar 18 01:58:13 2015 [pid 8257] [john] FTP response: Client "127.0.0.1", "331 Please specify the password."
Wed Mar 18 01:58:15 2015 [pid 8257] [john] FTP command: Client "127.0.0.1", "PASS <password>"
Wed Mar 18 01:58:15 2015 [pid 8256] [john] OK LOGIN: Client "127.0.0.1"
Wed Mar 18 01:58:15 2015 [pid 8258] [john] FTP response: Client "127.0.0.1", "230 Login successful."
Wed Mar 18 01:58:15 2015 [pid 8258] [john] FTP command: Client "127.0.0.1", "SYST"
Wed Mar 18 01:58:15 2015 [pid 8258] [john] FTP response: Client "127.0.0.1", "215 UNIX Type: L8"
Wed Mar 18 01:58:16 2015 [pid 8258] [john] FTP command: Client "127.0.0.1", "PORT 127,0,0,1,183,134"
Wed Mar 18 01:58:16 2015 [pid 8258] [john] FTP response: Client "127.0.0.1", "200 PORT command successful. Consider using PASV."
Wed Mar 18 01:58:16 2015 [pid 8258] [john] FTP command: Client "127.0.0.1", "LIST"
Wed Mar 18 01:58:16 2015 [pid 8258] [john] FTP response: Client "127.0.0.1", "150 Here comes the directory listing."
Wed Mar 18 01:58:16 2015 [pid 8258] [john] FTP response: Client "127.0.0.1", "226 Directory send OK."
Wed Mar 18 01:58:22 2015 [pid 8258] [john] FTP command: Client "127.0.0.1", "QUIT"
Wed Mar 18 01:58:22 2015 [pid 8258] [john] FTP response: Client "127.0.0.1", "221 Goodbye."
Wed Mar 18 02:14:44 2015 [pid 8374] CONNECT: Client "xxx.xxx.2.43"
Wed Mar 18 02:14:44 2015 [pid 8374] FTP response: Client "xxx.xxx.2.43", "220 (vsFTPd 3.0.2)"
Wed Mar 18 02:14:46 2015 [pid 8374] FTP command: Client "xxx.xxx.2.43", "USER john"
Wed Mar 18 02:14:46 2015 [pid 8374] [john] FTP response: Client "xxx.xxx.2.43", "331 Please specify the password."
Wed Mar 18 02:14:49 2015 [pid 8374] [john] FTP command: Client "xxx.xxx.2.43", "PASS <password>"
Wed Mar 18 02:14:49 2015 [pid 8373] [john] OK LOGIN: Client "xxx.xxx.2.43"
Wed Mar 18 02:14:49 2015 [pid 8375] [john] FTP response: Client "xxx.xxx.2.43", "230 Login successful."
Wed Mar 18 02:14:49 2015 [pid 8375] [john] FTP command: Client "xxx.xxx.2.43", "SYST"
Wed Mar 18 02:14:49 2015 [pid 8375] [john] FTP response: Client "xxx.xxx.2.43", "215 UNIX Type: L8"
Wed Mar 18 02:14:52 2015 [pid 8375] [john] FTP command: Client "xxx.xxx.2.43", "PASV"
Wed Mar 18 02:14:52 2015 [pid 8375] [john] FTP response: Client "xxx.xxx.2.43", "227 Entering Passive Mode (52,10,22,18,47,5)."
Wed Mar 18 02:14:52 2015 [pid 8375] [john] FTP command: Client "xxx.xxx.2.43", "LIST"
Wed Mar 18 02:14:52 2015 [pid 8375] [john] FTP response: Client "xxx.xxx.2.43", "150 Here comes the directory listing."
Wed Mar 18 02:14:52 2015 [pid 8375] [john] FTP response: Client "xxx.xxx.2.43", "226 Directory send OK."
Wed Mar 18 02:15:06 2015 [pid 8375] [john] FTP command: Client "xxx.xxx.2.43", "PORT 10,0,0,2,199,11"
Wed Mar 18 02:15:06 2015 [pid 8375] [john] FTP response: Client "xxx.xxx.2.43", "500 Illegal PORT command."
Wed Mar 18 02:15:21 2015 [pid 8375] [john] FTP command: Client "xxx.xxx.2.43", "PORT 10,0,0,2,235,22"
Wed Mar 18 02:15:21 2015 [pid 8375] [john] FTP response: Client "xxx.xxx.2.43", "500 Illegal PORT command."
Wed Mar 18 02:15:24 2015 [pid 8375] [john] FTP command: Client "xxx.xxx.2.43", "PASV"
Wed Mar 18 02:15:24 2015 [pid 8375] [john] FTP response: Client "xxx.xxx.2.43", "227 Entering Passive Mode (52,10,22,18,46,232)."
Wed Mar 18 02:15:24 2015 [pid 8375] [john] FTP command: Client "xxx.xxx.2.43", "LIST"
Wed Mar 18 02:15:24 2015 [pid 8375] [john] FTP response: Client "xxx.xxx.2.43", "150 Here comes the directory listing."
Wed Mar 18 02:15:24 2015 [pid 8375] [john] FTP response: Client "xxx.xxx.2.43", "226 Directory send OK."
Wed Mar 18 02:15:26 2015 [pid 8375] [john] FTP command: Client "xxx.xxx.2.43", "PASV"
Wed Mar 18 02:15:26 2015 [pid 8375] [john] FTP response: Client "xxx.xxx.2.43", "227 Entering Passive Mode (52,10,22,18,46,254)."
Wed Mar 18 02:15:27 2015 [pid 8375] [john] FTP command: Client "xxx.xxx.2.43", "LIST"
Wed Mar 18 02:15:27 2015 [pid 8375] [john] FTP response: Client "xxx.xxx.2.43", "150 Here comes the directory listing."
Wed Mar 18 02:15:27 2015 [pid 8375] [john] FTP response: Client "xxx.xxx.2.43", "226 Directory send OK."
Wed Mar 18 02:15:35 2015 [pid 8375] [john] FTP command: Client "xxx.xxx.2.43", "QUIT"
Wed Mar 18 02:15:35 2015 [pid 8375] [john] FTP response: Client "xxx.xxx.2.43", "221 Goodbye."

