Vsftpd 227 entering passive mode как исправить

Poorly secured FTP services can be one of the causes of server attacks.

However, VsFTPd servers come with restricted root privileges, making it one of the safer FTP servers.

Sometimes, the VsFTPd server may not work as we expect and result in “227 Entering Passive Mode ftp: connect: Connection timed out“ error.

It happens mainly due to improper passive port range configuration in the server.

Today, we’ll see how our Support Engineers fixed the error as part of our Server Management Services.

What is VsFTPd?

VsFTPd is a secure, stable, and fast FTP server. Also, VsFTPd becomes the preferred FTP server for many sites that need simultaneous downloads.

In addition, a FTP server is vulnerable to server attacks because of cleartext password authentication. Password sniffing attacks that collect user names and passwords from the network are common in FTP server.

However, the VsFTPd server is more secure and the malicious user finds it more difficult to compromise directly. Because it does not use usernames, passwords. Also, VsFTPd does not run with root privileges. By default, VsFTPd transfers each file in binary mode to improve security.

Moreover, 227 entering passive mode in VsFTPd is a response code given by the server and indicates that the server is ready to connect to the client for establishing a data connection.

How we fixed issues related to 227 entering passive mode in VsFTPd

From our experience in managing servers, we’ve seen that many customers experiencing errors related to VsFTPd.

Let’s see how our Support Engineers fixed these issues.

1. Missing passive port range

Recently, one of the customers reported us with a problem after logging in VsFTPd server, he couldn’t list files using the command “ls” and results in an error like this,

ftp> ls
227 Entering Passive Mode (192,168,122,55,220,105)
ftp: connect: Connection timed out

Then our Support Engineers took the following steps to solve the error.

1. Firstly, we checked /var/log/vsftpd.log file to identify the cause of this error.

2. We found that the error is due to the improper passive port range configuration in /etc/vsftpd.conf file.

3. Therefore, we opened the port range 64000-64321 in /etc/vsftpd.conf file.

pasv_min_port=64000
pasv_max_port=64321

4. At last, we restarted the service VsFTPd.

service vsftpd restart

That’s solved the error. Now the directory listing is done by “ls” command.

2. Firewall blocks IP

Similarly, another customer had a directory listing issue with VsFTPd server. After executing the command “ls”, he was getting an error like 227 Entering Passive Mode ftp: connect: Connection timed out.

1. Firstly, our Support Engineers analyzed /var/log/vsftpd.log file to identify the cause of this error. We found an entry corresponding to the IP firewall blocks the request.

2. After that, we checked the  “ip_conntrack_ftp” module is enabled or not. The module was not activated in the firewall configuration file.

3. So, we enabled the “ip_conntrack_ftp” module in the FTP server’s iptables configuration.

For firewall like Iptables,

3.1. To add “ip_conntrack_ftp” module, open /etc/sysconfig/iptables-config file add the following code as shown below.

# stored in /etc/modprobe.conf.
IPTABLES_MODULES=”ip_conntrack_ftp”

4. In addition, we make sure that the passive port range has enabled in the VsFTPd configuration file.

5. Now, we restarted the iptables and VsFTPd services.

That fixed the error and the user could list the directory without any error.

[Getting 227 entering passive mode VsFTPd connect connection timed out error? We’ll fix it for you.]

Conclusion

In short, 227 entering passive mode in VsFTPd is a response given by the server. It indicates that the server is ready to connect to the client for establishing a data connection. Today, we saw how our Support Engineers fixed the error related to 227 entering passive mode in VsFTPd.

var google_conversion_label = “owonCMyG5nEQ0aD71QM”;

As said in the title, I don’t manage to connect my Windows 10 host to my FTP server on the VirtualBox guest side (Ubuntu 18.04).
On the guest side, the vsftpd server works fine, I can connect without any problem.

So I tried to forward the associated port to the host (NAT) and tried to connect to the server via FileZilla. It does login, but always fails to retrieve directory listing. I tried deactivating the firewalls, giving all the access permissions to the folder but it doesn’t change anything.

I read that it could be a problem of passive mode there:
Problems with FTP file access to VirtualBox guest running Windows 2008 Server R2 x64

So I added the following lines to my vsftpd.conf:

pasv_enable=YES
pasv_min_port=8020
pasv_max_port=8020
port_enable=YES
pasv_address=127.0.0.1

I forwarded the port 8020 but I now get the following error on FileZilla:

The data connection could not be established: WSAEADDRNOTAVAIL – Cannot assign requested address

Full FileZilla response:

Status: Connecting to 127.0.0.1:2100...
Status: Connection established, waiting for welcome message...
Status: Server does not support non-ASCII characters.
Status: Logged in
Status: Retrieving directory listing...
Command:    PWD
Response:   257 "/home/cakephp" is the current directory
Command:    TYPE I
Response:   200 Switching to Binary mode.
Command:    PASV
Response:   227 Entering Passive Mode (0,0,0,0,31,84).
Command:    LIST
Error:  The data connection could not be established:
WSAEADDRNOTAVAIL - Cannot assign requested address
Error:  Connection timed out after 20 seconds of inactivity
Error:  Failed to retrieve directory listing
Status: Disconnected from server

I’m a bit lost with this, does anybody have a suggestion?
Thanks in advance

---

EDIT1:
Without any kind of hope, I also tried to access from the Windows Command Prompt. It does connect but when I ls the current folder I get the following error:

500 illegal PORT command.
425 use PORT or PASV first.

But I guess that this is because ftp.exe doesn’t support passive mode.

Just in case it can help, you can find here my whole current vsftpd config file.
Also, I can seamlessly access to the guest SSH server from the host with Putty.

EDIT2:
I set listen_ipv6 to YES, changed pasv_max_port to 8030 to increase the number of passive ports and forwarded them. I get the following logs from FileZilla:

Status:  Connecting to 127.0.0.1:2100...
Status: Connection established, waiting for welcome message...
Status: Server does not support non-ASCII characters.
Status: Logged in
Status: Retrieving directory listing...
Command:    PWD
Response:   257 "/home/cakephp" is the current directory
Command:    TYPE I
Response:   200 Switching to Binary mode.
Command:    PASV
Response:   227 Entering Passive Mode (0,0,0,0,31,90).
Command:    LIST
Error:  The data connection could not be established: WSAEADDRNOTAVAIL - Cannot assign requested address
Error:  Connection timed out after 20 seconds of inactivity
Error:  Failed to retrieve directory listing

by Jilu Joseph | May 3, 2019

Poorly secured FTP services can be one of the causes of server attacks.

However, VsFTPd servers come with restricted root privileges, making it one of the safer FTP servers.

Sometimes, the VsFTPd server may not work as we expect and result in “227 Entering Passive Mode ftp: connect: Connection timed out“ error.

It happens mainly due to improper passive port range configuration in the server.

Today, we’ll see how our Support Engineers fixed the error as part of our Server Management Services.

What is VsFTPd?

VsFTPd is a secure, stable, and fast FTP server. Also, VsFTPd becomes the preferred FTP server for many sites that need simultaneous downloads.

In addition, a FTP server is vulnerable to server attacks because of cleartext password authentication. Password sniffing attacks that collect user names and passwords from the network are common in FTP server.

However, the VsFTPd server is more secure and the malicious user finds it more difficult to compromise directly. Because it does not use usernames, passwords. Also, VsFTPd does not run with root privileges. By default, VsFTPd transfers each file in binary mode to improve security.

Moreover, 227 entering passive mode in VsFTPd is a response code given by the server and indicates that the server is ready to connect to the client for establishing a data connection.

From our experience in managing servers, we’ve seen that many customers experiencing errors related to VsFTPd.

Let’s see how our Support Engineers fixed these issues.

1. Missing passive port range

Recently, one of the customers reported us with a problem after logging in VsFTPd server, he couldn’t list files using the command “ls” and results in an error like this,

Then our Support Engineers took the following steps to solve the error.

1. Firstly, we checked /var/log/vsftpd.log file to identify the cause of this error.

2. We found that the error is due to the improper passive port range configuration in /etc/vsftpd.conf file.

3. Therefore, we opened the port range 64000-64321 in /etc/vsftpd.conf file.

4. At last, we restarted the service VsFTPd.

That’s solved the error. Now the directory listing is done by “ls” command.

2. Firewall blocks IP

Similarly, another customer had a directory listing issue with VsFTPd server. After executing the command “ls”, he was getting an error like 227 Entering Passive Mode ftp: connect: Connection timed out.

1. Firstly, our Support Engineers analyzed /var/log/vsftpd.log file to identify the cause of this error. We found an entry corresponding to the IP firewall blocks the request.

2. After that, we checked the “ip_conntrack_ftp” module is enabled or not. The module was not activated in the firewall configuration file.

3. So, we enabled the “ip_conntrack_ftp” module in the FTP server’s iptables configuration.

For firewall like Iptables,

3.1. To add “ip_conntrack_ftp” module, open /etc/sysconfig/iptables-config file add the following code as shown below.

4. In addition, we make sure that the passive port range has enabled in the VsFTPd configuration file.

5. Now, we restarted the iptables and VsFTPd services.

That fixed the error and the user could list the directory without any error.

[Getting 227 entering passive mode VsFTPd connect connection timed out error? We’ll fix it for you.]

Conclusion

In short, 227 entering passive mode in VsFTPd is a response given by the server. It indicates that the server is ready to connect to the client for establishing a data connection. Today, we saw how our Support Engineers fixed the error related to 227 entering passive mode in VsFTPd.

PREVENT YOUR SERVER FROM CRASHING!

Never again lose customers to poor server speed! Let us help you.

Our server experts will monitor & maintain your server 24/7 so that it remains lightning fast and secure.

Источник

227 entering passive mode ftp connect connection timed out – How we nailed it

by Jilu Joseph | Apr 30, 2019

The File Transfer Protocol is a network protocol providing functionality for file access, file transfer, and file management.

In addition, FTP operates in either active or a passive mode.

Due to the wrong passive port range configuration settings on the server side, the customer may cause an error like,

«227 Entering Passive Mode (192,168,1,2,118,151).
ftp: connect: Connection timed out»

Today, we’ll see the reason for this error and how it is fixed by our Support Engineers as part of our Server Management Services.

Active and Passive modes?

In passive mode, the server decides which server-side port the client should connect to. Then the client starts the connection to the specified port.

On the other hand, in active mode, the client specifies which client-side port the data channel has opened and the server starts the connection.

Moreover, one of the main reason to occur this “227 entering passive mode FTP connect connection timed out” error is the improper configuration settings of the passive port range.

How we fixed 227 entering passive mode FTP connect connection timed out error

The error is caused due to the misconfiguration of the passive port range on the FTP server and in the firewall settings.

Therefore, our Support Engineers correct the settings in both FTP server and in the firewall.

Set passive port range in FTP server

CPanel offers a choice of two FTP servers. PureFTP and ProFTP. PureFTPd is very much secure.

Here, our Support Engineers took the following steps to add passive range port on Pureftp servers.

In Pureftpd,

To solve the error, the passive Port range should be added to the Pureftp configuration file.

1. We open Pureftp configuration file /etc/pure-ftpd.conf.

2. Then, we add the following line.

3. At last, we restart the Pureftp service.

In ProFTP,

In ProFTP, we add the passive port range in /etc/proftpd.conf.

1. We open /etc/proftpd.conf and add this line.

2. In the end, we restart the service.

Add passive port range in firewall settings

Most servers have a firewall to avoid security problems. Therefore, the passive port range should be open in the firewall configuration too.

Even if the FTP server allows passive ports, the firewall can block the connection between FTP client and server when the passive port range is not open. It results in 227 entering passive mode ftp connect connection timed out error.

Our Support Engineers use the following steps to add the passive port range to the firewall configuration file.

For firewall like Iptables,

1. Firstly, we open /etc/sysconfig/iptables file.

2. Then, we add the entry like,

3. At last, we restart iptables

For firewall like CSF,

1. We open /etc/csf/csf.conf file.

2. Then, find the line with TCP_IN ,TCP_OUT and then added the port range.

3. Finally, restart the CSF service.

[Getting 227 entering passive mode ftp connect connection timed out error? We’ll fix it for you.]

Conclusion

In short, the improper configuration of the passive port range in the FTP server and in the firewall configuration file are the main reasons for “227 entering passive mode ftp connect connection timed out” error. Today, we saw how our Support Engineers fixed this error.

PREVENT YOUR SERVER FROM CRASHING!

Never again lose customers to poor server speed! Let us help you.

Our server experts will monitor & maintain your server 24/7 so that it remains lightning fast and secure.

Источник

227 entering passive mode ftp error

Вопрос

Hi , here we’ve TMG 2010. My Users want to Access the FTP Sites using with Browsers & FTP 3rd party application. Easily I provided the 3rd Party Application solution. But behind the TMG 2010 , that particular FTP Clients doesn’t connect. but when i use any internet connection without TMG 2010 , easily then can use it . below I’m mentioned the Error as well.

227 Entering Passive Mode

when i tryit with ftp.exe , it comes a error that 500 Invalid PORT Command

But as normal , I created the Firewall Rule Policy & configure the FTP Access Filtering as well. please find the below details.

I uploaded it as a One Image .

is there any solution for this ?

Ответы

What kind of (TMG-) clients are you using? Secure NAT, Firewall Client or Web proxy?

Is this behavior consistent for all FTP sites or just some?

