0

My ftp user face error like this:

FTP 127 Response: 500 I won't open a connection to xxx.xxx.xxx.xxx (only to yyy.yyy.yyy.yyy)

This is the response of my server which captured by Wireshark in a windows ftp client.

I enabled the VerboseLog in /etc/pure-ftpd.conf and there is line which says:

#If you want to log all client commands, set this to "yes".
#This directive can be specified twice to also log server responses. 
#VerboseLog yes

So I edited my config file and brought the VerboseLog yes twice to log server response something like this:

# If you want to log all client commands, set this to "yes".
# This directive can be specified twice to also log server responses.

VerboseLog yes

VerboseLog yes

However still I cannot find logs in /var/log/message for this error anywhere. Can somebody say what is wrong? P.S.: I want to have logs since I want to monitor the status of server and check if problem still arise or not. I'm not looking for capturing or snooping the interfaces as a temporary solution/workaround.

Here is my /etc/pure-ftpd.conf:

############################################################
#                                                          #
#             Configuration file for pure-ftpd             #
#                                                          #
############################################################

# If you want to run Pure-FTPd with this configuration
# instead of command-line options, please run the
# following command :
#
# /usr/sbin/pure-ftpd /etc/etc/pure-ftpd.conf
#
# Online documentation:
# https://www.pureftpd.org/project/pure-ftpd/doc


# Restrict users to their home directory

ChrootEveryone yes



# If the previous option is set to "no", members of the following group
# won't be restricted. Others will be. If you don't want chroot()ing anyone,
# just comment out ChrootEveryone and TrustedGID.

# TrustedGID                   100



# Turn on compatibility hacks for broken clients

BrokenClientsCompatibility no



# Maximum number of simultaneous users

MaxClientsNumber 250



# Run as a background process

Daemonize No



# Maximum number of simultaneous clients with the same IP address

MaxClientsPerIP 20



# If you want to log all client commands, set this to "yes".
# This directive can be specified twice to also log server responses.

VerboseLog yes

VerboseLog yes



# List dot-files even when the client doesn't send "-a".

DisplayDotFiles yes



# Disallow authenticated users - Act only as a public FTP server.

AnonymousOnly no



# Disallow anonymous connections. Only accept authenticated users.

NoAnonymous yes



# Syslog facility (auth, authpriv, daemon, ftp, security, user, local*)
# The default facility is "ftp". "none" disables logging.

SyslogFacility ftp,auth,authpriv,daemon,security,user



# Display fortune cookies

# FortunesFile                 /usr/share/fortune/zippy



# Don't resolve host names in log files. Recommended unless you trust
# reverse host names, and don't care about DNS resolution being possibly slow.

DontResolve yes



# Maximum idle time in minutes (default = 15 minutes)

MaxIdleTime 15



# LDAP configuration file (see README.LDAP)

# LDAPConfigFile               /etc/pureftpd-ldap.conf



# MySQL configuration file (see README.MySQL)

# MySQLConfigFile              /etc/pureftpd-mysql.conf


# PostgreSQL configuration file (see README.PGSQL)

# PGSQLConfigFile              /etc/pureftpd-pgsql.conf


# PureDB user database (see README.Virtual-Users)

# PureDB                       /etc/pureftpd.pdb


# Path to pure-authd socket (see README.Authentication-Modules)

ExtAuth /var/run/ftpd.sock



# If you want to enable PAM authentication, uncomment the following line

# PAMAuthentication            yes



# If you want simple Unix (/etc/passwd) authentication, uncomment this

# UnixAuthentication           yes



# Please note that LDAPConfigFile, MySQLConfigFile, PAMAuthentication and
# UnixAuthentication can be used specified once, but can be combined
# together. For instance, if you use MySQLConfigFile, then UnixAuthentication,
# the SQL server will be used first. If the SQL authentication fails because the
# user wasn't found, a new attempt will be done using system authentication.
# If the SQL authentication fails because the password didn't match, the
# authentication chain stops here. Authentication methods are chained in
# the order they are given.



# 'ls' recursion limits. The first argument is the maximum number of
# files to be displayed. The second one is the max subdirectories depth.

LimitRecursion 10000 8



# Are anonymous users allowed to create new directories?

AnonymousCanCreateDirs no



# If the system load is greater than the given value, anonymous users
# aren't allowed to download.

MaxLoad 4



# Port range for passive connections - keep it as broad as possible.

PassivePortRange 49152 65534



# Force an IP address in PASV/EPSV/SPSV replies. - for NAT.
# Symbolic host names are also accepted for gateways with dynamic IP
# addresses.

# ForcePassiveIP 5.9.161.221




# Upload/download ratio for anonymous users.

# AnonymousRatio               1 10



# Upload/download ratio for all users.
# This directive supersedes the previous one.

# UserRatio                    1 10



# Disallow downloads of files owned by the "ftp" system user;
# files that were uploaded but not validated by a local admin.

AntiWarez yes



# IP address/port to listen to (default=all IP addresses, port 21).

Bind 21



# Maximum bandwidth for anonymous users in KB/s

# AnonymousBandwidth           8



# Maximum bandwidth for *all* users (including anonymous) in KB/s
# Use AnonymousBandwidth *or* UserBandwidth, not both.

# UserBandwidth                8



# File creation mask. <umask for files>:<umask for dirs> .
# 177:077 if you feel paranoid.

Umask 133:022



# Minimum UID for an authenticated user to log in.
# For example, a value of 100 prevents all users whose user id is below
# 100 from logging in. If you want "root" to be able to log in, use 0.