Here is the latest log (I altered my external IP however). Interestingly, I could successfully change to passive from my external client, where I couldn't when I tried connecting on the server itself. However, the external client I used was another Ubuntu 14.04 server I have. When I tried to connect externally from one of my windows clients using FileZilla or WinSCP (on FTP mode), I was unable to connect AT ALL anymore (passive or active) and those failed connections don't show up in the logs at all either. The server that I was successfully able to connect with is on the same LAN as the windows client so any network issues should be present with both boxes. I was previously able to connect with my windows client using active connections but for whatever reason it's not working even with that.

Improve this question
4
  • Welcome to Ask Ubuntu! ;-) Could you please give us a bit more information like: what version of Ubuntu you're running? What the output of vsftpd -v is? Could you also add xferlog_enable=YES and post /var/log/vsftpd.log after one successful and one failed attempt? Please edit your question and add this information...
    – Fabby
    Mar 10, 2015 at 23:29
  • Thanks. I've edited my response with the information you requested. I wasn't quite sure what you meant by successful vs failed but yeah...
    – masquarainian
    Mar 12, 2015 at 0:56
  • Successful vs failed is: connect to 127.0.0.1 and xxx.xxx.xxx.xxx ;-) the xferlog_enable=yes should already give you more logging (I cannot see that enabled in your last edit) and log_ftp_protocol=yes should give you even more. Could you update your question with these last settings and update the (existing) log in your question too?
    – Fabby
    Mar 12, 2015 at 10:30
  • Okay, I've edited a decent amount... hope that helps! >_<
    – masquarainian
    Mar 18, 2015 at 2:54

1 Answer 1

Reset to default
3

The new kernel module seccomp is used automatically by vsftpd since version 3.0.0. vsftpd is a bit buggy when using seccomp.

Add this line to the end of /etc/vsftpd.conf

seccomp_sandbox=NO

and restart the Server:

sudo service vsftpd restart

Improve this answer
3
  • If this answer doesn't help, please leave a comment below your question...
    – Fabby
    Mar 18, 2015 at 8:19
  • 2
    I've done this and it works now! Thank you. However, are there any security implications involved in doing this? If so, what are they and how would i patch those up?
    – masquarainian
    Mar 20, 2015 at 19:33
  • If it solves your problem, you may accept it by clicking the check mark below 0 in the left of given answer, there is some compatibility issue with seccomp, not security issue.
    – Faizan Akram Dar
    Mar 21, 2015 at 6:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .