1

I have a centos 6.5 installed on Virtual Box. I'm trying to configure a basic ftp server. Below are details of it.

  1. Installed vsftpd from DVD/Yum: Status -> Successful

  2. Disabled firewall for test purposes,

    chkconfig iptables off : successful
    
    service iptables stop : successful
    
  3. Also set selinux in disabled mode: successful

  4. Added a rule in VirtualBox for port forwarding over NAT:

    Rule Protocol Host Port Guest Port
    Ftp  tcp.     2121.     21
    

Now when I try to connect with local user or anonymous, it gives a number of errors, every time a different error.

I'm also adding log messages shown by Filezila on my Host machine.

-> LocalUserLogFromClient

Status: Disconnected from server
Status: Resolving address of localhost
Status: Connecting to [::1]:2121...
Status: Connection attempt failed with "ECONNREFUSED - Connection refused by
server", trying next address.
Status: Connecting to 127.0.0.1:2121...
Status: Connection established, waiting for welcome message...
Response:   220 Welcome to C6G FTP service.
Command:    AUTH TLS
Response:   530 Please login with USER and PASS.
Command:    AUTH SSL
Response:   530 Please login with USER and PASS.
Status: Insecure server, it does not support FTP over TLS.
Command:    USER FUser1
Response:   331 Please specify the password.
Command:    PASS *****
Error:  Connection timed out after 20 seconds of inactivity
Error:  Could not connect to server

-> AnonymousUserLog

Status: Resolving address of localhost
Status: Connecting to [::1]:2121...
Status: Connection attempt failed with "ECONNREFUSED - Connection refused by
server", trying next address.
Status: Connecting to 127.0.0.1:2121...
Status: Connection established, waiting for welcome message...
Status: Insecure server, it does not support FTP over TLS.
Status: Connected
Status: Retrieving directory listing...
Command:    PWD
Response:   257 "/"
Command:    TYPE I
Response:   200 Switching to Binary mode.
Command:    PASV
Response:   227 Entering Passive Mode (10,0,2,15,88,204).
Command:    LIST
Error:  The data connection could not be established: 10065
Error:  Connection timed out after 20 seconds of inactivity
Error:  Failed to retrieve directory listing
  • 4
    (a) Is your client using passive mode?; (b) Does the NAT have a protocol helper for FTP? It needs one, or FTP won't work (FTP is hard to NAT); and (c) Let's have a few of those errors. A protocol log would be great. – derobert Sep 15 '15 at 21:12
  • @derobert hi there, thanks for your kind reply. Yes it does say something about passive mode in connection messages. I tried using filezila & fireftp extension of Firefox browser too. I'll update the errors next morning, as I'm using my cell phone right now, hope you don't mind waiting. – Sollosa Sep 15 '15 at 21:17
  • @derobert what is a protocol helper? Does VirtualBox need it too? If yes how is it configured? – Sollosa Sep 15 '15 at 21:32
  • 1
    @Sollosa a protocol helper "listens in" on the connection, and rewrites embedded IP addresses, opens related ports, etc. No idea how to set one up in VirtualBox. With Linux NAT, you'd load the ftp connection tracking module. – derobert Sep 15 '15 at 21:45
  • 1
    @Sollosa we'll need logs from that one to troubleshoot. Unfortunately FTP is a annoyingly complicated protocol w/r/t NAT. – derobert Sep 15 '15 at 21:58
2

Your logs show two different problems:

  1. For the non-anonymous user, the login timed out. After 20s of waiting for the login to complete, your FTP client gave up. This probably means your authentication configuration (on the server) is not working—especially if you tried to set up virtual users, etc. Other than that, the server might be taking a long time to write to a log, or maybe perform a DNS resolution.

  2. Your anonymous user log is probably having a NAT issue. 227 Entering Passive Mode (10,0,2,15,88,204). means that the client needs to make a connection to 10.0.2.15:22732/tcp, and its reporting it timed out. That's an odd address to have to connect to, since the FTP connection itself is to localhost.

(BTW: the last two numbers are two bytes of the port number, in network byte order. So 88×256 + 204 = 22732.)

1

An FTP server behind a port forwarder can’t serve in the passive mode unless the software used has a special design to pass FTP data connections through. Cases are:

  • The NAT software able to sniff for 227 Entering Passive Mode in FTP control connection, to do port forwarding accordingly and some mangling of FTP control data.
  • The FTP server sending passive mode with visible (NAT) IP address and the NAT forwarding given range of ports.
    Thanks to @derobert for pointing out a flaw in my original reasoning.

Linux kernel NAT is supplied with an (optional) FTP support. But if Linux is the guest, then its NAT has nothing to with the problem. The host system’s NAT must do NAT for the guest, indeed. Has the Windows’ NAT software in question such capability? Dunno, and it’s not a Linux question anyway. Recommended solution: replace NAT with bridging for the virtual machine.

  • 1
    It doesn't have to be done in the NAT. You can often configure the server to send passive mode with its public, routable IP address and a given range of ports, then you just need to make sure those ports are forwarded through the NAT. I'd say this is often the preferred config, as it greatly reduces resource requirements and attack surface on the NAT box (often the firewall). Does make a more complicated setup, though, so depends on the size of the setup, and how many connections you expect. – derobert Sep 16 '15 at 21:06
  • @Incnis Mrsi I've tried Bridged network too, I can ping & access centos machines via ssh. FTP works fine on the console of the machine, but if I access it from host machine with its IP, it says failed to load directory listings. – Sollosa Sep 19 '15 at 7:14
  • @Sollosa: Ask a follow-up question. Solution for your original problem is achieved, isn’t it? – Incnis Mrsi Sep 19 '15 at 9:24
  • @IncnisMrsi well yes question answered but issue still unresolved. – Sollosa Sep 19 '15 at 15:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.