Do you have the TMG Best Practices installed? If not, please do install it. Go to http://isabpa.com (link to MS download), download and install it on the TMG. With the BPA comes a little handy tool called TMG Data Packager. Launch that and:

1. Select to collect data using repro scenario

2. Select Basic Repro and Configuration (yes it is the right one), then click next and then Start Data Collection. The TDP will start and then pause and wait for the actual test.

3. Prepare the client but do not start to reproduce the problem (e.g. launch FTP app but don’t hit enter)

4. On TMG in the TDP, press spacebar to start the live capture and immediately go to the client and reproduce the problem

5. On TMG in the TDP, press spacebar to stop the capture.

7. Expand the tmgpackage.cab on the desktop to somewhere good.

With the use fo the client IP address and the destination find the connection in both Network Monitor traces (one for the external and one for the internal interface of TMG) and in the logfiles. Depending on the type of client it may be in either the FWC or Web log.

Let me know if you need help interpreting the data.

Источник

227 entering passive mode ftp error

This forum is closed. Thank you for your contributions.

Answered by:

Question

Hi , here we’ve TMG 2010. My Users want to Access the FTP Sites using with Browsers & FTP 3rd party application. Easily I provided the 3rd Party Application solution. But behind the TMG 2010 , that particular FTP Clients doesn’t connect. but when i use any internet connection without TMG 2010 , easily then can use it . below I’m mentioned the Error as well.

227 Entering Passive Mode

when i tryit with ftp.exe , it comes a error that 500 Invalid PORT Command

But as normal , I created the Firewall Rule Policy & configure the FTP Access Filtering as well. please find the below details.

I uploaded it as a One Image .

is there any solution for this ?

Answers

What kind of (TMG-) clients are you using? Secure NAT, Firewall Client or Web proxy?

Is this behavior consistent for all FTP sites or just some?

Do you have the TMG Best Practices installed? If not, please do install it. Go to http://isabpa.com (link to MS download), download and install it on the TMG. With the BPA comes a little handy tool called TMG Data Packager. Launch that and:

1. Select to collect data using repro scenario

2. Select Basic Repro and Configuration (yes it is the right one), then click next and then Start Data Collection. The TDP will start and then pause and wait for the actual test.

3. Prepare the client but do not start to reproduce the problem (e.g. launch FTP app but don’t hit enter)

4. On TMG in the TDP, press spacebar to start the live capture and immediately go to the client and reproduce the problem

5. On TMG in the TDP, press spacebar to stop the capture.

7. Expand the tmgpackage.cab on the desktop to somewhere good.

With the use fo the client IP address and the destination find the connection in both Network Monitor traces (one for the external and one for the internal interface of TMG) and in the logfiles. Depending on the type of client it may be in either the FWC or Web log.

Let me know if you need help interpreting the data.

Источник

227 entering passive mode ftp error

This forum is closed. Thank you for your contributions.

Answered by:

Question

Hi , here we’ve TMG 2010. My Users want to Access the FTP Sites using with Browsers & FTP 3rd party application. Easily I provided the 3rd Party Application solution. But behind the TMG 2010 , that particular FTP Clients doesn’t connect. but when i use any internet connection without TMG 2010 , easily then can use it . below I’m mentioned the Error as well.

227 Entering Passive Mode

when i tryit with ftp.exe , it comes a error that 500 Invalid PORT Command

But as normal , I created the Firewall Rule Policy & configure the FTP Access Filtering as well. please find the below details.

I uploaded it as a One Image .

is there any solution for this ?

Answers

What kind of (TMG-) clients are you using? Secure NAT, Firewall Client or Web proxy?

Is this behavior consistent for all FTP sites or just some?

Do you have the TMG Best Practices installed? If not, please do install it. Go to http://isabpa.com (link to MS download), download and install it on the TMG. With the BPA comes a little handy tool called TMG Data Packager. Launch that and:

1. Select to collect data using repro scenario

2. Select Basic Repro and Configuration (yes it is the right one), then click next and then Start Data Collection. The TDP will start and then pause and wait for the actual test.

3. Prepare the client but do not start to reproduce the problem (e.g. launch FTP app but don’t hit enter)

4. On TMG in the TDP, press spacebar to start the live capture and immediately go to the client and reproduce the problem

5. On TMG in the TDP, press spacebar to stop the capture.

7. Expand the tmgpackage.cab on the desktop to somewhere good.

With the use fo the client IP address and the destination find the connection in both Network Monitor traces (one for the external and one for the internal interface of TMG) and in the logfiles. Depending on the type of client it may be in either the FWC or Web log.

