0

I followed a tutorial to install and configure vsftpd service.

Connecting from the local server, but connection is immediately refused from a remote. This is the config file contents:

# /etc/vsftpd.conf
listen=NO
listen_ipv6=YES
anonymous_enable=NO
local_enable=YES
write_enable=YES
local_umask=022
dirmessage_enable=YES
use_localtime=YES
xferlog_enable=YES
ftpd_banner=Welcome to "My Cool" FTP service.
chroot_local_user=YES
userlist_enable=YES
userlist_file=/etc/vsftpd.userlist
userlist_deny=NO
chroot_list_enable=YES
chroot_list_file=/etc/vsftpd.chroot_list
chown_uploads=YES
chown_username=www-data
ftpd_banner=Welcome to mZoo FTP service.
chroot_local_user=YES
userlist_enable=YES
userlist_file=/etc/vsftpd.userlist
userlist_deny=NO
chroot_list_enable=YES
chroot_list_file=/etc/vsftpd.chroot_list
secure_chroot_dir=/var/run/vsftpd/empty
pam_service_name=vsftpd
rsa_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem
rsa_private_key_file=/etc/ssl/private/ssl-cert-snakeoil.key
ssl_enable=NO
user_sub_token=$USER
pasv_min_port=40000
pasv_max_port=50000
force_dot_files=YES

Port 21 seem to be open:

telnet localhost 21
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
220 Welcome to "my cool" FTP service.

I have tried disabling fail2ban as well as uwf neither of which seem to be the cause.

Remote connections are not appearing in /var/log/vsftpd.log, but maybe that only logs transfers and not the actual connection.

Incidentally the uwf status is (but no connection even when inactive):

Status: active

To                         Action      From
--                         ------      ----
OpenSSH                    ALLOW       Anywhere                  
20/tcp                     ALLOW       Anywhere                  
21/tcp                     ALLOW       Anywhere                  
40000:50000/tcp            ALLOW       Anywhere                  
990/tcp                    ALLOW       Anywhere                  
OpenSSH (v6)               ALLOW       Anywhere (v6)             
20/tcp (v6)                ALLOW       Anywhere (v6)             
21/tcp (v6)                ALLOW       Anywhere (v6)             
40000:50000/tcp (v6)       ALLOW       Anywhere (v6)             
990/tcp (v6)               ALLOW       Anywhere (v6) 

Ip Tables output in this gist in case relevant.

  • Is your server owning a public IP, or is it behind NAT? Anyway you should use tools like tcpdump to see if you ever see the incoming connection or if it's refused beyond (thus not even seing it) – A.B Aug 25 '18 at 18:28
  • It's a public IP. Will look into sudo tcpdump. It's output is quite large. – MikeiLL Aug 25 '18 at 18:33
  • use a filter eg, "port 21 or icmp" – A.B Aug 25 '18 at 18:34
  • Running tcpdump port 21, then trying to connect via fetch FTP client gives this output: 18:43:34.117929 IP ubuntu-s-1vcpu-1gb-nyc1-my-cool.ftp > 108-205-63-107.lightspeed.moblal.sbcglobal.net.57026: Flags [R.], seq 0, ack 665173793, win 0, length 0. Does that mean it is reaching the vsftpd server? – MikeiLL Aug 25 '18 at 18:45
  • Yes and the [R.] also means your server refused it. So you'll have to think again why. guess: not listening on the interface, but only on localhost or similar. Check again your configuration. I'm sorry but I won't continue the conversation – A.B Aug 25 '18 at 18:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.