MinUID 100



# Allow FXP transfers for authenticated users.

AllowUserFXP no



# Allow anonymous FXP for anonymous and non-anonymous users.

AllowAnonymousFXP no



# Users can't delete/write files starting with a dot ('.')
# even if they own them. But if TrustedGID is enabled, that group
# will exceptionally have access to dot-files.

ProhibitDotFilesWrite no



# Prohibit *reading* of files starting with a dot (.history, .ssh...)

ProhibitDotFilesRead no



# Don't overwrite files. When a file whose name already exist is uploaded,
# it gets automatically renamed to file.1, file.2, file.3, ...

AutoRename no



# Prevent anonymous users from uploading new files (no = upload is allowed)

AnonymousCantUpload yes



# Only connections to this specific IP address are allowed to be
# non-anonymous. You can use this directive to open several public IPs for
# anonymous FTP, and keep a private firewalled IP for remote administration.
# You can also only allow a non-routable local IP (such as 10.x.x.x) for
# authenticated users, and run a public anon-only FTP server on another IP.

# TrustedIP                    10.1.1.1



# To add the PID to log entries, uncomment the following line.

# LogPID                       yes



# Create an additional log file with transfers logged in a Apache-like format :
# fw.c9x.org - jedi [13/Apr/2017:19:36:39] "GET /ftp/linux.tar.bz2" 200 21809338
# This log file can then be processed by common HTTP traffic analyzers.

AltLog xferlog:/etc/apache2/logs/domlogs/ftpxferlog



# Create an additional log file with transfers logged in a format optimized
# for statistic reports.

AltLog                       stats:/var/log/pureftpd.log



# Create an additional log file with transfers logged in the standard W3C
# format (compatible with many HTTP log analyzers)

# AltLog                       w3c:/var/log/pureftpd.log



# Disallow the CHMOD command. Users cannot change perms of their own files.

# NoChmod                      yes



# Allow users to resume/upload files, but *NOT* to delete them.

# KeepAllFiles                 yes



# Automatically create home directories if they are missing

# CreateHomeDir                yes



# Enable virtual quotas. The first value is the max number of files.
# The second value is the maximum size, in megabytes.
# So 1000:10 limits every user to 1000 files and 10 MB.

# Quota                        1000:10



# If your pure-ftpd has been compiled with standalone support, you can change
# the location of the pid file. The default is /var/run/pure-ftpd.pid

# PIDFile                      /var/run/pure-ftpd.pid



# If your pure-ftpd has been compiled with pure-uploadscript support,
# this will make pure-ftpd write info about new uploads to
# /var/run/pure-ftpd.upload.pipe so pure-uploadscript can read it and
# spawn a script to handle the upload.
# Don't enable this option if you don't actually use pure-uploadscript.

# CallUploadScript             yes



# This option is useful on servers where anonymous upload is
# allowed. When the partition is more that percententage full,
# new uploads are disallowed.

MaxDiskUsage 99



# Set to 'yes' to prevent users from renaming files.

# NoRename                     yes



# Be 'customer proof': forbids common customer mistakes such as
# 'chmod 0 public_html', that are valid, but can cause customers to
# unintentionally shoot themselves in the foot.

CustomerProof yes



# Per-user concurrency limits. Will only work if the FTP server has
# been compiled with --with-peruserlimits.
# Format is: <max sessions per user>:<max anonymous sessions>
# For example, 3:20 means that an authenticated user can have up to 3 active
# sessions, and that up to 20 anonymous sessions are allowed.

# PerUserLimits                3:20



# When a file is uploaded and there was already a previous version of the file
# with the same name, the old file will neither get removed nor truncated.
# The file will be stored under a temporary name and once the upload is
# complete, it will be atomically renamed. For example, when a large PHP
# script is being uploaded, the web server will keep serving the old version and
# later switch to the new one as soon as the full file will have been
# transferred. This option is incompatible with virtual quotas.

# NoTruncate                   yes



# This option accepts three values:
# 0: disable SSL/TLS encryption layer (default).
# 1: accept both cleartext and encrypted sessions.
# 2: refuse connections that don't use the TLS security mechanism,
#    including anonymous sessions.
# Do _not_ uncomment this blindly. Double check that:
# 1) The server has been compiled with TLS support (--with-tls),
# 2) A valid certificate is in place,
# 3) Only compatible clients will log in.

TLS 1


# Cipher suite for TLS sessions.
# The default suite is secure and setting this property is usually
# only required to *lower* the security to cope with legacy clients.
# Prefix with -C: in order to require valid client certificates.
# If -C: is used, make sure that clients' public keys are present on
# the server.

TLSCipherSuite HIGH



# Certificate file, for TLS

# CertFile                     /etc/ssl/private/pure-ftpd.pem



# Listen only to IPv4 addresses in standalone mode (ie. disable IPv6)
# By default, both IPv4 and IPv6 are enabled.

# IPV4Only                     yes



# Listen only to IPv6 addresses in standalone mode (i.e. disable IPv4)
# By default, both IPv4 and IPv6 are enabled.

# IPV6Only                     yes



# UTF-8 support for file names (RFC 2640)
# Set the charset of the server filesystem and optionally the default charset
# for remote clients that don't use UTF-8.
# Works only if pure-ftpd has been compiled with --with-rfc2640

# FileSystemCharset                big5
# ClientCharset                    big5
2
0

put a file /etc/pure-ftpd/conf/AltLog containing just stats:/var/log/pureftpd.log - this should solve the missing-log-issue (when pure-ftpd.conf is located within /etc/pure-ftpd/).

1
  • @user452599 it would be helpful to provide a source and/or explanation to your answer for the benefit of the community. – marshki Feb 1 at 17:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.