2

OS: CentOS 7 with VSFTPD with firewall turned off for the moment

Client: Filezilla

VSFTPD Configuration Settings:

Used [root@Turbo ~]# vi /etc/vsftpd/vsftpd.conf

anonymous_enable=NO
local_enable=YES
write_enable=YES
local_umask=022
dirmessage_enable=YES
xferlog_enable=YES
connect_from_port_20=YES
xferlog_std_format=YES
ftpd_banner=Welcome to the DataMover FTP service.
chroot_local_user=YES
local_root=/home/ftp-docs
listen=YES
listen_ipv6=NO
pasv_enable=YES
pasv_max_port=65534
pasv_min_port=1024
pasv_address=192.168.20.88
hide_file=NO
pam_service_name=vsftpd
userlist_enable=YES
tcp_wrappers=YES

FileZilla Settings:

Logon Type          Normal
Port                21
Server Type         Default (tried UNIX)
Transfer Mode       Passive (tried Active)
Charset             Auto detect
Encryption          Only use plain FTP (insecure)

I tried all combinations of transfer mode and server type (between UNIX and auto detect) to no avail. I used plain FTP, as I did not add TLS to my CentOS machine. I had that protocol for a while, as I do not have it, I just wasted time negotiating down to plain FTP.

Here is the Filezilla output:

Status: Disconnected from server
Status: Connecting to 192.168.20.88:21...
Status: Connection established, waiting for welcome message...
Status: Connected
Status: Retrieving directory listing...
Status: Directory listing of "/" successful

What is interesting is that I do not see the welcome banner. I half expected to see that, as the Filezilla log says "waiting for welcome message...".

Like the welcome message, the contents of the directory are blank.

The user is fine. I logged in as the user and did a cd ~ and was able to verify that I went to the /home/ftp-docs directory.

The log files show major nothingness.

/var/log/messages:

Dec 11 09:23:35 Turbo systemd: Reloading.
Dec 11 09:23:35 Turbo systemd: [/usr/lib/systemd/system/lvm2-lvmetad.socket:9] Unknown lvalue 'RemoveOnStop' in section 'Socket'
Dec 11 09:23:35 Turbo systemd: [/usr/lib/systemd/system/dm-event.socket:10] Unknown lvalue 'RemoveOnStop' in section 'Socket'
Dec 11 09:23:36 Turbo avahi-daemon[1227]: Invalid response packet from host 192.168.20.74.
Dec 11 09:23:37 Turbo avahi-daemon[1227]: Invalid response packet from host 192.168.20.74.
Dec 11 09:23:37 Turbo avahi-daemon[1227]: Invalid response packet from host 192.168.20.74.
Dec 11 09:23:40 Turbo systemd: Stopping Vsftpd ftp daemon...
Dec 11 09:23:40 Turbo systemd: Stopped Vsftpd ftp daemon.
Dec 11 09:23:45 Turbo systemd: Starting Vsftpd ftp daemon...
Dec 11 09:23:45 Turbo systemd: Started Vsftpd ftp daemon.

With all my testing today, the /var/log/xferlog, shows emptiness.

Tue Dec  8 15:48:35 2015 1 ::ffff:192.168.20.74 0 /CreativeCloudSet-Up.exe b _ i r datamover ftp 0 * i
~

My command line on the server is fine too.

[root@Turbo ~]# systemctl daemon-reload
[root@Turbo ~]# systemctl stop vsftpd
[root@Turbo ~]# systemctl start vsftpd
[root@Turbo ~]# vi /var/log/messages
[root@Turbo ~]# vi /var/log/xferlog 
[root@Turbo ~]#

Just for completeness sake, the contents of the home directory are fine.

[root@Turbo ~]# ls -l /home
total 4
drwxr-xr-x.  3 root ftp-users   35 Dec  9 16:29 ftp-docs
...
[root@Turbo ~]# 
[root@Turbo ~]# cd /home/ftp-docs/
[root@Turbo ftp-docs]# ls -l
total 4
-rwxr--r--. 1 datamover root 13 Dec  8 15:47 smurfit.txt
drwxr--r--. 2 root      root  6 Dec  9 16:29 sub1
[root@Turbo ftp-docs]#

I perused quite a few webpages, which is why I added hide_file and the four passive entries into my vsftpd.conf configuration file. Other people had a problem connecting. That is and was not my problem. I connect fine. I just do not see anything.

Although I have firewall disabled at the moment, here is my iptables setting:

vi /etc/sysconfig/iptables

# FTP
-A INPUT -m state --state NEW -m tcp -p tcp --dport 20 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 21 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 1024:65535 -j ACCEPT

I did read that CentOS 7 uses FirewallD, not iptables, but as you can see:

[root@Turbo ~]# firewall-cmd --get-active-zones
FirewallD is not running
[root@Turbo ~]#

Here are some of the resources that I perused:

Any thoughts on anything that I missed?

Improve this question

1 Answer 1

Reset to default
1

The resolution to this problem was so, so not obvious. When I knew the proper search terms, obvious now, but not for the past couple of days, and understanding things better, the pieces started coming into place. Many posts on "VSFTPD directory content not listed" talked endlessly on passive vs. active, ports, permissions, use of hide_file, local_root, and others.

The real epiphany that I had came, when I asked myself there must be a way to get detailed logging or "vsftpd verbose logging" was my key term. That one thought and its implementation hit the mother load, so to speak. I got to know the existence of SELinux. That partially caused my misery.

This article, Installation and configuration of VSFTPD in CentOS with FTPS support and SELinux, did much to solve my problem.

The instructions created a couple of files, mypol.*, which I deleted. That gave me access to smurfs.txt, but I still had a problem with sub1.

I resolved that issue by noticing (why did it take me so long?) that the owner for sub1 was root, not datamover. When I fixed ownership (okay, permissions), then I had access to that folder as well.

I just tried downloading both files and success.

I still cannot upload to /home/ftp-docs/ and must maintain root as the owner for that folder as well as 755 permissions. Any deviation causes FTP to stop working. I can, however, upload to sub1. So the solution (workaround?) is to simply upload to a sub-folder.

In order to get things to work, I had to do the following at the end, where /mnt/raid1 is the home directory for the FTP client in this particular case. (I used to use /home/ftp-docs/.)

# /sbin/restorecon -v /mnt/raid1
# setsebool -P ftpd_full_access 1

Useful links I used:

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.