Let me know if you need help interpreting the data.

Источник

Reprint: About FTP active mode (active mode) and passive mode (passive mode) works:

Active mode (the server knocks on the client and then the client opens the door) FTP:
When a connection is established between the client and the server, the client is on a port larger than 1024 and the server is on the 20 port.
The client’s port is greater than 1024, and the server’s port is the 21 port to receive the request, but the 20 port to the client response.
allows the FTP client to connect to port 21 of the server from a port larger than 1024.
Allows the FTP server to respond from port 21 to a network connection greater than 1024 in the FTP client.
Allows the FTP server to actively connect to ports larger than 1024 of the FTP client from port 20.
Allows the FTP client to respond to a 20-port network connection from the FTP server from a port larger than 1024.
command connection: client >1024 port -> server 21 port
Data Connection: Client > 1024 Port

Passive mode (the client knocks on the server and then the server opens) FTP:
The connection between the client and the server is on a port larger than 1024.
The client’s port is greater than 1024, and the server’s port is the 21-port receiving request, but the greater than 1024 port to the client.
allows the FTP client to connect to port 21 of the server from a port larger than 1024.
Allows the FTP server to respond from port 21 to a network connection greater than 1024 in the FTP client.
allows FTP clients to connect to FTP servers larger than 1024 ports from ports larger than 1024.
Allows the FTP server to respond to network connections from FTP clients larger than 1024 ports from ports larger than 1024.
command connection: client >1024 port -> server 21 port
Data Connection: Client > 1024 Port -> Server > 1024 Port

Problem: No error is reported on the Linux server, there is an error in access under win10:

Solution: Set IE browser >> Internet Options >> Advanced >> Remove the “Use passive FTP (compatible for firewall and DSL modem)” option >> OK

It looks like a bug in vsftpd to me.

From the code, it looks like, vsftpd always sends the 0,0,0,0, if the public pasv_address is set, and the server has a (local) IPv6 address.

To fix this, make sure the server does not listen on IPv6 address (what is the default behavior, which you are overriding by setting listen_ipv6=YES):

listen_ipv6=NO
listen=YES

The only other solution is removing the private IPv6 address, if it is possible in EC2.

Or use another FTP server, e.g. ProFTPD.

---

To prove that this is indeed a bug:

handle_pasv in postlogin.c:

int is_ipv6 = vsf_sysutil_sockaddr_is_ipv6(p_sess->p_local_addr);

...

if (tunable_pasv_address != 0)
{
  vsf_sysutil_sockaddr_alloc_ipv4(&s_p_sockaddr);
  /* Report passive address as specified in configuration */
  if (vsf_sysutil_inet_aton(tunable_pasv_address, s_p_sockaddr) == 0)
  {
    die("invalid pasv_address");
  }
}
else
{
  vsf_sysutil_sockaddr_clone(&s_p_sockaddr, p_sess->p_local_addr);
}
str_alloc_text(&s_pasv_res_str, "Entering Passive Mode (");
if (!is_ipv6)
{
  str_append_text(&s_pasv_res_str, vsf_sysutil_inet_ntop(s_p_sockaddr));
}
else
{
  const void* p_v4addr = vsf_sysutil_sockaddr_ipv6_v4(s_p_sockaddr);
  if (p_v4addr)
  {
    str_append_text(&s_pasv_res_str, vsf_sysutil_inet_ntoa(p_v4addr));
  }
  else
  {
    str_append_text(&s_pasv_res_str, "0,0,0,0");
  }
}

where the vsf_sysutil_sockaddr_ipv6_v4 returns 0, if the s_p_sockaddr is not IPv6 (what it never is, when the pasv_address is set).

sysutil.c:

const void*
vsf_sysutil_sockaddr_ipv6_v4(const struct vsf_sysutil_sockaddr* p_addr)
{
  static unsigned char pattern[12] =
      { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0xFF, 0xFF };
  const unsigned char* p_addr_start;
  if (p_addr->u.u_sockaddr.sa_family != AF_INET6)
  {
    return 0;
  }
  if (vsf_sysutil_memcmp(pattern, &p_addr->u.u_sockaddr_in6.sin6_addr, 12))
  {
    return 0;
  }
  p_addr_start = (const unsigned char*)&p_addr->u.u_sockaddr_in6.sin6_addr;
  return &p_addr_start[12];
}

Imho, the code is wrong. It works (and makes sense), when the IP address is “autodetected” from p_sess->p_local_addr, but fails, when the pasv_address address is used.

Consider reporting this to the author of vsftpd.